Cyber Forensics - Hardcover

by Albert J. Marcella (Author), Frederic Guillossou (Author)

An explanation of the basic principles of data

This book explains the basic principles of data as building blocks of electronic evidential matter, which are used in a cyber forensics investigations. The entire text is written with no reference to a particular operation system or environment, thus it is applicable to all work environments, cyber investigation scenarios, and technologies. The text is written in a step-by-step manner, beginning with the elementary building blocks of data progressing upwards to the representation and storage of information. It inlcudes practical examples and illustrations throughout to guide the reader.

Front Jacket

Cyber forensics: From Data to Digital Evidence

As a cyber forensic investigator, simply pressing buttons or ticking off options on forensic software--without understanding what is happening behind the scenes--creates a gaping hole in your company's infosecurity. Painting a broad picture of the field, Cyber Forensics provides you with the specific knowledge you need to not only find key data in forensic investigations but also speak confidently about the validity of the data identified, accessed, and analyzed as part of a comprehensive cyber forensic investigation.

Authors Albert Marcella and Frederic Guillossou--both forensic and IT specialists--begin by explaining the origins of data. From there, the authors address concepts related to data storage, boot records, partitions, volumes, and file systems, and how each of these is interrelated and essential in a cyber forensic investigation. They then analyze the roles these concepts play in an investigation and what type of evidential data may be identified within each of these areas.

Providing a thorough foundation to this emerging field, this step-by-step reference covers:

• Converting binary to decimal

• The power of HEX

• Forensics and encrypted files

• Master Boot Record (MBR)

• Volume versus Partition

• FAT filing system limitations

• New technology file system

• Forensic Investigative Smart Practices

• MS-DOS 32-bit time stamp: date and time

• Characteristics of a good cyber forensic report

• A cyber forensic process summary

Ronelle Sawyer and Jose McCarthy--two fictional characters--are used throughout the book to illuminate specific IT and cyber forensic concepts and discuss critical cyber forensic processes. Their activities and actions bring cyber forensic concepts to life by providing you with specific examples of the applications. Cyber Forensics also examines Endianness and time--two important yet often overlooked topics--that drastically impact almost every cyber-based investigation.

Progressing logically from data to digital evidence, Cyber Forensics provides you with the most comprehensive examination and discussion of the science of cyber forensic investigations, what is happening behind the scenes to data and why, what to look for, and where to find it, so you can conduct cyber forensic investigations with a better understanding of the technologies involved.

Back Jacket

CYBER FORENSICS

From Data to Digital Evidence

As a cyber forensic investigator, simply pressing buttons or ticking off options on forensic software--without understanding what is happening behind the scenes--creates a gaping hole in your company's infosecurity. Painting a broad picture of the field, Cyber Forensics provides you with the specific knowledge you need to not only find key data in forensic investigations but also speak confidently about the validity of the data identified, accessed, and analyzed as part of a comprehensive cyber forensic investigation.

Authors Albert Marcella and Frederic Guillossou--both forensic and IT specialists--begin by explaining the origins of data. From there, the authors address concepts related to data storage, boot records, partitions, volumes, and file systems, and how each of these is interrelated and essential in a cyber forensic investigation. They then analyze the roles these concepts play in an investigation and what type of evidential data may be identified within each of these areas.

Providing a thorough foundation to this emerging field, this step-by-step reference covers:

• Converting binary to decimal
• The power of HEX
• Forensics and encrypted files
• Master Boot Record (MBR)
• Volume versus Partition
• FAT filing system limitations
• New technology file system
• Forensic Investigative Smart Practices
• MS-DOS 32-bit time stamp: date and time
• Characteristics of a good cyber forensic report
• A cyber forensic process summary

Ronelle Sawyer and Jose McCarthy--two fictional characters--are used throughout the book to illuminate specific IT and cyber forensic concepts and discuss critical cyber forensic processes. Their activities and actions bring cyber forensic concepts to life by providing you with specific examples of the applications. Cyber Forensics also examines Endianness and time--two important yet often overlooked topics--that drastically impact almost every cyber-based investigation.

Progressing logically from data to digital evidence, Cyber Forensics provides you with the most comprehensive examination and discussion of the science of cyber forensic investigations, what is happening behind the scenes to data and why, what to look for, and where to find it, so you can conduct cyber forensic investigations with a better understanding of the technologies involved.

Author Biography

ALBERT J. MARCELLA, JR., PHD, CISA, CISM, is President of Business Automation Consultants, LLC, a global information technology and management consulting firm providing IT management consulting, audit and security reviews, and training. He is an internationally recognized public speaker, researcher, workshop and seminar leader, and an author of numerous articles and books on various IT, audit, and security related subjects.

FREDERIC GUILLOSSOU, CISSP, CCE, is an Information Security Analyst with TALX, a division of Equifax. He regularly trains on intrusion prevention systems and has successfully led a number of forensic investigations in the field.