FORENSIC COMPUTER CRIME INVESTIGATION
CONTENTS 1 COMPUTER CRIME AND THE ELECTRONIC CRIME SCENE I INTRODUCTION AND HISTORICAL DEVELOPMENTS II CRIME SCENES WITH DIGITAL AND ELECTRONIC EVIDENCE III COMPUTERS, ELECTRONIC EQUIPMENT, DEVICES, AND INFORMATION REPOSITORIES A THE VALUE OF EQUIPMENT AND INFORMATION B INFORMATION REPOSITORIES — INFORMATIONAL VALUE C INFORMATION COLLECTION D MANAGEMENT OF THE ELECTRONIC CRIME SCENE E ELECTRONIC CRIME SCENE PROCEDURES F INITIATING THE FORENSIC COMPUTER INVESTIGATION G INVESTIGATIVE TOOLS AND ELECTRONIC CRIME SCENE INVESTIGATION IV LEGAL ISSUES IN THE SEARCHING AND SEIZURE OF COMPUTERS A SEARCHING AND SEIZING COMPUTERS WITHOUT A WARRANT B SEARCHING AND SEIZING COMPUTERS WITH A WARRANT V SUMMARY REFERENCES 2 THE DIGITAL INVESTIGATIVE UNIT: STAF?NG, TRAINING, AND ISSUES I UNIT NAME II MISSION STATEMENT A ONE UNIT’S HISTORY III INVESTIGATIONS A RESPONSIBILITY B PROACTIVE VERSUS REACTIVE C PRODUCTIVITY AND METRICS D RESOURCES IV STAF?NG A CASE INVESTIGATOR B LAB SPECIALIST C SIMPLE CASE: DUAL ROLE D PARTICIPATION WITH OTHER AGENCIES E CIVIL SERVICE: PERFORMING OUT-OF-TITLE F RECRUITMENT, HIRING, AND RETENTION G ADMINISTRATIVE ISSUES H RETIREMENT I ADVANCEMENT AND REWARDING 1 UNAVAILABILITY OF PERSONNEL AND THE INTERCHANGEABLE MAN J MISUSE OF PERSONNEL K INTERVIEWING L TRAINING 3 CRIMINAL INVESTIGATION ANALYSIS AND BEHAVIOR: CHARACTERISTICS OF COMPUTER CRIMINALS I ANNALS OF PRO?LING II HISTORY A PREMODERN ANTECEDENTS B THE FBI ERA C SUCCESSES AND FAILURES III PRO?LING DE?NED A CIBA DE?NED IV REVIEW OF THE LITERATURE V UNCERTAINTIES A CONCEPTUAL CONSIDERATIONS B INVESTIGATIVE DILEMMAS C INTERAGENCY OBSTACLES D SCHOLARLY CONCERNS E RELATED ISSUES VI EDUCATION AND TRAINING VII SCIENCE OR ART? A THE STATUS QUO B PRO?LING PROCESS C RISK LEVELS 1 LOW RISK 2 MODERATE RISK 3 HIGH RISK B BEHAVIORAL ASSESSMENT OF THE CRIME SCENE 1 VICTIMOLOGY 2 TYPOLOGY VIII PREDICTIVE INDICATORS IX METHODOLOGY X INDICATORS OF FURTHER POSITIVE DEVELOPMENTS A NEUROLINGUISTIC ANALYSIS B NEUROTECHNOLOGY RESEARCH C CHECKMATE XI INSIDER THREAT XII THE FUTURE OF CYBERPRO?LING WEB SOURCES ACKNOWLEDGEMENTS 4 INVESTIGATIVE STRATEGY AND UTILITIES I INTRODUCTION II THE GROWING IMPORTANCE OF COMPUTER FORENSIC INVESTIGATIONS III COMPUTER CRIME INVESTIGATIONS VIEWED AS A SYSTEM IV IS THERE A CRIME? V WHO HAS JURISDICTION? VI GATHERING INTELLIGENCE ABOUT THE CASE VI DETERMINING THE CRITICAL SUCCESS FACTORS FOR A CASE VII GATHERING CRITICAL EVIDENCE IX THE RAID X PROCESSING: CRITICAL EVIDENCE RECOVERY FROM ELECTRONIC MEDIA 1 DRIVE DUPLICATION UTILITIES 2 SEARCH UTILITIES 3 GRAPHIC AND FILE VIEWER UTILITIES 4 RECOVERING DELETED EVIDENCE 5 DISK UTILITIES 6 HASH OR CHECKSUM UTILITIES 7 PASSWORDS AND ENCRYPTED MEDIA 8 EVIDENCE RECOVERY FROM RAM MEMORY 9 FORENSIC SUITE SOFTWARE 10 NETWORK DRIVE STORAGE XII THE INVESTIGATOR AS A DETERMINED INTRUDER XIII MAY?ELD’S PARADOX XIV CHAIN OF CUSTODY XV EXHIBITS, REPORTS, AND FINDINGS XVI EXPERT TESTIMONY XVII SUMMARY CREDITS 5 COMPUTER FORENSICS & INVESTIGATION: THE TRAINING ORGANIZATION I OVERVIEW II HANDS-ON TRAINING ENVIRONMENT III COURSE DESIGN IV SPECIALIZED OR UPDATE TRAINING V PERSONNEL VI EQUIPMENT VII MATERIALS VIII FUNDING IX RECORD KEEPING X TESTING AND CERTI?CATION XI SUMMATION 6 INTERNET CRIMES AGAINST CHILDREN I BACKGROUND II COMPUTER-ASSISTED AND INTERNET CRIMES AGAINST CHILDREN III LAW ENFORCEMENT EFFORTS IV CONCLUSION 7 CHALLENGES TO DIGITAL FORENSIC EVIDENCE I BASICS A FAULTS AND FAILURES B LEGAL ISSUES C THE LATENT NATURE OF EVIDENCE D NOTIONS UNDERLYING "GOOD PRACTICE" E THE NATURE OF SOME LEGAL SYSTEMS AND REFUTING CHALLENGES F OVERVIEW II IDENTIFYING EVIDENCE A COMMON MISSES B INFORMATION NOT SOUGHT C FALSE EVIDENCE D NONSTORED TRANSIENT INFORMATION E GOOD PRACTICE III EVIDENCE COLLECTION A ESTABLISHING PRESENCE B CHAIN OF CUSTODY C HOW THE EVIDENCE WAS CREATED D TYPICAL AUDIT TRAILS E CONSISTENCY OF EVIDENCE F PROPER HANDLING DURING COLLECTION G SELECTIVE COLLECTION AND PRESENTATION H FORENSIC IMAGING I NONSTORED TRANSIENT INFORMATION J SECRET SCIENCE AND COUNTERMEASURES IV SEIZURE ERRORS A WARRANT SCOPE EXCESS B ACTING FOR LAW ENFORCEMENT C WIRETAP LIMITATIONS AND TITLE 3 D DETECTING ALTERATION E COLLECTION LIMITS F GOOD PRACTICE G FAULT TYPE REVIEW V TRANSPORT OF EVIDENCE A POSSESSION AND CHAIN OF CUSTODY B PACKAGING FOR TRANSPORT C DUE CARE TAKES TIME D GOOD PRACTICE VI STORAGE OF EVIDENCE A DECAY WITH TIME B EVIDENCE OF INTEGRITY C PRINCIPLES OF BEST PRACTICES VII EVIDENCE ANALYSIS A CONTENT B CONTEXTUAL INFORMATION C MEANING D PROCESS ELEMENTS E RELATIONSHIPS F ORDERING OR TIMING G LOCATION H INADEQUATE EXPERTISE I UNRELIABLE SOURCES J SIMULATED RECONSTRUCTION K RECONSTRUCTING ELEMENTS OF DIGITAL CRIME SCENES L GOOD PRACTICE IN ANALYSIS 1 THE PROCESS OF ELIMINATION 2 THE SCIENTI?C METHOD 3 THE DAUBERT GUIDELINES 4 DIGITAL DATA IS ONLY A PART OF THE OVERALL PICTURE 5 JUST BECAUSE A COMPUTER SAYS SO DOESN’T MAKE IT SO VIII OVERALL SUMMARY 8 STRATEGIC ASPECTS IN INTERNATIONAL FORENSICS I THE CURRENT PROBLEM OF COORDINATED ATTACKS II THE NEW ANTIBACKTRACING AND ANTIFORENSICS TOOLS, AND ONION ROUTING A USING COVERT CHANNELS TO ELUDE TRAF?C ANALYSIS: NCOVERT B DIF?CULTIES IN BACKTRACING ONION ROUTER TRAF?C 1 THE GOAL: PROTECTION FROM TRAF?C ANALYSIS 2 ONION ROUTING: WHAT IT IS 3 THE DIFFERENCES WITH THE OTHER ANONYMIZERS 4 THE ONION ROUTING ROADMAP 5 A GLOSSARY OF PROJECT TERMS 6 THE POTENTIAL DANGERS OF ONION ROUTERS 7 ONION ROUTERS IN THE REAL WORLD: THE DUAL USE OF DUAL USE III PLANNING AN INTERNATIONAL BACKTRACING PROCEDURE: TECHNICAL AND OPERATIONAL ASPECTS A SOME COMMONLY USED TOOLS IN DIGITAL AND NETWORK FORENSICS 1 WHY USE FREEWARE AND OPEN SOURCE FOR DIGITAL FORENSICS? 2 TCPDUMP 3 SANITIZE 4 A SERIES OF QUESTIONS 5 MORE TOOLS 6 SNORT B THE CLF PARADIGM (COMMON LOG FORMAT) 1 WHERE THE LOGGING INFORMATION COULD BE FOUND IV PREVENTIVE METHODS: INFORMATION SHARING AND HONEYNETS A DEPLOYING HONEYNET: BACKGROUND AND IMPLICATIONS 1 LOW- AND HIGH-INTERACTION HONEYPOTS 2 TWO TYPES: MORE RISKS 3 HONEYPOTS IN DETAIL: THE VARIATIONS 4 HOW INVESTIGATORS CAN USE HONEYNETS V AN EXAMPLE OF INTERNATIONAL COOPERATION: OPERATION ROOT KIT VI CONCLUSIONS 9 CYBER TERRORISM I POLICY ISSUES REGARDING CYBER TERRORISM II CYBER TERROR POLICY ISSUES LINKING CONGRESS AND EXECUTIVE BRANCH OF GOVERNMENT A PROTECTION OF CRITICAL INFRASTRUCTURE SECTORS B SECURING CYBERSPACE III INFORMATION WARRIORS IV NET WAR AND CYBER WAR V CYBER INTELLIGENCE OR CYBER TERRORISM VI RESEARCH ISSUES IN CYBER TERRORISM VII SUMMARY 10 FUTURE PERSPECTIVES I NETWORK INFRASTRUCTURE: SECURITY CONCERNS II THE ROLE OF EDUCATION AND TRAINING III THE EMERGENCE OF A NEW ACADEMIC DISCIPLINE IV OUR NATION’S INVESTMENT IN CYBER SECURITY RESEARCH V RECOMMENDATIONS VI CONCLUSION 11 CONCLUDING REMARKS