Digital Forensics Explained

255 Pages·2021·7.947 MB·English

by  Greg Gogolin

Digital Forensics
Explained

Digital Forensics
Explained
Second Edition
Edited by
Greg Gogolin, PhD, CISSP
Second Edition published 2021
by CRC Press
6000 Broken Sound Parkway NW, Suite 300, Boca Raton, FL 33487-2742
and by CRC Press
2 Park Square, Milton Park, Abingdon, Oxon, OX14 4RN
© 2021 Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, LLC
First Edition published 2013
By CRC Press
Reasonable efforts have been made to publish reliable data and information, but the author and
publisher cannot assume responsibility for the validity of all materials or the consequences of
their use. The authors and publishers have attempted to trace the copyright holders of all material
reproduced in this publication and apologize to copyright holders if permission to publish in this
form has not been obtained. If any copyright material has not been acknowledged please write
and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or
hereafter invented, including photocopying, microfilming, and recording, or in any information
storage or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, access www.
copyright.com or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive,
Danvers, MA 01923, 978-750-8400. For works that are not available on CCC please contact
[email protected].
Trademark notice: Product or corporate names may be trademarks or registered trademarks, and
are used only for identification and explanation without intent to infringe.
ISBN: 9780367502812 (hbk)
ISBN: 9780367503437 (pbk)
ISBN: 9781003049357 (ebk)
Typeset in Sabon
by codeMantra
Contents
Preface xi
Acknowledgments xv
Author xvii
Contributors xix
1 What is digital forensics, and what should you know about it? 1
Introduction 1
Forensic science 1
What does it take to be a digital forensic investigator? 3
Educational opportunities 5
What opportunities are there for digital forensic investigators? 6
What are the trends and challenges in digital forensics? 7
Resources available to digital forensic investigators 11
Conclusion 13
References 13
2 Digital forensic approaches and best practices 15
Introduction 15
First response 17
Responding to a case 24
Conclusion 36
References 37
Other useful resources 37
3 Digital forensics tool kit 39
Introduction 39
Computer forensics 39
Write blockers 43
Imaging 44
v
vi Contents
Add-ons and other technologies 46
Tools 49
Mobile forensics tools 50
Visual analysis 53
Secured storage 53
Damaged media 53
Summary 54
References 54
4 Internet and e-mail examinations 55
Introduction 55
E-mail 55
Chat and messaging logs 56
Peer-to-peer 57
Search engine activity 57
Internet history 58
Social networking and gaming 59
Malware and viruses 60
Summary 63
5 Mobile forensics 65
Introduction 65
Mobile phone technology 65
How a call is made 66
Forensic challenges 67
Forensic process 68
Digital cell phone investigation 72
Geographic positioning systems 77
Cameras 77
Common extraction types 78
Information sources and location information 78
Summary 79
Cellular communications technology overview 79
References 81
6 Cloud computing and digital forensics 83
Introduction 83
Infrastructure as a service 85
Platform as a service 86
Software as a service 86
Contents vii
Service and deployment models 87
Customer versus cloud provider responsibilities 87
Other service models 89
Multi-tenancy 91
User access and provisioning 92
Data protection and breaches 94
Information technology and information security
governance and change control processes 97
Service access vulnerabilities 97
Migration planning 98
Incident response 100
Virtualization 101
Security benefits of cloud 101
7 Law enforcement incident response 103
Introduction 103
Case summary 103
The initiation of an investigation 103
Information 104
Evidence gathering 105
Interviews and the analysis of evidence 106
Analysis of the electronic evidence 108
Prosecution and testimony 110
Things to consider 111
Conclusion 113
8 Report writing and presentation 115
Introduction 115
Report content and considerations 115
Sample reports 118
Presenting and testifying 128
Dr. Otting’s thoughts on criminal case testimony 130
Archiving 131
Summary 131
9 Social media forensics 133
Introduction 133
Introduction to social media 134
Social networking 134
Micro blogs 135
viii Contents
Multimedia sharing 135
Instant messaging and communication 136
Blogs 138
Event coordination 138
Location identification 138
Search 138
Wikis 139
Web conferencing 139
Virtual worlds 139
Social media forensics 139
Street gangs 140
Terrorist activity 142
White collar crimes 144
Summary 145
References 149
10 Social engineering forensics 151
Introduction 151
Introduction to social engineering 152
Online social engineering attacks 152
Telephone social engineering attacks 153
Waste management social engineering attacks 154
Mobile device social engineering attacks 154
Personal social engineering attacks 155
Reverse social engineering attacks 157
Social engineering forensics 160
Summary 163
References 164
11 Anti-forensics 167
Anti-forensic definition and concepts 167
Anti-forensic methods 168
Eliminate trails 169
Hide evidence 172
Destroy evidence 178
Mobile anti-forensics 179
Conclusion 181
References 181
Contents ix
12 Link and visual analysis 183
Introduction 183
Link and visual analysis 183
Conclusion 191
13 Psychological, ethical, and cultural implications of
digital forensics 193
Introduction 193
Psychological implications of digital forensics 193
Prospective from the career in law enforcement of Dr. Otting 199
Ethical implications of digital forensics 200
Cultural implications of digital forensics 202
Conclusion 203
References 204
14 Someone is watching 205
Introduction 205
Case summary 205
Evidence gathering 206
Analysis of evidence 208
Summary 217
15 The realities of digital forensic practice 219
Introduction 219
The case – taking a look 219
Case #1 – things are not what they seem 220
Case #2 – things are not what they seem 221
Working a criminal case 221
Case #3 – conducting a thorough investigation 222
Case #4 – conducting a thorough investigation 224
Working a civil case 226
Things to keep in mind during any investigation 227
Summary 228
Index 229