Digital Forensics for Legal Professionals: Understanding Digital Evidence From The Warrant To The Courtroom

Cover......Page 1
Front Matter......Page 2
ISBN:  9781597496438......Page 3
Copyright\r......Page 4
Intended Audience......Page 20
Section I: Overview of Digital Forensics......Page 21
Section II: Experts......Page 22
Section III: Motions and Discovery......Page 23
Section IV: Common Types of Digital Evidence......Page 25
Acknowledgments......Page 28
Dedication......Page 29
About the Authors......Page 30
About the Tech Editors......Page 32
1.1 What is Digital Forensics?......Page 35
1.2 What is Digital Evidence?......Page 36
1.3 How Digital Evidence is Created And Stored......Page 37
Summary......Page 41
2.1 Digital Forensics......Page 43
2.1.3 Analysis......Page 44
2.2 A Little Computer History......Page 45
2.3 A Brief History of Computer Forensics......Page 46
2.4 Computer Forensics Becomes Digital Forensics......Page 47
Summary......Page 48
3.1 The Subdisciplines......Page 49
3.2.1 Incident response......Page 50
3.2.3 GPS forensics......Page 51
3.2.5 Social media forensics......Page 52
3.2.7 Digital camera forensics......Page 53
3.2.10 Game console forensics......Page 54
Summary......Page 55
4.1 Who Establishes Best Practices?......Page 57
4.3.1 Volatile data and live forensics......Page 58
4.3.2 Preservation best practices......Page 59
4.3.3 Acquisition best practices......Page 60
4.4 What Really Happens in Many Cases......Page 63
Summary......Page 64
Introduction......Page 65
5.1 What Makes a Tool Forensically Sound?......Page 66
5.2 Who Performs Tool Testing?......Page 67
5.4 Classes of Forensics tools......Page 68
References......Page 70
6.1 Mitigation......Page 73
6.3 Trial Preparation......Page 74
6.4.1 A civil case example......Page 75
6.4.2 Criminal trial example......Page 80
Summary......Page 84
7.1 Why Hire a Digital Forensics Expert?......Page 87
7.2 When to Hire a Digital Forensics Expert......Page 89
Summary......Page 90
8.1 The Computer Expert......Page 91
8.2 The Digital Forensics Expert......Page 93
8.3 A Side-by-Side Comparison......Page 95
8.4.1 What does it mean to “investigate”?......Page 96
Summary......Page 98
9.1 What is an Expert?......Page 99
9.2 Locating and Selecting an Expert......Page 101
9.2.3 What type of case do you have?......Page 102
9.2.4.1 Prequalification questions......Page 103
9.2.6 How can you tell what is a reasonable fee quote?......Page 104
9.3 Certifications......Page 105
9.4 Training, Education, and Experience......Page 106
9.5 The Right Forensic Tools......Page 107
References......Page 108
10.1 General Expectations......Page 109
10.2.1 Sample protocol for evidence collection by a third or opposing party......Page 110
10.4 Court Preparation......Page 113
10.5 Expert Advice......Page 114
Summary......Page 115
11.1 Standards......Page 117
11.2 Training and Experience......Page 118
11.4 Ethics......Page 119
11.5 The Approach to an Examination......Page 120
References......Page 121
12.1.1 Verifiable experience and criminal records......Page 123
12.1.4 Appearance matters......Page 124
Summary......Page 125
13.1 Qualifying an Expert......Page 127
13.1.3 Certifications......Page 128
13.1.6 Education......Page 129
13.2.1 Sample qualification questions......Page 130
Reference......Page 131
14.1 Discovery Motions in Civil and Criminal Cases......Page 135
14.1.1.2 Common challenges in civil cases......Page 136
Summary......Page 137
15.1 Sources of Digital Evidence......Page 139
15.2.1 Discovery motion specifics......Page 140
Summary......Page 143
Introduction......Page 145
16.2 Electronic Discovery in Particular......Page 146
16.4 Getting to the Particulars......Page 147
16.4.4 Where might electronic evidence be stored?......Page 148
16.4.5 Who has control of the electronic evidence you need to collect?......Page 149
16.5 Getting the Electronic Evidence......Page 150
Summary......Page 152
References......Page 153
17.1 An Example of a Simple Consent to Search Agreement......Page 155
17.2 Example of a Simple Order for Expedited Discovery......Page 156
17.3 Example of an Order for Expedited Discovery and Temporary Restraining Order......Page 157
Summary......Page 159
18.1 Common Issues with Video Evidence......Page 161
18.1.2.2 File formats and video programs......Page 162
18.3 Example Discovery Language for Video Evidence......Page 164
Summary......Page 165
19.1 Common Issues with Audio Evidence......Page 167
19.1.3 Audio metadata......Page 168
19.2 Example Discovery Language for Audio Evidence......Page 169
Summary......Page 170
20.1 Legal Issues in Social Media Discovery......Page 171
20.3.1 Sample language to include for Facebook......Page 172
20.4.1 Google blogger example......Page 173
20.5 Online E-Mail Accounts......Page 174
References......Page 175
21.1 The Adam Walsh Child Protection and Safety Act of 2006......Page 177
21.2.2 The second round of discovery......Page 179
References......Page 181
22.1 Internet Service Provider Records or IP Addresses......Page 183
22.1.1.1 Using the ping command......Page 184
22.1.2 Motion language once you know the IP address......Page 186
22.2 Example Language for Web-Based E-Mail Addresses......Page 187
Summary......Page 188
23.1 GPS Tracking Evidence Overview......Page 189
23.1.1 Categories of potential GPS tracking evidence......Page 190
23.2.1 Language for getting a GPS device for examination......Page 191
23.2.2 Language for getting information from a manufacturer about a device......Page 192
Summary......Page 193
24.1 Discovery Issues in Cellular Evidence......Page 195
24.2 Example Language for Call Detail Records......Page 196
Summary......Page 197
25.1 Justifying Extraordinary Expenses......Page 199
25.2 Example Language for an Ex Parte Motion for Expert Funds......Page 201
Summary......Page 202
26.1 Hash Values......Page 205
26.2 How Hash Values are Used in Digital Forensics......Page 206
26.2.1 Using hash values to find hidden files......Page 207
26.2.4 The dangers of court testimony without verification......Page 208
Summary......Page 209
27.1 The Purpose of Metadata......Page 211
27.2.2.2 Browser metadata......Page 212
27.2.3 Document metadata......Page 213
27.2.4 Picture metadata......Page 215
Summary......Page 218
28.1 Thumbnails and the Thumbnail Cache......Page 219
28.2 How Thumbnails and the Thumbnail Cache Work......Page 220
28.2.1 When are these thumbs.db cache files created?......Page 221
28.2.3 Thumbs.db and networked drives......Page 222
28.3 Thumbnails and the Thumbnail Cache as Evidence......Page 223
Reference......Page 226
29.1 How Data is Stored on a Hard Drive......Page 227
29.1.1 Hard drive data storage structure......Page 229
29.2 Deleted File Recovery......Page 231
29.2.1.1 Simple file recovery using forensic software......Page 232
29.2.2.1 File carving......Page 233
29.3.1 Physical destruction......Page 236
Summary......Page 237
Introduction......Page 239
30.2 Fundamental Issues in Forensic Analysis of Timeline......Page 240
30.3 Created, Modified, Accessed......Page 241
Summary......Page 243
31.1 What is Web Caching?......Page 245
31.2 How Internet Browser (Web) Caching Works......Page 246
31.3 Internet (Web) Caching As Evidence......Page 247
Summary......Page 250
32.1 The Purpose of Link Files, How They are Created, and How They Work......Page 251
32.3 Link Files as Evidence......Page 253
32.3.1 Using link files to show that a file was accessed by the user......Page 254
32.3.4 Connecting a deleted file on a computer to a USB device using link file evidence......Page 255
Summary......Page 256
33.1 An Overview of the Cellular Phone System......Page 257
33.2 How Cell Phones Work......Page 261
33.2.1 Anatomy of a Cell Phone Call......Page 262
33.3 Call Detail Records......Page 263
33.4 Call Detail Records as Evidence of Cell Phone Location......Page 264
33.4.1 A Cell Tower Location Example......Page 265
33.5 Enhanced 911 Wireless Location Services......Page 266
33.6 The E911 System Overview......Page 267
Reference......Page 269
34.1 E-mail as Evidence......Page 271
34.2.1 Server-based storage......Page 272
34.2.2 User-based E-mail Storage......Page 273
34.3 Web Mail......Page 275
Reference......Page 276
35.1 Common Forms of Social Networking (Social Media)......Page 277
35.2 Evidence Out in the Open......Page 278
35.4 The Allure of Anonymity......Page 279
35.4.1 Hobby or obsession?......Page 280
35.5.1 Connecting evidence from a device to social media evidence......Page 281
Summary......Page 282
References......Page 283
36.2 How it Works......Page 285
36.2.2 Using a file-sharing program......Page 287
36.3 Privacy and Security Issues with Peer-to-Peer File Sharing......Page 289
36.4.1 Investigating file-sharing networks......Page 290
Reference......Page 293
Introduction......Page 295
37.1 The Fragile Nature of Cellular Evidence......Page 296
37.2 Forensic Acquisition Methods for Cellular Phones......Page 297
37.2.3 Manual examinations......Page 298
37.4 Cell Phone Backup Files......Page 300
37.5 Advanced Cell Phone Data Analytics......Page 301
37.6 The Future of Cell Phone Forensics......Page 302
Summary......Page 303
References......Page 304
38.1.1 Documentation......Page 305
38.1.2 Knowing how your tools work......Page 306
38.2 Using Video and Photo Evidence in Cases......Page 307
38.2.1 Enhancing an image or video......Page 311
38.2.2 Determining the authenticity of a video or image......Page 314
Summary......Page 318
39.1 Databases in Everyday Life......Page 319
39.2.1 What is a database management system?......Page 320
39.2.2 Modern databases......Page 321
39.3 Database Files as Evidence......Page 323
39.5 Data as Evidence......Page 324
Summary......Page 325
40.1 Accounting and Money Management Programs......Page 327
40.3.1 Small business accounting software......Page 328
40.4 Getting the Evidence......Page 329
40.5 Types of Evidence from Financial Software......Page 330
40.7 Other Sources of Financial Evidence......Page 331
Summary......Page 332
41.1 The Culture of Massively Multiplayer Online Role Playing Games (MMORPGs)......Page 333
41.2.1.1 Client-side timeline evidence......Page 336
41.2.2 Content evidence......Page 338
Summary......Page 339
References......Page 340
42.1 An Overview of Global Positioning Systems......Page 341
42.2 An Overview of the Navstar Global Positioning System......Page 342
42.3.1 How geolocation works using GPS......Page 343
42.4 Types of GPS Evidence......Page 344
42.4.2 Track points and track logs......Page 345
42.5.1 Preservation of GPS data......Page 346
42.5.3 Service-based data collection......Page 347
42.6.2 Map errors......Page 348
Summary......Page 350
References......Page 351
Index\r......Page 353