Digital forensics and investigations : people, processes, and technologies to defend the enterprise

목차 (Table of Contents)

• CONTENTS
• Preface = xi
• Acknowledgments = xiii
• About the Author = xv
• Introduction = xvii
• SECTION Ⅰ ENABLING DIGITAL FORENSICS
• 1 Introduction to Digital Forensics = 3
• A Brief History of Forensics and Technology = 3
• Evolutionary Cycle of Digital Forensics = 7
• Technical and Scientific Working Groups = 9
• Scientific Working Group on Digital Evidence (SWGDE) = 12
• Principles of Digital Forensics = 13
• Summary = 17
• Glossary = 17
• 2 Investigative Process Methodologies = 19
• Existing Process Models = 19
• Mapping Out Process Models = 22
• The Process Methodology Workflow = 24
• Summary = 33
• Glossary = 33
• 3 Education, Training, and Awareness = 35
• Organizational Roles and Responsibilities = 35
• Types of Training and Awareness = 39
• Specializations = 41
• An Educational Roadmap = 42
• Nontechnical Knowledge = 45
• Educational Resources = 50
• Summary = 51
• Glossary = 51
• 4 Laws, Standards, and Regulations = 53
• The Role of Technology in Crime = 53
• A Brief History of Crime and Technology = 55
• Types of Laws = 56
• Federal Rules of Evidence = 59
• Good Practices for Computer-Based Electronic Evidence = 61
• Legal Precedence = 61
• Search Warrants = 64
• Subpoenas = 65
• Jurisdiction = 66
• Summary = 66
• Glossary = 66
• 5 Ethics and Professional Conduct = 69
• Importance of Ethics = 69
• Principles of Ethics = 70
• Ethics in Digital Forensics = 72
• Certifications and Accreditations = 77
• Summary = 78
• Glossary = 78
• SECTION Ⅱ ENHANCING DIGITAL FORENSIC CAPABILITIES
• 6 The Business of Digital Forensics = 81
• The Role of Digital Forensics in an Enterprise = 81
• Starting a Digital Forensic Program = 82
• Maintaining a Digital Forensic Program = 97
• Challenges and Strategies = 102
• Industry Regulation = 102
• Political Influences = 103
• Summary = 103
• Resources = 104
• Glossary = 104
• 7 Controlling Mobile Devices = 107
• Brief History of Mobile Devices = 107
• Persistent Threats and Challenges = 108
• Mobile Device Governance = 111
• Enterprise Management Strategies = 114
• Device Management Methodologies = 116
• Device Management Capabilities = 117
• Mobile Device Process Methodology = 120
• Legal Considerations = 129
• Summary = 130
• Resources = 130
• Glossary = 131
• 8 Cloud Computing Enablement = 133
• Brief History of Cloud Computing = 133
• What is Cloud Computing? = 134
• Persistent Threats and Challenges = 137
• Cloud Computing Governance = 139
• Enterprise Management Strategies = 141
• Cloud Computing Process Methodology = 147
• Legal Considerations = 153
• Summary = 154
• Resources = 155
• Glossary = 155
• 9 Combatting Antiforensics = 157
• What Are Antiforensics? = 157
• Traditional Techniques = 158
• Detection Methods = 167
• Strategic Countermeasures = 171
• Summary = 172
• Resources = 172
• Glossary = 173
• 10 Digital Evidence Management = 175
• Types of Digital Evidence = 175
• Evidence Gathering Considerations = 182
• Cause and Effect = 186
• Data Security Requirements = 188
• Preservation Strategies = 191
• Enterprise Log Management = 196
• Summary = 200
• Resources = 200
• Glossary = 201
• 11 Digital Forensic Readiness = 203
• Forensic Readiness 101 = 203
• Cost versus Benefit = 204
• Ten Steps to Forensic Readiness = 205
• Achieving Forensic Readiness = 216
• Summary = 216
• Glossary = 217
• SECTION Ⅲ INTEGRATING DIGITAL FORENSIC CAPABILITIES
• 12 Incident Management and Response = 221
• Understanding the Incident Response Workflow = 221
• The Incident Response Team (IRT) = 227
• What to Expect During an Incident = 229
• Investigative Techniques = 235
• Reverse Engineering Malware = 237
• Timeline Analysis = 238
• Summary = 239
• Glossary = 240
• 13 Electronic Discovery and Litigation Support = 241
• What is Electronic Discovery (eDiscovery)? = 241
• Understanding the eDiscovery Workflow = 248
• Managing Litigation Discovery = 257
• The Role of Digital Forensics in a Litigation = 259
• Discovering Electronically Stored Information (ESI) = 261
• Summary = 263
• Resources = 263
• Glossary = 263
• 14 Information Security and Cybersecurity = 265
• Information Security vs Cybersecurity = 265
• Digital Forensics in Enterprise Security = 269
• Security Investigations = 283
• Summary = 290
• Resources = 291
• Glossary = 291
• SECTION Ⅳ APPENDIXES
• Appendix A : Investigative Process Models = 295
• [P01] Computer Forensic Investigative Process (1995) = 297
• [P02] Computer Forensic Process Model (2001) = 297
• [P03] Digital Forensic Research Workshop (DFRWS) Investigative Model (2001) = 298
• [P04] Scientific Crime Scene Investigation Model (2001) = 298
• [P05] Abstract Model of the Digital Forensic Procedures (2002) = 298
• [P06] Integrated Digital Investigation Process (2003) = 299
• [P07] End-to-End Digital Investigation (2003) = 299
• [P08] Enhanced Integrated Digital Investigation Process (2004) = 300
• [P09] Extended Model of Cybercrime Investigation (2004) = 300
• [P10] A Hierarchical, Objective-Based Framework for the Digital Investigations Process (2004) = 301
• [P11] Event-Based Digital Forensic Investigation Framework (2004) = 301
• [P12] Four Step Forensic Process (2006) = 301
• [P13] Framework for a Digital Forensic Investigation (2006) = 302
• [P14] Computer Forensic Field Triage Process Model (2006) = 302
• [P15] FORZA : Digital Forensics Investigation Framework (2006) = 302
• [P16] Process Flows for Cyber Forensics Training and Operations (2006) = 303
• [P17] Common Process Model for Incident and Computer Forensics (2007) = 303
• [P18] Dual Data Analysis Process (2007) = 304
• [P19] Digital Forensic Investigations Framework (2008) = 304
• [P20] Digital Forensic Model Based on Malaysian Investigation Process (2009) = 304
• [P21] Generic Framework for Network Forensics (2010) = 305
• [P22] Generic Computer Forensic Investigation Model (2011) = 305
• [P23] Systematic Digital Forensic Investigation Model (2011) = 306
• [P24] Advanced Data Acquisition Model (ADAM) (2011) = 306
• Appendix B : Education and Professional Certifications = 307
• Professional Certifications = 307
• Formal Education Programs = 309
• SECTION Ⅳ TEMPLATES
• Template A : Investigator Logbook = 323
• Template B :: Chain of Custody = 325
• Bibliography = 329
• Index = 337