Computer Forensics and Cyber Crime: An Introduction

Description

The leading introduction to computer crime and forensicsis now fully updated to reflect today's newest attacks, laws, and investigatory best practices. Packed with new case studies, examples, and statistics, Computer Forensics and Cyber Crime, Third Edition adds up-to-the-minute coverage of smartphones, cloud computing, GPS, Mac OS X, Linux, Stuxnet, cyberbullying, cyberterrorism, search and seizure, online gambling, and much more. Covers all forms of modern and traditional computer crime, defines all relevant terms, and explains all technical and legal concepts in plain English, so students can succeed even if they have no technical, legal, or investigatory background. Cover Title Page Copyright Page Contents Foreword Acknowledgments About the Author Chapter 1 INTRODUCTION AND OVERVIEW OF COMPUTER FORENSICS AND CYBERCRIME I. Introduction II. Cyberspace and Criminal Behavior III. Clarification of Terms IV. Traditional Problems Associated with Computer Crime a. Physicality and Jurisdictional Concerns b. Perceived Insignificance, Stereotypes, and Incompetence c. Prosecutorial Reluctance d. Lack of Reporting e. Lack of Resources f. Jurisprudential Inconsistency V. Extent of the Problem VI. The Emergence of e-Cash: A New Problem for Law Enforcement a. Prepaid Cards b. Stored Value Cards c. Mobile Payments d. Internet Payment Services e. Digital Precious Metals VII. Conclusions Discussion Questions Recommended Reading Web Resources Endnotes Chapter 2 COMPUTER TERMINOLOGY AND HISTORY I. A Brief History of Computers II. Computer Language a. Understanding Data III. Computer Hardware a. Input Devices b. Output Devices c. Hard Drives and Other Mass Storage Devices IV. Computer Software a. Boot Sequence b. Operating System V. Beyond DOS: Contemporary Operating Systems a. Microsoft Windows b. Macintosh c. UNIX d. LINUX e. Smart Phones VI. Application Software VII. A Brief History of the Internet VIII. Network Language a. Commonly Used Terms IX. Realms of the Cyberworld X. Data Bandwith Transfer Rates XI. Categorizing Internet Communication a. World Wide Web b. Newsgroups/Bulletin Boards (Usenet Groups) c. Internet Relay Chat XII. Future Issues and Conclusions Discussion Questions Recommended Reading Web Resources Endnotes Chapter 3 TRADITIONAL COMPUTER CRIME: EARLY HACKERS AND THEFT OF COMPONENTS I. Introduction II. Traditional Problems III. Recognizing and Defining Computer Crime IV. Three Incidents V. Phreakers: Yesterday’s Hackers a. What Is Phreaking? b. The War on Phreaking VI. Hacking a. Defining Hacking b. Evolution in the Hacking Community c. Contemporary Motivation d. Hierarchy of Contemporary Cybercriminals VII. Computers as Commodities a. Hardware VIII. Theft of Intellectual Property a. Software b. Film Piracy XI. Conclusions Discussion Questions Recommended Reading Web Resources Endnotes Chapter 4 CONTEMPORARY COMPUTER CRIME I. Web-Based Criminal Activity a. Interference with Lawful Use of Computers II. Malware a. Viruses and Worms b. DoS and DDoS Attacks c. Botnets and Zombie Armies d. Spam e. Ransomware and the Kidnapping of Information III. Theft of Information, Data Manipulation, and Web Encroachment a. Traditional Methods of Proprietary Information Theft b. Trade Secrets and Copyrights c. Political Espionage IV. Terrorism a. Cyberterrorism V. Neotraditional Crime: Old Wine in New Bottles a. Dissemination of Contraband or Offensive Materials b. Threatening and Harassing Communications c. Online Fraud d. e-Fencing e. Fraudulent Instruments VI. Ancillary Crimes a. Money Laundering VII. Conclusions Discussion Questions Recommended Reading Web Resources Endnotes Chapter 5 IDENTITY THEFT AND IDENTITY FRAUD I. Introduction II. Typologies of Identity Theft/Fraud a. Assumption of Identity b. Theft for Employment and/or Border Entry c. Criminal Record Identity Theft/Fraud d. Virtual Identity Theft/Fraud e. Credit Identity Theft/Fraud III. Prevalence and Victimology a. Victims and the Costs Associated with Victimization b. Future Increases IV. Physical Methods of Identity Theft a. Mail Theft b. Dumpster Diving c. Theft of Computers d. Bag Operations e. Child Identity Theft f. Insiders g. Fraudulent or Fictitious Companies h. Card Skimming, ATM Manipulation, and Fraudulent Machines V. Virtual or Internet-Facilitated Methods a. Phishing b. Spyware and Crimeware c. Keyloggers and Password Stealers d. Trojans VI. Crimes Facilitated by Identity Theft/Fraud a. Insurance and Loan Fraud b. Immigration Fraud and Border Crossings VII. Conclusions and Recommendations Discussion Questions Recommended Reading Web Resources Endnotes Chapter 6 TERRORISM AND ORGANIZED CRIME I. Terrorism a. Defining Terrorism b. Classification Through Motivation c. Roots of Contemporary Terrorism d. Terrorism as a Stage e. Cyberterrorism as a Concept II. Terror Online a. Propaganda, Information Dissemination, Recruiting, and Fundraising b. Training c. Research and Planning d. Communication e. Attack Mechanism III. Terrorism and Crime a. Criminal Activities b. Criminalizing Terrorist Acts c. Government Efforts d. Conclusions IV. Organized Crime a. Defining Organized Crime b. Distinguishing Organized Crime from Cybergangs V. Organized Crime and Technology a. Extortion b. Cargo Heists and Armed Robbery c. Fraud d. Money Laundering e. The Sex Trade f. Confidence Scams g. Fencing of Stolen Property h. Data Piracy and Counterfeit Goods i. Human Smuggling VI. Confronting Contemporary Organized Crime VII. The Intersection of Organized Crime and Terrorism Discussion Questions Recommended Reading Web Resources Endnotes Chapter 7 AVENUES FOR PROSECUTION AND GOVERNMENT EFFORTS I. Introduction II. Traditional Statutes III. The Evolution of Computer-Specific Statutes a. Computer Fraud and Abuse Act of 1986 b. National Information Infrastructure Protection Act of 1996 (NIIPA) IV. Evolving Child Pornography Statutes V. Identity Theft and Financial Privacy Statutes a. Identity Theft and Assumption Deterrence Act of 1998 b. The Financial Modernization Act of 1999 c. Fair and Accurate Credit Transactions Act (FACTA) 2003 d. Identity Theft Penalty Enhancement Act of 2004 e. Identity Theft Enforcement and Restitution Act of 2008 f. Additional Efforts to Protect Personal Information VI. Federally Funded Initiatives and Collaborations VII. Law Enforcement Operations and Tools in the United States a. Packet Sniffers and Key Loggers b. Data Mining c. Collaborations and Professional Associations VIII. International Efforts a. OECD and the Select Committee of Experts on Computer-Related Crime of the Council of Europe b. Council of Europe’s (CoE) Cybercrime Conventions IX. Conclusions Discussion Questions Recommended Reading Web Resources Endnotes Chapter 8 APPLYING THE FIRST AMENDMENT TO COMPUTER-RELATED CRIME I. Introduction and General Principles II. Obscenity in General III. Traditional Notions of Decency IV. Emerging Statutes and the Availability of Obscene Material to Children V. Traditional Attempts to Criminalize Child Pornography VI. Applying Case Law to Traditional Child Pornography Statutes a. New York v. Ferber b. Osborne v. Ohio VII. Technology-Specific Legislation—Contention in the Courts a. Child Pornography Prevention Act b. Ashcroft v. Free Speech Coalition c. Prosecutorial Remedies and Other Tools to End the Exploitation of Children Today Act (PROTECT) d. U.S. v. Williams VIII. Internet Gambling a. Unlawful Internet Gambling Enforcement Act of 2006 (UIGEA) b. Case law on Internet Gaming Statutes c. Lack of International Cooperation and the WTO IX. Future Issues and Conclusions Discussion Questions Recommended Reading Web Resources Endnotes Chapter 9 THE FOURTH AMENDMENT AND OTHER LEGAL ISSUES I. The Fourth Amendment a. Probable Cause b. Reasonable Suspicion II. Warranted Searches and Computers a. Particularity b. Seizure of Evidence c. Third-Party Origination d. Other Arguments Used in Warranted Searches III. Warrantless Searches a. Consent b. Exigent Circumstances and Emergency Situations c. Incident to Arrest d. Plain View e. Border Searches f. Other Warrantless Searches IV. Exclusionary Rule V. Electronic Surveillance and the Right to Privacy a. Types of Recognized Privacy VI. Private versus Public Sector Searches VII. Application of Ortega to E-mail: The Cases of Simons and Monroe VII. The Electronic Communications Privacy Act and The Privacy Protection Act of 1980 a. Electronic Communications Privacy Act of 1986 b. Three Titles under ECPA c. Privacy Protection Act d. Defining Interception under ECPA and the PPA e. Communications Assistance for Law Enforcement Act f. Challenges to the CALEA g. Applying the Wiretap Act to E-mail Interceptions—U.S. v. Councilman VIII. The Patriot Act a. Enhanced Presidential Authority b. Electronic Surveillance and Criminal Investigations c. National Security Letters and Other Fourth Amendment Issues IX. Other Questions Regarding Privacy a. Peer-to-Peer or File sharing b. Internet Service Provider Subscriber Records c. Web sites d. Cell phones X. Other Legal Considerations a. Vicinage b. Undercover Techniques c. Sentencing Guidelines XI. Conclusions Discussion Questions Recommended Reading Web Resources Endnotes Chapter 10 COMPUTER FORENSICS: TERMINOLOGY AND REQUIREMENTS I. Computer Forensics—An Emerging Discipline II. Traditional Problems in Computer Investigations a. Inadequate Resources b. Lack of Communication and Cooperation among Agencies c. Over-reliance on Automated Programs and Self-proclaimed Experts d. Lack of Reporting e. Evidence Corruption IV. Disk Structure and Digital Evidence a. Disk Structure and Data Storage b. Partition Table c. File Systems c. Firmware—Operating Instructions e. Data Integrity V. Developing Computer Forensic Science Capabilities VI. Minimum Housing Requirements VII. Minimum Hardware Requirements VIII. Minimum Software Requirements a. Data Preservation, Duplication, and Verification Tools b. Data Recovery/Extraction Utilities c. Data Analysis Software d. Reporting Software e. Miscellaneous Software IX. A Sampling of Popular Forensic Software a. Guidance Software b. Access Data c. Other Forensic Utilities X. Conclusions Discussion Questions Recommended Reading Web Resources Endnotes Chapter 11 SEARCHING AND SEIZING COMPUTER-RELATED EVIDENCE I. Traditional Problems Associated with Finding Digital Evidence II. Pre-search Activities a. Warrant Preparation and Application b. Plan Preparation and Personnel Gathering c. Preparing a Toolkit d. Traditional Equipment e. Computer-Specific Equipment and Materials III. On-scene Activities a. Knock, Notice, and Document b. Securing the Crime Scene c. Determining the Need for Additional Assistance d. Scene Processing e. Locating Evidence f. Seizure and Documentation of Evidence g. Bagging and Tagging h. Interviewing Witnesses i. Scene Departure and Transportation of Evidence to Lab IV. Conclusions Discussion Questions Recommended Reading Web Resources Endnotes Chapter 12 PROCESSING OF EVIDENCE AND REPORT PREPARATION I. Aspects of Data Analysis a. Establish Forensically Sterile Conditions b. Ensure Legitimacy and Capabilities of Analysis Tools c. Physical Examination d. Creation and Verification of Image e. Jumping the CMOS Password f. Short-Circuiting the Chip g. Pulling the Battery h. Recovering Passwords i. Image Verification j. Logical Examination k. Restoration of Files l. Listing of Files m. Examine Unallocated Space for Data Remnants n. Unlocking Files q. Examination of User Data Files r. Piping of Evidence s. Examination of Executable Programs t. Evidence from Internet Activity II. Non-Windows Operating Systems a. Macintosh Operating System b. Linux/Unix Operating Systems III. Smart Phones and GPS Forensics a. Smartphones IV. A Sample of Popular Products V. Naviation Sysstems VI. Report Preparation and Final Documentation VII. Conclusions Discussion Questions Recommended Reading Web Resources Endnotes Chapter 13 CONCLUSIONS AND FUTURE ISSUES I. Traditional Problems and Recommendations a. Establishing Technology-Neutral Legislation b. Establishing Accountability for Internet Users c. Increasing Public Awareness and Research Capabilities d. Increasing Interagency and Intradepartmental Cooperation e. Developing Relationships between Investigative Agencies and the Private Sector f. Developing International Cooperation g. Standardization of Accreditation or Expertise h. Miscellaneous II. Additional Approaches to Internet Crime III. Future Trends and Emerging Concerns a. Wireless Communications b. Data Hiding: Remote Storage, Encryption, and the Like c. Governing Decency and Virtual Pornography d. Data Mining and Increased Interoperability IV. Conclusions Discussion Questions Web Resources Endnotes Bibliography Index A B C D E F G H I K L M N O P R S T U V W Z Uploaded by [StormRG]