Practical Guide to Digital Forensics Investigations, A uCertify Labs Access Code Card

THE DEFINITIVE GUIDE TO DIGITAL FORENSICS—NOW THOROUGHLY UPDATED WITH NEW TECHNIQUES, TOOLS, AND SOLUTIONS
Complete, practical coverage of both technical and investigative skills Thoroughly covers modern devices, networks, and the Internet Addresses online and lab investigations, documentation, admissibility, and more Aligns closely with the NSA Knowledge Units and the NICE Cybersecurity Workforce Framework
As digital crime soars, so does the need for experts who can recover and evaluate evidence for successful prosecution. Now, Dr. Darren Hayes has thoroughly updated his definitive guide to digital forensics investigations, reflecting current best practices for securely seizing, extracting and analyzing digital evidence, protecting the integrity of the chain of custody, effectively documenting investigations, and scrupulously adhering to the law, so that your evidence is admissible in court.
Every chapter of this new Second Edition is revised to reflect newer technologies, the latest challenges, technical solutions, and recent court decisions. Hayes has added detailed coverage of wearable technologies, IoT forensics, 5G communications, vehicle forensics, and mobile app examinations; advances in incident response; and new iPhone and Android device examination techniques. Through practical activities, realistic examples, and fascinating case studies, you'll build hands-on mastery—and prepare to succeed in one of today's fastest-growing fields.
LEARN HOW TO
  • Understand what digital forensics examiners do, the evidence they work with, and the opportunities available to them
  • Explore how modern device features affect evidence gathering, and use diverse tools to investigate them
  • Establish a certified forensics lab and implement best practices for managing and processing evidence
  • Gather data online to investigate today's complex crimes
  • Uncover indicators of compromise and master best practices for incident response
  • Investigate financial fraud with digital evidence
  • Use digital photographic evidence, including metadata and social media images
  • Investigate wearable technologies and other “Internet of Things” devices
  • Learn new ways to extract a full fi le system image from many iPhones
  • Capture extensive data and real-time intelligence from popular apps
  • Follow strict rules to make evidence admissible, even after recent Supreme Court decisions

1133662457
Practical Guide to Digital Forensics Investigations, A uCertify Labs Access Code Card

THE DEFINITIVE GUIDE TO DIGITAL FORENSICS—NOW THOROUGHLY UPDATED WITH NEW TECHNIQUES, TOOLS, AND SOLUTIONS
Complete, practical coverage of both technical and investigative skills Thoroughly covers modern devices, networks, and the Internet Addresses online and lab investigations, documentation, admissibility, and more Aligns closely with the NSA Knowledge Units and the NICE Cybersecurity Workforce Framework
As digital crime soars, so does the need for experts who can recover and evaluate evidence for successful prosecution. Now, Dr. Darren Hayes has thoroughly updated his definitive guide to digital forensics investigations, reflecting current best practices for securely seizing, extracting and analyzing digital evidence, protecting the integrity of the chain of custody, effectively documenting investigations, and scrupulously adhering to the law, so that your evidence is admissible in court.
Every chapter of this new Second Edition is revised to reflect newer technologies, the latest challenges, technical solutions, and recent court decisions. Hayes has added detailed coverage of wearable technologies, IoT forensics, 5G communications, vehicle forensics, and mobile app examinations; advances in incident response; and new iPhone and Android device examination techniques. Through practical activities, realistic examples, and fascinating case studies, you'll build hands-on mastery—and prepare to succeed in one of today's fastest-growing fields.
LEARN HOW TO
  • Understand what digital forensics examiners do, the evidence they work with, and the opportunities available to them
  • Explore how modern device features affect evidence gathering, and use diverse tools to investigate them
  • Establish a certified forensics lab and implement best practices for managing and processing evidence
  • Gather data online to investigate today's complex crimes
  • Uncover indicators of compromise and master best practices for incident response
  • Investigate financial fraud with digital evidence
  • Use digital photographic evidence, including metadata and social media images
  • Investigate wearable technologies and other “Internet of Things” devices
  • Learn new ways to extract a full fi le system image from many iPhones
  • Capture extensive data and real-time intelligence from popular apps
  • Follow strict rules to make evidence admissible, even after recent Supreme Court decisions

66.99 In Stock
Practical Guide to Digital Forensics Investigations, A uCertify Labs Access Code Card

Practical Guide to Digital Forensics Investigations, A uCertify Labs Access Code Card

by Darren Hayes
Practical Guide to Digital Forensics Investigations, A uCertify Labs Access Code Card

Practical Guide to Digital Forensics Investigations, A uCertify Labs Access Code Card

by Darren Hayes

eBook

$66.99 

Available on Compatible NOOK devices, the free NOOK App and in My Digital Library.
WANT A NOOK?  Explore Now

Related collections and offers


Overview


THE DEFINITIVE GUIDE TO DIGITAL FORENSICS—NOW THOROUGHLY UPDATED WITH NEW TECHNIQUES, TOOLS, AND SOLUTIONS
Complete, practical coverage of both technical and investigative skills Thoroughly covers modern devices, networks, and the Internet Addresses online and lab investigations, documentation, admissibility, and more Aligns closely with the NSA Knowledge Units and the NICE Cybersecurity Workforce Framework
As digital crime soars, so does the need for experts who can recover and evaluate evidence for successful prosecution. Now, Dr. Darren Hayes has thoroughly updated his definitive guide to digital forensics investigations, reflecting current best practices for securely seizing, extracting and analyzing digital evidence, protecting the integrity of the chain of custody, effectively documenting investigations, and scrupulously adhering to the law, so that your evidence is admissible in court.
Every chapter of this new Second Edition is revised to reflect newer technologies, the latest challenges, technical solutions, and recent court decisions. Hayes has added detailed coverage of wearable technologies, IoT forensics, 5G communications, vehicle forensics, and mobile app examinations; advances in incident response; and new iPhone and Android device examination techniques. Through practical activities, realistic examples, and fascinating case studies, you'll build hands-on mastery—and prepare to succeed in one of today's fastest-growing fields.
LEARN HOW TO
  • Understand what digital forensics examiners do, the evidence they work with, and the opportunities available to them
  • Explore how modern device features affect evidence gathering, and use diverse tools to investigate them
  • Establish a certified forensics lab and implement best practices for managing and processing evidence
  • Gather data online to investigate today's complex crimes
  • Uncover indicators of compromise and master best practices for incident response
  • Investigate financial fraud with digital evidence
  • Use digital photographic evidence, including metadata and social media images
  • Investigate wearable technologies and other “Internet of Things” devices
  • Learn new ways to extract a full fi le system image from many iPhones
  • Capture extensive data and real-time intelligence from popular apps
  • Follow strict rules to make evidence admissible, even after recent Supreme Court decisions


Product Details

ISBN-13: 9780134892948
Publisher: Pearson Education
Publication date: 10/16/2020
Series: Pearson IT Cybersecurity Curriculum (ITCC)
Sold by: Barnes & Noble
Format: eBook
Pages: 600
File size: 42 MB
Note: This product may take a few minutes to download.
Age Range: 18 Years

About the Author

Dr. Darren R. Hayes is a leading expert in the field of digital forensics and computer security. He is the Director of Digital Forensics and Associate Professor at Pace University, and he has been named one of the Top 10 Computer Forensics Professors by Forensics Colleges. He was selected as the recipient of the 2020 Homeland Security Investigations New York Private Sector Partnership Award.
During his time at Pace University, Hayes developed a Digital Forensics track for the University's Bachelor of Science in Information Technology degree in addition to his development of digital forensics graduate courses. He also created, and now manages, the Pace University Digital Forensics Research Laboratory, where he devotes must of his time to working with a team of students to support the efforts of law enforcement and the University's students. As part of his research and promoting this scientific field of study, he has fostered relationships with the New York Police Department, New York County D.A., Westchester County D.A., Homeland Security Investigations, National Crime Agency and numerous other agencies.
Hayes is not only an academic, however—he is also a practitioner. He has been an investigator on both civil and criminal investigations and frequently consults on cases for law firms. In fact, he has been declared an expert witness in U.S. federal court.
In New York City, Hayes has been working with six to eight public high schools to develop a curriculum in computer forensics and cybersecurity. He collaborates on computer forensics projects internationally and served as an extern examiner for the MSc in the Forensic Computing and Cybercrime Investigation degree program at University College Dublin for four years.
Hayes has appeared on CNBC, Bloomberg Television, MSNBC and Fox News and been quoted by Associated Press, CNN, Wall Street Journal, The Guardian (UK), The Irish Independent, Japan Times, Investor's Business Daily, MarketWatch, Newsweek, SC Magazine, Silicon Valley Business Journal, USA Today, Washington Post, and Wired News. His op-eds have been published by Homeland Security Today, USA Today, and The Hill's Congress Blog. In addition, he has authored a number of peerreviewed articles in many prominent academic journals. Hayes has been both an author and reviewer for Pearson Prentice Hall since 2007

Table of Contents

    Introduction xxxvii
Chapter 1: The Scope of Digital Forensics 2
    Popular Myths about Computer Forensics.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
    Types of Digital Forensic Evidence Recovered.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
    What Skills Must a Digital Forensics Investigator Possess?.. . . . . . . . . . . . . . . . . . . . 10
    The Importance of Digital Forensics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
    Job Opportunities.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
    A History of Digital Forensics.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
    Training and Education.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Chapter 2: Windows Operating and File Systems 34
    Physical and Logical Storage.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
    Paging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
    File Conversion and Numbering Formats.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
    Operating Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
    Windows Registry.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
    Microsoft Office.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
    Microsoft Windows Features.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Chapter 3: Handling Computer Hardware 92
    Hard Disk Drives.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
    Cloning a PATA or SATA Hard Disk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
    Removable Memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
    Reference.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Chapter 4: Acquiring Evidence in a Computer Forensics Lab 126
    Lab Requirements.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
    Private-Sector Computer Forensics Laboratories.. . . . . . . . . . . . . . . . . . . . . . . . . . . 130
    Computer Forensics Laboratory Requirements.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
    Extracting Evidence from a Device.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
    Skimmers.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
    Steganography. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
Chapter 5: Online Investigations 176
    Working Undercover.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
    Dark Web Investigations.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
    Virtual Currencies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
    Website Evidence.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
    Background Searches on a Suspect.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
    Online Crime. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
    Capturing Online Communications.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
    Edge Web Browser.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Chapter 6: Documenting the Investigation 224
    Obtaining Evidence from a Service Provider.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
    Documenting a Crime Scene.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
    Seizing Evidence.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
    Documenting the Evidence.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
    Using Tools to Document an Investigation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
    Writing Reports.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
    Using Expert Witnesses at Trial.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
Chapter 7: Admissibility of Digital Evidence 252
    History and Structure of the United States Legal System.. . . . . . . . . . . . . . . . . . . . . 253
    Evidence Admissibility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
    Constitutional Law.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
    When Computer Forensics Goes Wrong.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296
    Structure of the Legal System in the European Union (E.U.).. . . . . . . . . . . . . . . . . . . 296
    Privacy Legislation in Asia. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Chapter 8: Network Forensics and Incident Response 314
    The Tools of the Trade.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
    Networking Devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316
    Understanding the OSI Model.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
    Introduction to VoIP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346
    Incident Response (IR).. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348
    STIX, TAXII, and Cybox.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
    Advanced Persistent Threats.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
    Investigating a Network Attack. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
Chapter 9: Mobile Forensics 372
    The Cellular Network.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374
    Handset Specifications.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 389
    Mobile Operating Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
    Standard Operating Procedures for Handling Handset Evidence.. . . . . . . . . . . . . . . 401
    Handset Forensics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
    Manual Cellphone Examinations.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408
    Global Satellite Service Providers.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
    Legal Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
    Other Mobile Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413
    Documenting the Investigation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421
Chapter 10: Mobile App Investigations 426
    Static Versus Dynamic Analysis.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427
    Dating Apps.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441
    Rideshare Apps.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450
    Communication Apps.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458
Chapter 11: Photograph Forensics 460
    National Center for Missing and Exploited Children (NCMEC).. . . . . . . . . . . . . . . . . 462
    Project VIC.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463
    Case Studies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463
    Understanding Digital Photography.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464
    Examining Picture Files.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466
    Evidence Admissibility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470
    Case Studies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475
Chapter 12: Mac Forensics 480
    A Brief History.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480
    Apple Wi-Fi Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487
    Macintosh File Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
    Macintosh Operating Systems.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502
    Apple Mobile Devices.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507
    Performing a Mac Forensics Examination.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527
    Case Studies.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535
Chapter 13: Case Studies 538
    Silk Road.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 538
    Las Vegas Massacre.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549
    Zacharias Moussaoui.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
    BTK (Bind Torture Kill) Serial Killer.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555
    Cyberbullying.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 557
    Sports.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 564
    Assignment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 570
Chapter 14: Internet of Things (IoT) Forensics and Emergent Technologies 572
    5G.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573
    Wi-Fi 6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575
    Wi-Fi Mesh Networks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 576
    Shodan.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 576
    Mirai Botnet.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577
    Cryptocurrency Mining.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577
    Alexa.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578
    Micro-Chipping.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579
    Fitness Trackers.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579
    Apple Watch.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581
    Action Cameras.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 583
    Police Safety.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 583
    Police Vehicles.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585
    Vehicle Forensics.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585
    Low-Tech Solution for High-Tech Seizures.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 586
    Summary.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588
    Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588
    Assessment.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 590
Answer Key 594


9780789759917, TOC, 8/10/2020

From the B&N Reads Blog

Customer Reviews