Craiger / Shenoi Advances in Digital Forensics III

IFIP International Conference on Digital Forensics , National Center for Forensic Science, Orlando Florida, January 28-January 31, 2007
1. Auflage 2007
ISBN: 978-0-387-73742-3
Verlag: Springer
Format: PDF
Kopierschutz: 1 - PDF Watermark

E-Book, Englisch, Band 242, 357 Seiten

Reihe: IFIP Advances in Information and Communication Technology

ADVANCES IN DIGITAL FORENSICS III Edited by: Philip Craiger and Sujeet Shenoi Digital forensics deals with the acquisition, preservation, examination, analysis and presentation of electronic evidence. Networked computing, wireless communications and portable electronic devices have expanded the role of digital forensics beyond traditional computer crime investigations. Practically every crime now involves some aspect of digital evidence, digital forensics provides the techniques and tools to articulate this evidence. Digital forensics also has myriad intelligence applications. Furthermore, it has a vital role in information assurance -- investigations of security breaches yield valuable information that can be used to design more secure systems. Advances in Digital Forensics III describes original research results and innovative applications in the emerging discipline of digital forensics. In addition, it highlights some of the major technical and legal issues related to digital evidence and electronic crime investigations. The areas of coverage include: - Legal Issues - Insider Threat Detection - Rootkit Detection - Authorship Attribution - Forensic Techniques - File System Forensics - Network Forensics - Portable Electronic Device Forensics - Evidence Analysis and Management - Formal Methods This book is the third volume in the annual series produced by the International Federation for Information Processing (IFIP) Working Group 11.9 on Digital Forensics, an international community of scientists, engineers and practitioners dedicated to advancing the state of the art of research and practice in digital forensics. The book contains a selection of twenty-four edited papers from the Third Annual IFIP WG 11.9 Conference on Digital Forensics, held at the National Center for Forensic Science, Orlando, Florida, USA in the spring of 2007. Advances in Digital Forensics III is an important resource for researchers, faculty members and graduate students, as well as for practitioners and individuals engaged in research and development efforts for the law enforcement and intelligence communities. Philip Craiger is an Assistant Professor of Engineering Technology and Assistant Director for Digital Evidence at the National Center for Forensic Science, University of Central Florida, Orlando, Florida, USA. Sujeet Shenoi is the F.P. Walter Professor of Computer Science and a principal with the Center for Information Security at the University of Tulsa, Tulsa, Oklahoma, USA.

Autoren/Hrsg.

Craiger, Philip

Shenoi, Sujeet

Inhaltsverzeichnis

1;Contents;6
2;Contributing Authors;9
3;Preface;18
4;LEGAL ISSUES;20
4.1;Chapter 1 CALIBRATION TESTING OF NETWORK TAP DEVICES;21
4.2;Chapter 2 ON THE LEGALITY OF ANALYZING TELEPHONE CALL RECORDS;38
4.3;Chapter 3 SURVEY OF LAW ENFORCEMENT PERCEPTIONS REGARDING DIGITAL EVIDENCE;57
5;INSIDER THREAT DETECTION;69
5.1;Chapter 4 INSIDER THREAT ANALYSIS USING INFORMATION- CENTRIC MODELING;70
5.2;Chapter 5 AN INTEGRATED SYSTEM FOR INSIDER THREAT DETECTION;89
6;ROOTKIT DETECTION;101
6.1;Chapter 6 ANALYSIS OF TOOLS FOR DETECTING ROOTKITS AND HIDDEN PROCESSES;102
6.2;Chapter 7 A METHOD FOR DETECTING LINUX KERNEL MODULE ROOTKITS;119
7;AUTHORSHIP ATTRIBUTION;129
7.1;Chapter 8 FUTURE TRENDS IN AUTHORSHIP ATTRIBUTION;130
7.2;Chapter 9 THE KEYBOARD DILEMMA AND AUTHORSHIP IDENTIFICATION;144
8;FORENSIC TECHNIQUES;158
8.1;Chapter 10 FACTORS AFFECTING ONE- WAY HASHING OF CD- R MEDIA;159
8.2;Chapter 11 DISK DRIVE I / O COMMANDS AND WRITE BLOCKING;172
8.3;Chapter 12 A NEW PROCESS MODEL FOR TEXT STRING SEARCHING;187
8.4;Chapter 13 DETECTING STEGANOGRAPHY USING MULTI- CLASS CLASSIFICATION;200
8.5;Chapter 14 REDACTING DIGITAL INFORMATION FROM ELECTRONIC DEVICES;212
9;FILE SYSTEM FORENSICS;222
9.1;Chapter 15 IN- PLACE FILE CARVING;223
9.2;Chapter 16 FILE SYSTEM JOURNAL FORENSICS;237
10;NETWORK FORENSICS;251
10.1;Chapter 17 USING SEARCH ENGINES TO ACQUIRE NETWORK FORENSIC EVIDENCE;252
10.2;Chapter 18 A FRAMEWORK FOR INVESTIGATING RAILROAD ACCIDENTS;259
11;PORTABLE ELECTRONIC DEVICE FORENSICS;270
11.1;Chapter 19 FORENSIC ANALYSIS OF XBOX CONSOLES;271
11.2;Chapter 20 SUPER- RESOLUTION VIDEO ANALYSIS FOR FORENSIC INVESTIGATIONS;283
12;EVIDENCE ANALYSIS AND MANAGEMENT;302
12.1;Chapter 21 SPECIALIZING CRISP- DM FOR EVIDENCE MINING;303
12.2;Chapter 22 APPLYING THE BIBA INTEGRITY MODEL TO EVIDENCE MANAGEMENT;316
13;FORMAL METHODS;327
13.1;Chapter 23 INVESTIGATING COMPUTER ATTACKS USING ATTACK TREES;328
13.2;Chapter 24 ATTACK PATTERNS: A NEW FORENSIC AND DESIGN TOOL;341