Computer Forensics InfoSec Pro Guide

David Cowen, CISSP, is a partner at G-C Partners, LLC, where he provides expert witness services and consulting to Fortune 500 companies nationwide.

• IntroductionPART I: Getting StartedChapter 1: What Is Computer Forensics?What You Can Do with Computer ForensicsHow People Get Involved in Computer ForensicsLaw EnforcementMilitaryUniversity ProgramsIT or Computer Security ProfessionalsIncident Response vs. Computer ForensicsHow Computer Forensic Tools WorkTypes of Computer Forensic ToolsProfessional Licensing RequirementsChapter 2: Learning Computer ForensicsWhere and How to Get TrainingLaw Enforcement TrainingCorporate TrainingWhere and How to Get CertifiedVendor CertificationsVendor-Neutral CertificationsStaying CurrentConferencesBlogsForumsPodcastsAssociationsChapter 3: Creating a LabChoosing Where to Put Your LabAccess ControlsElectrical PowerAir ConditioningPrivacyGathering the Tools of the TradeWrite BlockersDrive KitsExternal StorageScrewdriver KitsAntistatic BagsAdaptorsForensic WorkstationChoosing Forensic SoftwareOpen Source SoftwareCommercial SoftwareStoring EvidenceSecuring Your EvidenceOrganizing Your EvidenceDisposing of Old EvidencePART II: Your First InvestigationChapter 4: How to Approach a Computer Forensics InvestigationThe Investigative ProcessWhat Are You Being Asked to Find Out?Where Would the Data Exist?What Applications Might Have Been Used in Creating the Data?Should You Request to Go Beyond the Scope of the Investigation?Testing Your HypothesisStep 1. Define Your HypothesisStep 2. Determine a Repeatable TestStep 3. Create Your Test EnvironmentStep 4. Document Your TestingThe Forensic Data LandscapeActive DataUnallocated SpaceSlack SpaceMobile DevicesExternal StorageWhat Do You Have the Authority to AccessWho Hosts the Data?Who Owns the Device?Expectation of PrivacyChapter 5: Choosing Your ProceduresForensic ImagingDetermining Your Comfort LevelForensic Imaging Method Pros and ConsCreating Forms and Your Lab ManualChain of Custody FormsRequest FormsReport FormsStandard Operating Procedures ManualChapter 6: Testing Your ToolsWhen Do You Need to TestCollecting Data for Public Research or PresentationsTesting a Forensic MethodTesting a ToolWhere to Get Test EvidenceRaw ImagesCreating Your Own Test ImagesForensic ChallengesLearn Forensics with David Cowen on YouTubeHoneynet ProjectDC3 ChallengeDFRWS ChallengeSANS Forensic ChallengesHigh School Forensic ChallengeCollections of Tool Testing ImagesDigital Forensic Tool Testing ImagesNIST Computer Forensics Reference Data Sets ImagesThe Hacking CaseNIST Computer Forensics Tool TestingChapter 7: Live vs. Postmortem ForensicsLive ForensicsWhen Live Forensics Is the Best OptionTools for Live ForensicsPostmortem ForensicsPostmortem Memory AnalysisChapter 8: Capturing EvidenceCreating Forensic Images of Internal Hard DrivesFTK Imager with a Hardware Write BlockerFTK Imager with a Software Write BlockerCreating Forensic Images of External DrivesFTK Imager with a USB Write BlockerFTK Imager with a Software Write BlockerSoftware Write Blocking on Linux SystemsCreating Forensic Images of Network SharesCapturing a Network Share with FTK ImagerMobile DevicesServersChapter 9: Nontraditional Digital ForensicsBreaking the Rules: Nontraditional Digital Forensic TechniquesVolatile ArtifactsMalwareEncrypted File SystemsChallenges to Accessing Encrypted DataMobile Devices: Smart Phones and TabletsSolid State DrivesVirtual MachinesPART III: Case Examples: How to Work a CaseChapter 10: Establishing the Investi