Table of Contents

Introduction 1

Part I: Digging Out and Documenting Electronic Evidence 7

Chapter 1: Knowing What Your Digital Devices Create, Capture, and Pack Away — Until Revelation Day 9

Chapter 2: Suiting Up for a Lawsuit or Criminal Investigation 23

Chapter 3: Getting Authorized to Search and Seize 39

Chapter 4: Documenting and Managing the Crime Scene 55

Part II: Preparing to Crack the Case 71

Chapter 5: Minding and Finding the Loopholes 73

Chapter 6: Acquiring and Authenticating E-Evidence 95

Chapter 7: Examining E-Evidence 117

Chapter 8: Extracting Hidden Data 135

Part III: Doing Computer Forensic Investigations 151

Chapter 9: E-Mail and Web Forensics 153

Chapter 10: Data Forensics 175

Chapter 11: Document Forensics 201

Chapter 12: Mobile Forensics 219

Chapter 13: Network Forensics 241

Chapter 14: Investigating X-Files: eXotic Forensics 265

Part IV: Succeeding in Court 275

Chapter 15: Holding Up Your End at Pretrial 277

Chapter 16: Winning a Case Before You Go to Court 287

Chapter 17: Standing Your Ground in Court 295

Part V: The Part of Tens 311

Chapter 18: Ten Ways to Get Qualifi ed and Prepped for Success 313

Chapter 19: Ten Tactics of an Excellent Investigator and a Dangerous Expert Witness 319

Chapter 20: Ten Cool Tools for Computer Forensics 325

Glossary 331

Index 345

About the Author

Linda Volonino (PhD, MBA, CISSP, ACFE) is a computer forensic investigator and expert witness with Robson Forensic, Inc. and a member of InfraGard. Reynaldo Anzaldua (MBA, CISSP, EnCE, CHFI, IBM I-Series) teaches computer forensics and information security at South Texas College and works with private organizations and government agencies.