Computer Forensics: Computer Crime Scene Investigation (with CD-ROM) with CDROM [Paperback]

On the other hand, though Vacca gives good general advice (don't lose volatile information by shutting a compromised machine down midattack; do be prepared to translate memory dumps into jury-readable form), he sometimes meanders into generalizations and irrelevancies. The fact that terrorists distribute their plans via public Web sites is certainly scary, but hardly helpful to someone wanting to prosecute the guy who vandalized the corporate Web site. Similarly interesting, but practically irrelevant to most of us, are discussions of high-energy radio frequency (HERF) and electromagnetic pulse (EMP) weapons that can knock out information systems from a distance. More focus on evidence collection in organizational computing environments would make this book useful, rather than just generally informative. --David Wall

Topics covered: How to gather evidence of a hack attack after the fact, and a lot of general-interest information on the state of crime and law enforcement in computer technology. Coverage is almost all general in nature, dealing with how to formulate a strategy and deal with events without getting into details of any operating system or computing environment.

KEY FEATURES

* Comprehensive overview of the subject from definitions to data recovery techniques to auditing methods to terrorist cyber-attacks

* Case studies and vignettes of actual computer crimes

* Selected Topics: Computer Forensics Fundamentals; Data Recovery; Evidence Collection And Data Seizure; Duplication And Preservation Of Digital Evidence; Electronic Evidence Reconstructing Past Events; Deterrence through Attacker ID; Destruction of e-mail; Is the US Government Prepared for Information Warfare; The Dark World of the Cyber Underground; Protection against Random Terrorist Information Warfare Tactics; The Cyber Foot Print and Criminal Tacking; The Individual Exposed; Case Studies and Vignettes

* CD includes tools, presentations, and demos of the latest computer forensics software, including partition images from The Forensic Challenge

On the CD-ROM:

The following forensic tools, demos, and presentations are included on the accompanying CD-ROM.

The Forensics Challenge Partition Images
- The HoneyNet Project
FW-1 Specific Network Intrusion Detector
- Lance Spitzner
RecoverNT v3.5(demo)
Recover98 v3.5 (demo)
FILERECOVERY for Windows v2.1(demo)
PHOTORECOVERY for Digital Media 1.5(demo)
- LC Technology International, Inc.
The Coroner's Toolkit (TCT)
- Dan Farmer and Wietse Venema
Free Hex Editor v1.1
- Raihan Kibria
WinHex 10.45(demo)
- X-Ways Software Technology AG
TCPurify 0.9.6
- Ethan Blanton
Protect2000 Security Suite (product presentation)
- Computer Security Products Inc.
Mazu Enforcer (product presentation)
- Mazu Networks