What This Book Covers

Chapter 1    This chapter lays the foundation for the rest of the book. It discusses the need for computer forensics and how the examiners' activities meet the need.

Chapter 2    This chapter addresses the necessary knowledge you must have before you start. When you finish this chapter, you will know how to prepare for an investigation.

Chapter 3    This chapter discusses computer evidence and focuses on identifying, collecting, preserving , and analyzing evidence.

Chapter 4    Most investigations include similar common tasks. This chapter outlines those tasks you are likely to see over and over. It sets the stage for the action items you will use in your activities.

Chapter 5    This chapter covers the first functional step in many investigations. You will learn the reason for and the process of creating media images for analysis.

Chapter 6    After you have an exact media image, you can start analyzing it for evidence. This chapter covers the basics of data analysis. You will learn what to look for and how to find it.

Chapter 7    Sooner or later, you will run into password-protected resources and encrypted files. This chapter covers basic encryption and password issues and discusses how to deal with them.

Chapter 8    Every computer examiner needs a tool box. This chapter covers many popular hardware and software forensic tools.

Chapter 9    When the analysis is done, you need to present the results. This chapter covers the elements and flow of an investigation report.

Chapter 10    If your evidence ends up in court, you need to know how to effectively present it. This chapter covers many ins and outs of being an expert witness and presenting evidence in court .

Appendix A    Provides the answers to the Review Questions

Appendix B    A list of forensics resources you can use for further research

Appendix C    A list of computer forensics certifications and contact information

Appendix D    A summary list of forensic tools, several of which are discussed in the text, with contact information

Glossary    A list of terms used throughout the book