Computer Evidence : Collection & Preservation (Paperback)

Description

I know of no other book for the computer forensics professional or student that covers this material in this depth and organization. The writing is good, the references helpful...what more can I say, this is right on target for the examiner who needs to know more about the physical aspects of collecting digital evidence from computers.”
—Gary C. Kessler, Computer & Digital, Forensics program, Champlain College

Computer Evidence: Collection and Preservation teaches law enforcement and computer forensics investigators how to identify, collect, and maintain digital artifacts to preserve their reliability for admission as evidence. The book focuses on collection and preservation because these two phases of computer forensics are the most critical to evidence acceptance, but are not thoroughly covered in text or courses. Throughout the book, a constant eye is kept on evidence dynamics and the impact investigators can have on data integrity while collecting evidence. The simple act of a computer forensics investigator shutting down a suspect’s computer changes the state of the computer as well as many of its fi les, so a good understanding of evidence dynamics is essential when doing computer forensics work. Broken up into five parts, Computer Forensics & Evidence Dynamics, Information Systems, Data Storage Systems & Media, Artifact Collection, and Archiving & Maintaining Evidence, the book places specific focus on how investigators and their tools are interacting with digital evidence. By reading and using this task-oriented guide, computer forensics investigators will be able to ensure case integrity during the most crucial phases of the computer forensics process.

描述

我不知道有哪本書能像這本書一樣深入且有組織地涵蓋這個材料，適合電腦取證專業人士或學生閱讀。這本書寫得很好，參考資料也很有幫助...我還能說什麼呢，對於需要更多了解從電腦中收集數位證據的調查人員來說，這本書非常適合。
- Gary C. Kessler, Champlain College 電腦與數位取證課程

《電腦證據：收集與保存》教導執法人員和電腦取證調查人員如何識別、收集和保存數位證據，以確保其可靠性以作為證據的使用。本書專注於收集和保存，因為這兩個階段對於證據的接受至關重要，但在教材或課程中並未深入探討。在整本書中，我們一直關注證據動態和調查人員在收集證據時對數據完整性的影響。一位電腦取證調查人員關閉嫌疑人的電腦這個簡單的行為會改變電腦的狀態以及其中許多文件，因此在進行電腦取證工作時，對於證據動態的良好理解至關重要。本書分為五個部分：電腦取證與證據動態、資訊系統、數據存儲系統與媒體、證據收集以及存檔與維護證據，重點關注調查人員及其工具與數位證據的互動。通過閱讀和使用這本以任務為導向的指南，電腦取證調查人員將能夠在電腦取證過程的最關鍵階段確保案件的完整性。