Handbook of Digital Forensics and Investigation

594 Pages·2009·12.39 MB·English

by  Eoghan Casey

Handbook of Digital Forensics
and Investigation
This page intentionally left blank
Handbook of Digital Forensics
and Investigation
Edited by
Eoghan Casey
With contributions from
Cory Altheide
Christopher Daywalt
Andrea de Donno
Dario Forte
James O. Holley
Andy Johnston
Ronald van der Knijff
Anthony Kokocinski
Paul H. Luehr
Terrance Maguire
Ryan D. Pittman
Curtis W. Rose
Joseph J. Schwerha IV
Dave Shaver
Jessica Reust Smith
AMSTERDAM • BOSTON • HEIDELBERG • LONDON
NEW YORK • OXFORD • PARIS • SAN DIEGO
SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO
Academic Press is an imprint of Elsevier
Elsevier Academic Press
30 Corporate Drive, Suite 400, Burlington, MA 01803, USA
525 B Street, Suite 1900, San Diego, California 92101-4495, USA
84 Theobald’s Road, London WC1X 8RR, UK
This book is printed on acid-free paper.
Copyright Eoghan Casey, 2010. Published by Elsevier Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means,
electronic or mechanical, including photocopy, recording, or any information storage and
retrieval system, without permission in writing from the publisher.
Permissions may be sought directly from Elsevier’s Science & Technology Rights Department
in Oxford, UK: phone: [phone], fax: [phone], E-mail: permissions@
elsevier.co.uk. You may also complete your request on-line via the Elsevier homepage
(http://elsevier.com), by selecting “Customer Support” and then “Obtaining Permissions.”
Library of Congress Cataloging-in-Publication Data
Application Submitted
British Library Cataloguing in Publication Data
A catalogue record for this book is available from the British Library
ISBN 13: 978-0-12-374267-4
For all information on all Elsevier Academic Press publications
visit our Web site at www.elsevierdirect.com
Printed in the United States of America
09 10 9 8 7 6 5 4 3 2 1
To Genevieve, Roisin and Hesper
This page intentionally left blank
Contents
Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
About the Authors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxiii
Chapter 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1
Eoghan Casey
part 1 Investigative Methodology
Chapter 2 Forensic Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21
Eoghan Casey and Curtis W. Rose
Chapter 3 Electronic Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63
James O. Holley, Paul H. Luehr, Jessica Reust Smith,
and Joseph J. Schwerha IV
Chapter 4 Intrusion Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .135
Eoghan Casey, Christopher Daywalt, and Andy Johnston
part 2 technology
Chapter 5 Windows Forensic Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .209
Ryan D. Pittman and Dave Shaver
Chapter 6 UNIX Forensic Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .301
Cory Altheide and Eoghan Casey
Chapter 7 Macintosh Forensic Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .353
Anthony Kokocinski
Chapter 8 Embedded Systems Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .383
Ronald van der Knijff vii
viii Contents
Chapter 9 Network Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .437
Eoghan Casey, Christopher Daywalt, Andy Johnston,
and Terrance Maguire
Chapter 10 Mobile Network Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .517
Dario Forte and Andrea de Donno
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .559
Contributors
Eoghan Casey cmdLabs, Baltimore, MD
Curtis W. Rose Curtis W. Rose & Associates, Laurel, MD
Cory Altheide Mandiant Highlands Ranch, CO
James O. Holley Ernst & Young LLP, New York, NY
Paul H. Luehr Stroz Friedberg, Minneapolis, MN
Jessica Reust Smith Stroz Friedberg, Washington, DC
Joseph J. Schwerha IV TraceEvidence, Charleroi, PA
Christopher Daywalt cmdLabs, Baltimore, MD
Andy Johnston University of Maryland, Baltimore County, Baltimore, MD
Ryan D. Pittman U.S. Army CCIU, Fort Belvoir, VA
Dave Shaver U.S. Army, Woodbridge, VA
Anthony Kokocinski CSC, Chicago, IL
Ronald van der Knijff Netherlands Forensic Institute, Den Haag, The Netherlands
Terrance Maguire cmdLabs, Baltimore, MD
Dario Forte DFLabs, Crema (CR), Italy
Andrea de Donno Lepta Milano (MI), Italy
ix