جرم‌شناسی کامپیوتری: اصول پاسخ به حوادث

Every computer crime leaves tracks―you just have to know where to find them. This book shows you how to collect and analyze the digital evidence left behind in a digital crime scene. Computers have always been susceptible to unwanted intrusions, but as the sophistication of computer technology increases so does the need to anticipate, and safeguard against, a corresponding rise in computer-related criminal activity. Computer forensics, the newest branch of computer security, focuses on the aftermath of a computer security incident. The goal of computer forensics is to conduct a structured investigation to determine exactly what happened, who was responsible, and to perform the investigation in such a way that the results are useful in a criminal proceeding. Written by two experts in digital investigation, Computer Forensics provides extensive information on how to handle the computer as evidence. Kruse and Heiser walk the reader through the complete forensics process―from the initial collection of evidence through the final report. Topics include an overview of the forensic relevance of encryption, the examination of digital evidence for clues, and the most effective way to present your evidence and conclusions in court. Unique forensic issues associated with both the Unix and the Windows NT/2000 operating systems are thoroughly covered. This book provides a detailed methodology for collecting, preserving, and effectively using evidence by addressing the three A's of computer forensics: Acquire the evidence without altering or damaging the original data. Authenticate that your recorded evidence is the same as the original seized data. Analyze the data without modifying the recovered data. Computer Forensics is written for everyone who is responsible for investigating digital criminal incidents or who may be interested in the techniques that such investigators use. It is equally helpful to those investigating hacked web servers, and those who are investigating the source of illegal pornography. 0201707195B09052001

"Computer Forensics, Incident Response Essentials is a phenomenal introduction to the tools and techniques for computer forensic response. The book listed a number of tools that I had never heard of before. I can't wait to download several of these and take them for a spin."
—Stephen Northcutt, The SANS Institute

Every computer crime leaves tracks—you just have to know where to find them. This book shows you how to collect and analyze the digital evidence left behind in a digital crime scene.

Computers have always been susceptible to unwanted intrusions, but as the sophistication of computer technology increases so does the need to anticipate, and safeguard against, a corresponding rise in computer-related criminal activity.

Computer forensics, the newest branch of computer security, focuses on the aftermath of a computer security incident. The goal of computer forensics is to conduct a structured investigation to determine exactly what happened, who was responsible, and to perform the investigation in such a way that the results are useful in a criminal proceeding.

Written by two experts in digital investigation, Computer Forensics provides extensive information on how to handle the computer as evidence. Kruse and Heiser walk the reader through the complete forensics process—from the initial collection of evidence through the final report. Topics include an overview of the forensic relevance of encryption, the examination of digital evidence for clues, and the most effective way to present your evidence and conclusions in court. Unique forensic issues associated with both the Unix and theWindows NT/2000 operating systems are thoroughly covered.

This book provides a detailed methodology for collecting, preserving, and effectively using evidence by addressing the three A's of computer forensics:

• Acquire the evidence without altering or damaging the original data.
• Authenticate that your recorded evidence is the same as the original seized data.
• Analyze the data without modifying the recovered data.

Computer Forensics is written for everyone who is responsible for investigating digital criminal incidents or who may be interested in the techniques that such investigators use. It is equally helpful to those investigating hacked web servers, and those who are investigating the source of illegal pornography.

Every computer crime leaves tracks―you just have to know where to find them. This book shows you how to collect and analyze the digital evidence left behind in a digital crime scene. Computer forensics, the newest branch of computer security, focuses on the aftermath of a computer security incident. The goal of computer forensics is to conduct a structured investigation to determine exactly what happened, who was responsible, and to perform the investigation in such a way that the results are useful in a criminal proceeding. This book provides a detailed methodology for collecting, preserving, and effectively using evidence by addressing the three A's of computer forensics: **__Computer Forensics__** is written for everyone who is responsible for investigating digital criminal incidents or who may be interested in the techniques that such investigators use. It is equally helpful to those investigating hacked web servers, and those who are investigating the source of illegal pornography. Cover Contents Preface Acknowledgments Chapter 1 Introduction to Computer Forensics Chapter 2 Tracking an Offender Chapter 3 The Basics of Hard Drives and Storage Media Chapter 4 Encryption and Forensics Chapter 5 Data Hiding Chapter 6 Hostile Code Chapter 7 Your Electronic Toolkit Chapter 8 Investigating Windows Computers Chapter 9 Introduction to Unix for Forensic Examiners Chapter 10 Compromising a Unix Host Chapter 11 Investigating a Unix Host Chapter 12 Introduction to the Criminal Justice System Chapter 13 Conclusion Appendix A: Internet Data Center Response Plan Appendix B: Incident Response Triage Questionnaire Appendix C: How to Become a Unix Guru Appendix D: Exporting a Windows 2000 Personal Certificate Appendix E: How to Crowbar Unix Hosts Appendix F: Creating a Linux Boot CD Appendix G: Contents of a Forensic CD Annotated Bibliography Index A B C D E F G H I J K L M N O P Q R S T U V W X Z "Computer Forensics provides extensive information on how to handle the computer as evidence. Kruse and Heiser walk the reader through the complete forensics process - from the initial collection of evidence through the final report. Topics include an overview of the forensic relevance of encryption, the examination of digital evidence for clues, and the most effective way to present your evidence and conclusions in court. Unique forensic issues associated with both the Unix and the Windows NT/2000 operating systems are thoroughly covered." "Computer Forensics is written for everyone who is responsible for investigating digital criminal incidents or who may be interested in the techniques that such investigators use. It is equally helpful to those investigating hacked web servers, and those who are investigating the source of illegal pornography."--Jacket Computer forensics is the newest branch of computer security. This handbook provides useful guidance on the types of incidents, the legal and regulatory issues, and how to gather evidence that will stick in court