C F OMPUTER ORENSICS C F OMPUTER ORENSICS A E G N SSENTIAL UIDE FOR A , L , CCOUNTANTS AWYERS AND M ANAGERS M S ICHAEL HEETZ JOHNWILEY&SONS,INC. Thisbookisprintedonacid-freepaper. Copyright2007byJohnWiley&Sons,Inc.Allrightsreserved. PublishedbyJohnWiley&Sons,Inc.,Hoboken,NewJersey. PublishedsimultaneouslyinCanada. Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmittedinanyform orbyanymeans,electronic,mechanical,photocopying,recording,scanning,orotherwise,exceptas permittedunderSection107or108ofthe1976UnitedStatesCopyrightAct,withouteithertheprior writtenpermissionofthePublisher,orauthorizationthroughpaymentoftheappropriateper-copyfeeto theCopyrightClearanceCenter,Inc.,222RosewoodDrive,Danvers,MA01923,978-750-8400,fax 978-646-8600,oronthewebatwww.copyright.com.RequeststothePublisherforpermissionshouldbe addressedtothePermissionsDepartment,JohnWiley&Sons,Inc.,111RiverStreet,Hoboken,NJ 07030,(201)748-6011,fax(201)748-6008. LimitofLiability/DisclaimerofWarranty:Whilethepublisherandauthorhaveusedtheirbesteffortsin preparingthisbook,theymakenorepresentationsorwarrantieswithrespecttotheaccuracyor completenessofthecontentsofthisbookandspecificallydisclaimanyimpliedwarrantiesof merchantabilityorfitnessforaparticularpurpose.Nowarrantymaybecreatedorextendedbysales representativesorwrittensalesmaterials.Theadviceandstrategiescontainedhereinmaynotbesuitable foryoursituation.Youshouldconsultwithaprofessionalwhereappropriate.Neitherthepublishernor authorshallbeliableforanylossofprofitoranyothercommercialdamages,includingbutnotlimited tospecial,incidental,consequential,orotherdamages. ForgeneralinformationonourotherproductsandservicespleasecontactourCustomerCare DepartmentwithintheU.S.at877-762-2974,outsidetheU.S.at317-572-3993,orfax317-572-4002. Wileyalsopublishesitsbooksinavarietyofelectronicformats.Somecontentthatappearsinprint, however,maynotbeavailableinelectronicformat. FormoreinformationaboutWileyproducts,visitourWebsiteathttp://www.wiley.com. LibraryofCongressCataloging-in-PublicationData: Sheetz,Michael. Computerforensics:anessentialguideforaccountants,lawyers,andmanagers/MichaelSheetz. p.cm. Includesindex. ISBN:978-0-471-78932-1 (cloth) 1.Computercrimes–Investigation.I.Title. HV8079.C65S442007 363.25–dc22 2006030331 PrintedintheUnitedStatesofAmerica. 10987654321 This book is dedicated to my mother and father, whose love and encouragement have given me the confidence to dare to dream, and to the memory of my grandfather, Benjamin Franklin Sheetz. His love of the written word lives on in me. C ONTENTS Introduction xi Acknowledgments xvii 1 A Definition of Computer Forensics 1 Introduction 1 ForensicScience 2 HistoryofComputerForensics 2 WorldWideWeb 5 HackerCommunity 6 Conclusion 10 Notes 11 SuggestedReading 12 2 Basics of Computer Forensic Concepts 13 Introduction 13 UnderstandingDigitalEvidence 14 Input 15 Storage 15 Processing 16 WhatComputerDataIs 17 Output 23 Conclusion 24 Notes 24 SuggestedReading 24 3 Preservation and Collection of Digital Evidence 25 Introduction 25 RulesofEvidence 26 Preservation 27 Collection 30 Conclusion 36 Note 37 SuggestedReading 37 vii viii CONTENTS 4 Analysis of Digital Evidence 38 Introduction 38 ForensicAnalysis 39 Conclusion 50 Notes 50 SuggestedReading 51 5 Reporting and Rendering the Opinion 52 Introduction 52 PreparingtheReport 53 Presentation 57 TrialProcess 57 Conclusion 64 SuggestedReading 65 6 Computer Attacks 66 HackersandPhreakzOhMy 66 Hackers:UnauthorizedUseandTrespassing 66 WirelessHacking 71 Malware 75 AttacksfromtheInside 79 Conclusion 85 Notes 86 SuggestedReading 87 7 Computers as Tools for Evil 88 Introduction 88 ComputersandCrime 88 IdentityTheft 89 Concealment 96 AuctionFraudandRetailCons 97 CounterfeitingandForgery 100 Prostitution 100 SecuritiesFraud 101 Conclusion 105 Notes 105 CONTENTS ix 8 Computer Tools and the Forensic Examination 108 Introduction 108 AssumingControloftheCase 109 UnderstandingtheCase 109 EvaluatingtheEvidence 110 Examiningthe‘‘Live’’System 110 CollectingDatafromaDeadSystem 116 ImagingtheDrive 118 DataExtraction 120 DataAnalysis 122 Conclusion 125 Notes 126 9 Presenting Digital Evidence in Court 127 Introduction 127 Evidence 128 TypesofEvidence 129 ExpertWitnesses 131 LegalRequirementsofEvidence 132 SearchandSeizure 137 Conclusion 142 Notes 143 Index 145