528/526=1.004” HAYES All you need to know to succeed in digital forensics: technical and investigative skills, in one book COMPUTER Complete, practical, and up-to-date • Understand what computer forensics examiners do, and the A PRACTICAL GUIDE TO types of digital evidence they work with Thoroughly covers digital forensics for Windows, • Explore Windows and Mac computers, understand how Mac, mobile, hardware, and networks their features affect evidence gathering, and use free tools to Addresses online and lab investigations, investigate their contents documentation, admissibility, and more • Extract data from diverse storage devices By Dr. Darren Hayes, founder of Pace University’s • Establish a certified forensics lab and implement good practices for managing and processing evidence COMPUTER Code Detectives forensics lab—one of America’s “Top 10 Computer Forensics Professors” • Gather data and perform investigations online A PRACTICAL GUIDE TO Perfect for anyone pursuing a digital forensics • Capture Internet communications, video, images, and other content FORENSICS career or working with examiners • Write comprehensive reports that withstand defense objections and enable successful prosecution Criminals go where the money is. Today, trillions • Follow strict search and surveillance rules to make your evidence FORENSICS of dollars of assets are digital, and digital crime is growing fast. In response, demand for digital admissible forensics experts is soaring. To succeed in this • Investigate network breaches, including dangerous Advanced exciting field, you need strong technical and Persistent Threats (APTs) investigative skills. In this guide, one of the world’s INVESTIGATIONS • Retrieve immense amounts of evidence from smartphones, even leading computer forensics experts teaches you all without seizing them the skills you’ll need. • Successfully investigate financial fraud performed with digital devices Writing for students and professionals at all levels, Dr. Darren Hayes presents complete best practices • Use digital photographic evidence, including metadata and for capturing and analyzing evidence, protecting the social media images INVESTIGATIONS chain of custody, documenting investigations, and scrupulously adhering to the law, so your evidence Dr. Darren R. Hayes, a leading expert in computer forensics and can always be used. security, is Director of Cybersecurity and Assistant Professor at Pace University. He has been named one of the Top 10 Computer Hayes introduces today’s latest technologies and Forensics Professors by Forensics Colleges. Hayes is former technical challenges, offering detailed coverage President and current Board Member of the High Technology Crime of crucial topics such as mobile forensics, Mac Investigation Association (HTCIA), Northeast Chapter. He created forensics, cyberbullying, and child endangerment. and manages Code Detectives, Pace’s Computer Forensics research This guide’s practical activities and case studies give laboratory, where he works closely with students in computer and you hands-on mastery of modern digital forensics mobile forensics. He has fostered relationships with the N.Y.P.D., tools and techniques. Its many realistic examples N.Y. State Police, and other law enforcement agencies; and reflect the author’s extensive and pioneering work organized internship programs at the Cybercrime divisions of as a forensics examiner in both criminal and civil the New York County and Westchester County D.A. Offices. investigations. Security / Computer Forensics ISBN-13: 978-0-7897-4115-8 ISBN-10: 0-7897-4115-6 Cover image: Mega Pixel/Shutterstock.com 56500 Text printed on recycled paper 9 780789 741158 www.pearsonITcertification.com $65.00 U.S. • $75.00 Canada DR. DARREN R. HAYES A Practical Guide to Computer Forensics Investigations Dr. Darren R. Hayes 800 East 96th Street, Indianapolis, Indiana 46240 USA 9780789741158_forensics.indb i 11/20/14 10:48 PM A Practical Guide to Computer Forensics Investigations Associate Publisher Dave Dusthimer Copyright © 2015 by Pearson Education, Inc. All rights reserved. No part of this book shall be reproduced, stored in a retrieval system, or Acquisitions Editor transmitted by any means, electronic, mechanical, photocopying, recording, or otherwise, Betsy Brown without written permission from the publisher. No patent liability is assumed with respect Development Editor to the use of the information contained herein. Although every precaution has been taken in Jeff Riley the preparation of this book, the publisher and author assume no responsibility for errors or omissions. Nor is any liability assumed for damages resulting from the use of the information Managing Editor contained herein. Sandra Schroeder ISBN-13: 978-0-7897-4115-8 ISBN-10: 0-7897-4115-6 Project Editor Mandie Frank Library of Congress Control Number: 2014955541 Copy Editor Printed in the United States of America Krista Hansing First Printing: December 2014 Indexer Larry Sweazy Trademarks All terms mentioned in this book that are known to be trademarks or service marks have Proofreader been appropriately capitalized. Pearson IT Certification cannot attest to the accuracy of this Megan Wade-Taxter information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark. Technical Editors Dennis Dragos Shawn Merdinger Warning and Disclaimer Every effort has been made to make this book as complete and as accurate as possible, but Publishing Coordinator no warranty or fitness is implied. The information provided is on an “as is” basis. The author Vanessa Evans and the publisher shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book. Designer Alan Clements Special Sales Compositor For information about buying this title in bulk quantities, or for special sales opportunities Tricia Bronkella (which may include electronic versions; custom cover designs; and content particular to your business, training goals, marketing focus, or branding interests), please contact our corporate sales department at [email protected] or (800) 382-3419. For government sales inquiries, please contact [email protected]. For questions about sales outside the U.S., please contact [email protected]. 9780789741158_forensics.indb ii 11/20/14 10:48 PM Contents at a Glance Introduction .................................................. xx 1 The Scope of Computer Forensics ................................ 2 2 Windows Operating and File Systems ............................. 32 3 Handling Computer Hardware ................................... 80 4 Acquiring Evidence in a Computer Forensics Lab .................. 116 5 Online Investigations .......................................... 162 6 Documenting the Investigation .................................. 210 7 Admissibility of Digital Evidence ................................. 238 8 Network Forensics ............................................ 292 9 Mobile Forensics ............................................. 320 10 Photograph Forensics ......................................... 372 11 Mac Forensics ............................................... 390 12 Case Studies ................................................ 436 Index ....................................................... 458 iii 9780789741158_forensics.indb iii 11/20/14 10:48 PM Table of Contents Introduction xx Chapter 1: The Scope of Computer Forensics 2 Introduction ....................................................... 2 Popular Myths about Computer Forensics ......................... 3 Types of Computer Forensics Evidence Recovered ...................... 5 Electronic Mail (Email) .......................................... 5 Images ...................................................... 7 Video ....................................................... 8 Websites Visited and Internet Searches ........................... 9 Cellphone Forensics .......................................... 10 What Skills Must a Computer Forensics Investigator Possess? ........... 10 Computer Science Knowledge ................................. 10 Legal Expertise .............................................. 11 Communication Skills ......................................... 11 Linguistic Abilities ............................................ 11 Continuous Learning .......................................... 11 An Appreciation for Confidentiality .............................. 12 The Importance of Computer Forensics ............................... 12 Job Opportunities ............................................ 12 A History of Computer Forensics .................................... 14 1980s: The Advent of the Personal Computer ..................... 14 1990s: The Impact of the Internet ............................... 15 Training and Education ............................................ 19 Law Enforcement Training ..................................... 19 Summary ........................................................ 25 iv Table of Contents 9780789741158_forensics.indb iv 11/20/14 10:48 PM Chapter 2: Windows Operating and File Systems 32 Introduction ...................................................... 32 Physical and Logical Storage ....................................... 34 File Storage ................................................. 34 File Conversion and Numbering Formats .............................. 37 Conversion of Binary to Decimal ...............................