Contents

Cover

Contents

Title Page

Copyright

About the Authors

About the Technical Editor

Dedication

Acknowledgments

Introduction

Who Should Read This Book

What This Book Covers

Chapter 1: The Need for Computer Forensics

Defining Computer Forensics

Real-Life Examples of Computer Crime

Corporate versus Law Enforcement Concerns

Training

What Are Your Organization’s Needs?

Terms to Know

Review Questions

Chapter 2: Preparation—What to Do Before You Start

Know Your Hardware

Know Your Operating System

Know Your Limits

Develop Your Incident Response Team

Terms to Know

Review Questions

Chapter 3: Computer Evidence

What Is Computer Evidence?

Search and Seizure

Chain of Custody

Evidence Admissibility in a Court of Law

Leave No Trace

Terms to Know

Review Questions

Chapter 4: Common Tasks

Evidence Identification

Evidence Preservation

Evidence Analysis

Evidence Presentation

Terms to Know

Review Questions

Chapter 5: Capturing the Data Image

Full Volume Images

Partial Volume Image

Imaging/Capture Tools

Terms to Know

Review Questions

Chapter 6: Extracting Information from Data

What Are You Looking For?

How People Think

Picking the Low-Hanging Fruit

Hidden Evidence

Trace Evidence

Terms to Know

Review Questions

Chapter 7: Passwords and Encryption

Passwords

Encryption Basics

Common Encryption Practices

Strengths and Weaknesses of Encryption

Handling Encrypted Data

Terms to Know

Review Questions

Chapter 8: Common Forensics Tools

Disk Imaging and Validation Tools

Forensics Tools

Your Forensics Toolkit

Terms to Know

Review Questions

Chapter 9: Pulling It All Together

Begin with a Concise Summary

Document Everything, Assume Nothing

Formulating the Report

Sample Analysis Reports

Using Software to Generate Reports

Terms to Know

Review Questions

Chapter 10: How to Testify in Court

Preparation Is Everything

Appearance Matters

What Matters Is What They Hear

Know Your Forensics Process and Tools

Say Only What Is Necessary

Keep It Simple

Be Ready to Justify Every Step

Summary

Terms to Know

Review Questions

Appendix A: Answers to Review Questions

Chapter 1

Chapter 2

Chapter 3

Chapter 4

Chapter 5

Chapter 6

Chapter 7

Chapter 8

Chapter 9

Chapter 10

Appendix B: Forensics Resources

Information

Organizations

Publications

Services

Software

Training

Appendix C: Forensics Certifications

Advanced Information Security (AIS)

Certified Computer Examiner (CCE)

Certified Cyber-Crime Expert (C³E)

Certified Information Forensics Investigator (CIFI)

Certified Computer Crime Investigator (CCCI)

Certified Computer Forensic Technician (CCFT)

Certified Forensic Computer Examiner (CFCE)

Certified Information Systems Auditor (CISA)

EnCase Certified Examiner Program

GIAC Certified Forensic Analyst (GCFA)

Professional Certified Investigator (PCI)

Appendix D: Forensics Tools

Forensics Tool Suites

Password-Cracking Utilities

CD Analysis Utilities

Metadata Viewer Utility

Graphic Viewing Utility

Forensics Hardware Devices

Computer Forensics Training

Glossary

Index

Wiley End User License Agreement

Guide

Cover

Contents

Start Reading

Pages

i

ii

iii

iv

v

vi

xv

xvi

xvii

xviii

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

Computer Forensics JumpStart™

Michael G. Solomon

Diane Barrett

Neil Broom

Associate Publisher: Neil Edde

Acquisitions and Developmental Editor: Maureen Adams

Production Editor: Lori Newman

Technical Editor: Warren G. Kruse

Copyeditor: Kathy Grider-Carlyle

Compositor: Jeff Wilson, Happenstance Type-O-Rama

Graphic Illustrator: Jeff Wilson, Happenstance Type-O-Rama

Proofreaders: Ian Golder, Amy Rasmussen, Nancy Riddiough

Indexer: Nancy Guenther

Book Designer: Judy Fung

Cover Designer: Richard Miller, Calyx Design

Cover Illustrator: Richard Miller, Calyx Design

Copyright © 2005 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved. No part of this publication may be stored in a retrieval system, transmitted, or reproduced in any way, including but not limited to photocopy, photograph, magnetic, or other record, without the prior agreement and written permission of the publisher.

Library of Congress Card Number: 2004113397

ISBN: 0-7821-4375-X

SYBEX and the SYBEX logo are either registered trademarks or trademarks of SYBEX Inc. in the United States and/or other countries.

JumpStart is a trademark of SYBEX Inc.

Screen reproductions produced with FullShot 99. FullShot 99 © 1991-1999 Inbit Incorporated. All rights reserved.

FullShot is a trademark of Inbit Incorporated.

Internet screen shot(s) using Microsoft Internet Explorer 6 reprinted by permission from Microsoft Corporation.

TRADEMARKS: SYBEX has attempted throughout this book to distinguish proprietary trademarks from descriptive terms by following the capitalization style used by the manufacturer.

The author and publisher have made their best efforts to prepare this book, and the content is based upon final release software whenever possible. Portions of the manuscript may be based upon pre-release versions supplied by software manufacturer(s). The author and the publisher make no representation or warranties of any kind with regard to the completeness or accuracy of the contents herein and accept no liability of any kind including but not limited to performance, merchantability, fitness for any particular purpose, or any losses or damages of any kind caused or alleged to be caused directly or indirectly from this book.

About the Authors

Michael G. Solomon is a full-time security speaker, consultant (http://www.solomonconsulting.com/), trainer, and a former college instructor who specializes in development and assessment security topics. As an IT professional and consultant since 1987, he has worked on projects or trained for more than 60 major companies and organizations, including EarthLink, Nike Corporation, Lucent Technologies, BellSouth, UPS, the U.S. Coast Guard, and Norrell.

From 1998 until 2001, Michael was an instructor in the Kennesaw State University’s Computer Science and Information Sciences (CSIS) department, where he taught courses on software project management, C++ programming, computer organization and architecture, and data communications. Michael has an M.S. in mathematics and computer science from Emory University (1998) and a B.S. in computer science from Kennesaw State University (1987).

Michael has also contributed to various security certification books for LANWrights/iLearning, including TICSA Training Guide and an accompanying Instructor Resource Kit (Que, 2002), CISSP Study Guide (Sybex, 2003), as well as Security+ Training Guide (Que, 2003). Michael co-authored Information Security Illuminated (Jones and Bartlett, 2005), Security+ Lab Manual Exam Cram 2 (Que, 2005), and authored and provided the on-camera delivery of LearnKey’s CISSP Prep e-Learning course.

Michael’s certifications include Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), and TruSecure ICSA Certified Security Associate (TICSA).

Diane Barrett has been involved in the IT industry since 1993. She works at Remington College where she taught in the computer networking program for two years before becoming a director. She teaches online classes that include networking, security, and virus protection, and she is the president of a security awareness corporation that specializes in training.

Diane has co-authored several security and networking books, including MCSA/MCSE 70-299 Exam Cram 2: Implementing and Administering Security in a Windows Server 2003 Network (Que, 2004) and Computer Networking Illuminated (Jones and Bartlett, 2005). She is currently volunteering for ISSA’s Generally Accepted Information Security Principles Project in the ethical practices working group.

Diane’s certifications include Microsoft Certified Systems Engineer (MCSE) on Windows 2000, MCSE+I on Windows NT 4.0, Certified Information Systems Security Professional (CISSP), Cisco Certified Network Associate (CCNA), A+, Network+, i-Net+, and Security+.

Neil Broom is the President of the Technical Resource Center (http://www.trcglobal.com) in Atlanta, Georgia. As a speaker, trainer, course director, and consultant in the fields of Computer Forensics, Information Assurance, and Professional Security Testing, he has over 14 years of experience providing technical education and security services to the military, law enforcement, the health care industry, financial institutions, and government agencies.

Neil is the Lead Instructor and Developer of the Computer Forensics and Cyber Investigations course and the Certified Cyber Crime Examiner (C³E) certification and provides Computer Forensics services to clients in the Metro Atlanta area and the Southeast United States.

Neil is currently the Vice President of the Atlanta Chapter of the International Information Systems Forensics Association, and he is a professional member of the National Speakers Association. His past employment includes the U.S. Navy as a submariner, the Gainesville, Florida Police Department as a law enforcement officer, and Internet Security Systems (ISS) as a security trainer.

Neil has multiple certifications including Certified Information Systems Security Professional (CISSP), Certified Computer Examiner (CCE), Certified Ethical Hacker (CEH), Computer Hacking Forensic Investigator (CHFI), National Security Agency’s INFOSEC Assessment Methodology (IAM), Microsoft Certified Systems Engineer (MCSE 4.0 and 2000), Microsoft Certified Trainer (MCT), and TruSecure ICSA Certified Security Associate (TICSA).

About the Technical Editor

Warren G. Kruse II, CISSP, CFCE, is the co-author of Computer Forensics: Incident Response Essentials, published by Addison-Wesley. Warren has conducted forensics globally in support of cases involving some of the largest law firms and corporations in the world. He is a member of the New York and European Electronic Crimes Task Forces of the U.S. Secret Service. He was elected President of the High Tech Crime Investigation Association’s (www.htcia.org) 2005 International Executive Committee. Warren has extensive experience investigating cases involving the illegal use of computer and networks and received the High Tech Crime Investigation Association’s (HTCIA) “2001 Case of the Year” award. He is an IACIS Certified Forensic Computer Examiner (CFCE) and an (ISC)² Certified Information Systems Security Professional (CISSP). He lectures on computer forensics for Computer Security Institute (CSI) and has taught computer forensics at the SANS Institute and MIS Training Institute. He is the lead instructor of the handson intro and advanced Computer Forensics Bootcamps for Computer Forensic Services, LLC. Warren is a partner at Computer Forensic Services, LLC (www.computer-forensic.com).

To my wife, best friend, and source of unyielding support, Stacey.

—Michael G. Solomon

To my dad, Gerald, who has always encouraged me to be my own person.

—Diane Barrett

To my mother, thank you for always believing in me.

—Neil Broom

Acknowledgments

Anything worth doing is worth doing well, and doing anything well generally requires a lot of help. My family has helped me immensely throughout this project. Stacey, Noah, and Isaac are all great fun to be around and often serve as sounding boards. The one focal point of this book, however, is Kim Lindros at LANWrights/ iLearning. She kept the project on track and worked things out regardless of what curve balls I may have sent her way. Kim deserves a huge ovation for her work to get this book into your hands. I truly appreciate the efforts of all the people at LANWrights/iLearning and Sybex to make this project a reality.

—Michael G. Solomon

Thanks to everyone at Sybex for making this book possible, especially Maureen Adams the acquisitions editor and Lori Newman the production editor. Thank you to the wonderful team at LANWrights/iLearning, especially Kim Lindros, who worked so hard behind the scenes to be sure that our work was accurate and completed in a timely fashion. To co-authors Michael Solomon and Neil Broom, thank you for the part each of you played in making this project successful. Thanks to Warren G. Kruse II, our technical reviewer, for making certain our writing was technically and procedurally sound. Finally, special thanks to my husband, Bill, for keeping a sense of humor during the hours I spent writing.

—Diane Barrett

Kim Lindros, you rock! Thank you for all the support and gentle nudging you provided to keep me writing. I also wish to say thank you to the cat and kitten rescue group that I work with, www.FurKids.org. Now that the book is finished, I can return to helping save the lives of our furry little friends.

—Neil Broom

Introduction

Want to knows what computer forensics examiners really do? This book is intended to cover the essential basics of computer forensics, and it is especially designed for those new to the field. Many new stories and television shows highlight the role of forensics investigators in solving cases. It all seems so exciting, doesn’t it? Computer forensics is really not that different from what we see on TV. It’s quite a bit less glamorous, but similar in nature. To be honest, all forensics examiners lead lives that are a little less glamorous than what TV tells us.

After a crime or incident has occurred that involves a computer, a specialist trained in computer forensics can examine the computer to find clues as to what happened. That is the role of the computer forensics examiner. The specialist could work with law enforcement (LE) or with a corporate incident response team. Although the rules governing each activity can be dramatically different, the approach to the investigation is roughly the same.

This book covers the field of computer forensics, including the basic elements, concepts, tools, and common activities that will prepare you with a solid understanding of the field. You will be able to participate in investigations and understand the process of finding, collecting, and analyzing evidence. Although this book is not a definitive training guide for specific forensic tools, you will learn how to perform the most common tasks that you will encounter in an investigation.

The world’s heightened awareness of security since the attacks of September 11, 2001, has also provided more nontechnical people with a view of security issues that were previously discussed only in security specialist circles. Computers play a central role in all activities, both legal and illegal. The material in this book can be applied to both criminal investigations and incident response activities. You don’t have to be a member of law enforcement to benefit from the material presented here. Nontechnical people can also benefit from this book in that it covers the basic approach computer examiners take in an investigation.

If you like the comprehensive introduction to computer forensics we present in this book, you can pursue the topic further in several ways. Most major forensic tools vendors offer their own training on their products and their use in investigations. See Chapter 8, “Common Forensics Tools,” and Appendix D, “Forensics Tools,” for more information. Appendix B, “Forensics Resources,” contains many references to where you can get more information. If you decide to pursue computer forensic certification, Appendix C, “Forensics Certifications,” provides a list of common certifications and contact information for each. If your job involves computer investigations, this book can help you expand your knowledge and abilities. Keep it handy as a resource as you acquire more experience and knowledge. And good luck with your pursuit!

Who Should Read This Book

Anyone fulfilling, or aspiring to fulfill, the responsibilities of a computer examiner can benefit from this book. Also, if you just want to know more about what computer examiners do, this book will fill you in. The material is organized to provide a high-level view of the process and methods used in an investigation. Both LE personnel and non-LE will benefit from the topics presented.

Because you are reading this introduction, you must have some interest in computer forensics. Why are you interested? Are you just curious, do you want to start working in computer forensics, or have you just been given the responsibility of conducting or managing an investigation? This book addresses readers in all of these categories.

Although we recommend that you read the book from start to finish for a complete overview of the topics, you can jump right to an area of interest. If you bought this book for a concise list of forensics tools, go right to Chapter 8. But don’t forget the other chapters! You’ll find a wealth of information in all chapters that will help expand your understanding of computer forensics.

What This Book Covers

Chapter 1 This chapter lays the foundation for the rest of the book. It discusses the need for computer forensics and how the examiners’ activities meet the need.

Chapter 2 This chapter addresses the necessary knowledge you must have before you start. When you finish this chapter, you will know how to prepare for an investigation.

Chapter 3 This chapter discusses computer evidence and focuses on identifying, collecting, preserving, and analyzing evidence.

Chapter 4 Most investigations include similar common tasks. This chapter outlines those tasks you are likely to see over and over. It sets the stage for the action items you will use in your activities.

Chapter 5 This chapter covers the first functional step in many investigations. You will learn the reason for and the process of creating media images for analysis.

Chapter 6 After you have an exact media image, you can start analyzing it for evidence. This chapter covers the basics of data analysis. You will learn what to look for and how to find it.

Chapter 7 Sooner or later, you will run into password-protected resources and encrypted files. This chapter covers basic encryption and password issues and discusses how to deal with them.

Chapter 8 Every computer examiner needs a tool box. This chapter covers many popular hardware and software forensic tools.

Chapter 9 When the analysis is done, you need to present the results. This chapter covers the elements and flow of an investigation report.

Chapter 10 If your evidence ends up in court, you need to know how to effectively present it. This chapter covers many ins and outs of being an expert witness and presenting evidence in court.

Appendix A Provides the answers to the Review Questions

Appendix B A list of forensics resources you can use for further research

Appendix C A list of computer forensics certifications and contact information

Appendix D A summary list of forensic tools, several of which are discussed in the text, with contact information

Glossary A list of terms used throughout the book

Making the Most of This Book

At the beginning of each chapter you’ll find a list of topics that the chapter covers. You’ll find new terms (specific terminology) defined in the margins of the pages to help you quickly get up to speed on computer forensics. In addition, several special elements highlight important information:

NOTE

Notes provide extra information and references to related information.

TIP

Tips are insights that help you perform tasks more easily and effectively.

WARNING

Warnings let you know about things you should do—or shouldn’t do—as you perform computer investigations.

You’ll find Review Questions at the end of each chapter to test your knowledge of the material covered. The answers to the Review Questions can be found in Appendix A. You’ll also find a list of Terms to Know at the end of each chapter that will help you review the key terms introduced in the chapter. These terms are compiled in the Glossary at the end of the book.

You’ll also find special sidebars in each chapter titled “Tales from the Trenches,” written by Neil Broom. These are war stories Neil has encountered throughout his career as a computer forensics examiner. They are written in first person, so you’ll really get a sense of what it’s like to go “on scene” and get your hands dirty.

Chapter 1
The Need for Computer Forensics

In This Chapter

Defining computer forensics

Understanding corporate forensic needs

Understanding law enforcement forensics needs

Training practitioners

Training end users

Assessing your organization’s needs

Computer forensics is a fascinating field. As enterprises become more complex and exchange more information online, high-tech crimes are increasing at a rapid rate. The industry has taken off in recent years, and it’s no surprise that a profession once regarded as a vague counterpart of network security has grown into a science all its own. In addition, numerous companies and professionals now offer computer forensic services. A computer forensic technician is a combination of a private eye and a computer scientist. Although the ideal background for this field includes legal, technical, and law enforcement experience, a myriad of industries use professionals with investigative intelligence and technology proficiency. A computer forensic professional can fill a variety of roles such as private investigator, corporate compliance professional, or law enforcement official.

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!