CYBER CRIME INVESTIGATOR'S FIELD GUIDE

Cover
Half Title
Title Page
Copyright Page
Dedication
Table of Contents
Preface
About the Author
Chapter 1 The initial contact
	Chapter questions
Chapter 2 Client site arrival
	Chapter questions
Chapter 3 Evidence collection procedures
	You Are Now Sitting in Front of the victim’s system – What Should Your Approach Be?
	Let’s step back for a minute and look at the big network picture
	Malware
		Virus
			Encrypted
			Program
			Boot sector
			Multipartite
			Macro
			Stealth
			Hoax
			Polymorphic
			Armored
			Metamorphic
			Worm
			Trojan horse
			Ransomware
			Spyware
			Rootkit
			Spam
	Terminology
	Infection warning signs
	Network devices
	Microsoft Windows Operating Systems and file system types
	Detailed procedures for obtaining a bitstream backup of a hard drive
		Kali Linux
	Questions
Chapter 4 Evidence collection and analysis tools
	Safe back
	GetTime
	FileList, FileCnvt, and Excel
	GetFree
	Swap files and GetSwap
	GetSlack
	Temporary files
		Filter_I
			Filter
			Intel
			Names
		Key word generation
	TextSearch Plus
	CRCMD
	DiskSig
		Doc
		Mcrypt
		Micro-Zap
		Map
		M-Sweep
		Net Threat Analyzer
		AnaDisk
		Seized
		Scrub
		Spaces
		NTFS FileList
		NTFS GetFree
		NTFS GetSlack
		NTFS VIEW
		NTFS Check
		NTIcopy
		DiskSearch 32
	Magnet Forensics
	Chapter questions
Chapter 5 AccessData’s Forensic Toolkit
	Creating a case
	Working on an existing case
	Chapter questions
Chapter 6 Guidance Software’s EnCase
	Chapter questions
Chapter 7 ILook Investigator
	Chapter questions
Chapter 8 Password recovery
	Chapter questions
Chapter 9 Questions and answers by subject area
	Evidence collection
	Legal
	Evidence analysis
	Military
	Hackers
	BackTracing (TraceBack)
	Logs
	Encryption
	Government
	Networking
	E-Mail
Chapter 10 Recommended: Reference materials
	PERL and C Scripts
	UNIX, Windows, NetWare, and Macintosh
	Computer internals
	Computer networking
	Websites of interest
Chapter 11 Case study
	Travel security
	Wireshark and Python
	The Fallout
	Vendor status
	The target
	Let’s dance
	Recommendations
		Passwords
		SAM file
		Intrusion Detection Systems
		Insecure CGI Scripts
		BO/BO2K
Chapter 12 Rail transportation
Chapter 13 Transhumanism, robotics, and medical devices
Chapter 14 Memory and incident response system commands
Chapter 15 Making use of open-source intelligence (OSINT)
Appendix A: Glossary
Appendix B: Port numbers of interest
Appendix C: Attack signatures
Appendix D: UNIX/Linux commands
Appendix E: Cisco firewall commands
Appendix F: Discovering unauthorized access to your computer
Appendix G: Electromagnetic field analysis (EFA)
Appendix H: The intelligence community since 9/11
Appendix I: Answers to chapter questions
Index