Computer Forensics and Investigation
What is Computer Forensics
Digital evidence
Computer systems
Data recovery firms
Storage devices
Colleges and Universities
Mobile devices
Organizations
Networking equipment
Military
Other potential sources
Individuals
Media analysis
Network analysis
Code analysis
What is the Role of a Computer Forensic Examiner
Locard's exchange principle
Certified Computer Examiner (CCE)
Certified Forensic Computer Examiner (CFCE)
Certified Computer Forensics Examiner (CCFE)
GIAC Certified Forensic Analyst (GCFA)
Collecting, Handling, and Using Digital Evidence
To commit a crime
As a target of crime
To facilitate a crime
As a witness to crime
The Investigative Process
Collection
Examination
Preservation
Presentation
Identification
Chain of Custody
forensic duplicate image
Persistent data
Volatile data
Legal issues involving digital evidence
Authority to Collect Evidence
The fourth amendment and search warrants
The silver platter doctrine
Consent
Plain view doctrine
Inventory search
Exigent circumstances
Search incident to a lawful arrest
Federal laws regarding electronic data collection
The wiretap act
Network banner
The Pen Register and Trap and Trace Statute
Admissibility of Evidence
Computer-generated records
Records created by people and stored electronically
probative evidence
fruit of the poisonous tree doctrine
The Hearsay Rule
The Best Evidence Rule