Building a Digital Forensic Laboratory
Establishing and Managing a Successful Facility
Published on 19. April 2011
312 pages
978-0-08-094953-6 (ISBN)
Description
The need to professionally and successfully conduct computer forensic investigations of incidents and crimes has never been greater. This has caused an increased requirement for information about the creation and management of computer forensic laboratories and the investigations themselves. This includes a great need for information on how to cost-effectively establish and manage a computer forensics laboratory. This book meets that need: a clearly written, non-technical book on the topic of computer forensics with emphasis on the establishment and management of a computer forensics laboratory and its subsequent support to successfully conducting computer-related crime investigations.
- Provides guidance on creating and managing a computer forensics lab
- Covers the regulatory and legislative environment in the US and Europe
- Meets the needs of IT professionals and law enforcement as well as consultants
More details
Other editions
Additional editions
Andrew Jones | Craig Valli
Building a Digital Forensic Laboratory
Establishing and Managing a Successful Facility
Book
11/2008
Syngress
€79.00
Shipment within 10-15 days
Persons
Dr. Andrew Jones is a digital forensic and information security researcher and academic and has developed several tools and processes for the efficient and effective recovery of data from a range of devices. He has also participated and led a number of forensic investigations for criminal and civil cases.Andrew has been involved in several information security projects for the Government Communications Electronic Security Group (CESG), the Office of the E-Envoy, the police and a defense contractor. He acted as the technical advisor for the then National Crime Squad Data Acquisition and Recovery Team and he is currently on the committees for five information security and computer forensic conferences. He also sat on two working groups of the governments Central Sponsor for Information Assurance National Information Assurance Forum. He holds posts as an adjunct professor at Edith Cowan University in Perth, Australia and the University of South Australia in Adelaide.He has authored six books in the areas of Information Warfare, Information Security and Digital Forensics, including co-authoring Digital Forensics Processing and Procedures, First Edition.
Content
SECTION I: Computer Related Crime Investigations and Computer Forensics Management Support.This section provides a background to computer crime and addresses the Computer Forensics management issues related to Computer Forensic Incidents and Crime Investigations. It looks at how investigations are carried out, what needs to be considered in the planning of an investigation and the conduct of the investigation including the collection and storage of evidence. The section finishes with a number of case studies to highlight how things can go well if they are done properly and how they can go wrong if they are not.Chapter 1. A Short History of Computer-Related Crimes and the Developing Need for Computer Forensics. This chapter will provide an overview of computer-related crimes from the less sophisticated and localized dial-up computer crimes to today's sophisticated, global, network attacks; as well as the history of the development of the computer forensics profession and increasingly formal computer forensics laboratories. Chapter 2. An Introduction to Computer Forensics. This chapter provides an overview of the important concepts associated with "computer forensics." It describes the potential sources of evidence available in the typical microcomputer, how to conduct a search for evidence, and a method of conducting a search in a systematic and effective manner.Chapter 3. Types of Forensic Investigation. This chapter will include the reasons for carrying out the investigation and the type of investigation that is being undertaken, for example single computer, network or mobile devices.Chapter 4. Responding to Crimes requiring Computer Forensic Investigation. This chapter will talk about what actions are required, the management considerations and just as importantly, what should not be done when responding to a high tech crime scene. It will deal with the differing requirements that must be considered for the range of types of investigation that the laboratory may be called on to take part in including; stand alone PCs, Servers, Networks, Live Acquisition and wireless and will discuss the management issues that relate to the use of function specific tools.Chapter 5. Management of the Collections of Evidence. As the title states, this chapter will talk about the management issues that relate to the collection of high technology crime scene evidence, a crucial part of any high technology investigation. It will also deal with issues such as continuity of evidence in of custody.Chapter 6. Management of evidence storage. This chapter will address the issues that relate to the storage of evidence and the management issues that need to be considered to ensure that it is carried out effectively and to meet the relevant rules and legislation. We will also address the difficult question of long term storage periods, a particular problem for Law Enforcement.Chapter 7. High Technology Crimes: Case Summaries. This chapter gives a range of cases that illustrate the types of incidents that may be encountered under the general grouping of high technology crimes. There are examples of cases that have been successful and other examples that highlight that a lack of good procedures can lead to considerable expense, loss of credibility and embarrassment. This chapter will also address the specific roles that the computer forensics laboratory and staff play in each of the cases cited. SECTION II: Creating a Computer Forensics Laboratory. This Section will provide a background explanation of Computer Forensics and address management issues related to the creation of a laboratory and a computer forensic investigations laboratory. The section will include an introduction to computer forensics and the types of investigation that may be encountered and will give advice on things that need to be considered when establishing a laboratory.
