Digital forensics for legal professionals : understanding digital evidence from the warrant to the courtroom / Larry Daniel, and Lars Daniel.

CONTENTS

CHAPTER 1: DIGITAL EVIDENCE IS EVERYWHERE
Introduction
what is digital forensics
what is digital evidence
how digital evidence is created and stored
summary

CHAPTER 2: OVERVIEW OF DIGITAL FORENSICS
introduction
digital forensics
a little computer history
a brief history of computer forensics
computer forensics becomes digital forensics
summary

CHAPTER 3: DIGITAL FORENSICS: THE SUBDISCIPLINES
introduction
the subdisciplines
computer forensics
summary

CHAPTER 4: THE FOUNDATIONS OF DIGITAL FORENSICS: BEST PRACTICES
Introduction
Who establishes best practices
who should be following best practices
e.tc

CHAPTER 5: DIGITAL FORENSICS AT WORK IN THE LEGAL SYSTEM
Introduction
what makes a tool forensically sound
who performs tool testing
computer forensics tools: an overview
e.tc

CHAPTER 6: DIGITAL FORENSICS AT WORK IN THE LEGAL SYSTEM
Introduction
mitigation
pre-trial motions
trial preparation
e.tc

CHAPTER 7: WHY DO I NEED AN EXPERT
Introduction
why hire a digital forensics expert
when to hire a digital Forensics expert
e.tc

CHAPTER 8: THE DIFFERENCE BETWEEN COMPUTER EXPERTS AND DIGITAL FORENSICS EXPERTS
Introduction
the computer expert
The digital forensics expert
A side by side comparison
e.tc

CHAPTER 9: SELECTING A DIGITAL FORENSICS EXPERT
Introduction
what is an expert
locating and selecting an expert
certifications
e.tc

CHAPTER 10: WHAT TO EXPECT FROM AN EXPERT
Introduction
general expectations
where to begin
the examination
court preparation

CHAPTER 11: APPROCHES BY DIFFERENT TYPES OF EXAMINERS
Introduction
Standards
Training and experience
impact on examinations
e.tc

CHAPTER 12: SPOTTING A PROBLEM EXPERT
Introduction
beyond the window dressings
e.tc

CHAPTER 13: QUALIFYING AN EXPERT IN COURT
Introduction
Qualifying an expert
Qualifying experts in court
e.tc

CHAPTER 14: OVERVIEW OF DIGITAL EVIDENCE DISCOVERY
introduction
discover motions in civil and criminal cases
summary

CHAPTER 15: DISCOVERY OF DIGITAL EVIDENCE IN CRIMINAL CASES
introduction
sources of digital evidence
electronic discovery in particular
e.tc

CHAPTER 16: DISCOVERY OF DIGITAL EVIDENCE IN CIVIL CASES
introduction
rules governing civil discovery
electronic discovery in particular
e.tc

CHAPTER 17: DISCOVERY OF COMPUTERS AND STORAGE MEDIA
Introduction
an example of a simple consent to search agreement
example of a simple order for expedited discovery
e.tc

CHAPTER 18: DISCOVERY OF VIDEO EVIDENCE
introduction
common issues with video evidence
collecting video evidence
e.tc

CHAPTER 19: DISCOVERY OF AUDIO EVIDENCE
introduction
common issues with audio evidence
example discovery language for audio
e.tc

CHAPTER 20: DISCOVERY OF SOCIAL MEDIA EVIDENCE
Introduction
Legal issues in social media discovery
finding custodian of records contact information
Facebook
e.tc

CHAPTER 21: DISCOVERY IN CHILD PORNOGRAPHY CASES
introduction
The Adam Walsh child protection and safety act of 2006
the discovery of process
e.tc

CHAPTER 22: DISCOVERY OF INTERNET SERVICE PROVIDER RECORDS
introduction
internet service provider records or IP addresses
Example language for web-based e-mail addresses
e.tc

CHAPTER 23: DISCOVERY OF GLOBAL POSITIONING SYSTEM EVIDENCE
introduction
GPS tracking evidence overview
discovery of GPS evidence
e.tc

CHAPTER 24: DISCOVERY OF CALL DETAIL RECORDS
Introduction
discovery issues in cellular evidence
example language for call detail records
e.tc

CHAPTER 25: OBATAINING EXPERT FUNDING IN INDIGENT CASES
Introduction
Hash values
How hash values are used in digital forensics
e.tc

CHAPTER 26: HASH VALUES: THE VERIFICATION STANDARD
introduction
hash values are used in digital forensics
e.tc

how hash values
CHAPTER 27: METADATA
Introduction
The purpose of metadata
common types of metadata
e.tc

CHAPTER 28: THUMBNAILS AND THE THUMBNAIL CACHE
introduction
thumbnails and the thumbnail cache
how thumbnail and the thumbnail cache work
e.tc

CHAPTER 29: DELETED DATA
introduction
how data is stored on a hard drive
deleted file recovery
e.tc

CHAPTER 30: COMPUTER TIME ARTIFACTS
introduction
computer file system time stamps
fundamental issues in forensic analysis of timeline
e.tc

CHAPTER 31: INTERNET HISTORY(WEB AND BROWSER CACHING)
introduction
what is web caching
how internet browser caching works
e.tc

CHAPTER 32: WINDOWS SHORTCUT FILES (LINK FILES)
introduction
the purpose of link files, how they are created and how they work
how link files can be of evidentiary value
e.tc

CHAPTER 33: CELLULAR SYSTEM EIDENCE AND CALL DETAIL RECORDS
introduction
an overview of the cellular phone systems
how cell phones work
e.tc

CHAPTER 34: E-MAIL EVIDENCE
introduction
email as evidence
email storage and access: where is it
web mail
e.tc

CHAPTER 35: SOCIAL MEDIA
introduction
common forms of social networking
evidence out in the open
e.tc

CHAPTER 36: PEER-TO-PEER NETWORKS AND FILE SHARING
introduction
what is peer to peer sharing
how it works
e.tc

CHAPTER 37: CELL PHONES
introduction
the fragile nature of cellular evidence
forensic acquisition methods for cellular phones
e.tc

CHAPTER 38: VIDEO AND PHOTO EVIDENCE
introduction
the most critical steps in the forensic examination of video and photo evidence
using video and photo evidence in cases
e.tc

CHAPTER 39: DATABASES
introduction
databases in everyday life
what is a database
e.tc

CHAPTER 40: ACCOUNTING SYSTEMS AND FINANCIAL SOFTWARE
introduction
accounting and money management programs
personal money management software
e.tc

CHAPTER 41: MULTIPLAYER ONLINE GAMES
introduction
the culture of massively multiplayer online role playing games
MMORPG data as evidence
e.tc

CHAPTER 42: GLOBAL POSITIONING SYSTEMS
introduction
an overview of global positioning systems
an overview of the navstar global
e.tc

Includes Bibliographic references and Index p. 321-330