The Basics of Digital Forensics: The Primer for Getting Started in Digital Forensics

The Basics of Digital Forensics: The Primer for Getting Started in Digital Forensics

Volumn , Issue , 2012, Pages 1-177

  Sammons, John ^a  

^a MARSHALL UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 85061557548     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1016/C2010-0-68337-4     Document Type: Book

References (218)

1. American Academy of Forensic Sciences. (n.d.). About AAFS. Retrieved February 4, 2011, from: . http://www.aafs.org/about-aafs.
2. ASTM. (n.d.). ABOUT: ASTM. Retrieved February 23, 2011, from: . http://www.astm.org/ABOUT/aboutASTM.html.
3. ASTM. (n.d.). E30. Retrieved February 23, 2011, from: . http://www.astm.org/COMMIT/SUBCOMMIT/E30.htm.
4. ASTM. (n.d.). Overview: ABOUT: ASTM. Retrieved February 23, 2011, from: . http://www.astm.org/ABOUT/overview.html.
5. Carvey, H. (2005, January 27). Locard's Exchange Principle in the Digital World: Windows Incident Response. Retrieved February 23, 2011, from: . http://windowsir.blogspot.com/2005/01/locards-exchange-principle-in-digital.html.
6. Federal Bureau of Investigation. (n.d.). Scientific Working Groups: Federal Bureau of Investigation. Retrieved February 19, 2011, from: . http://www.fbi.gov/about-us/lab/swgs.
7. Lawler, B. A. (2002, September 4). Government's Response to Court's Order on Computer and Email Evidence. Retrieved September 13, 2011, from: . http://news.findlaw.com/hdocs/docs/moussaoui/usmouss90402grsp.pdf.
8. McKendrick, J. (2010, May 12). Size of the Data Universe: 1.2 Zettabytes and Growing Fast: ZDNet. Retrieved February 23, 2011, from: . http://www.zdnet.com/blog/service-oriented/size-of-the-data-universe-12-zettabytes-and-growing-fast/4750.
9. Regional Computer Forensics Laboratory. (n.d.). RCFL: Regional Computer Forensics Laboratory. Retrieved February 4, 2011, from: . http://www.rcfl.gov/.
10. Saferstein R. Criminalistics: An Introduction to Forensic Science 2006, Prentice Hall, Upper Saddle River, New Jersey. College Edition.
11. Scientific Working Group on Digital Evidence. (n.d.). Scientific Working Group on Digital Evidence-About Us. Retrieved February 4, 2011, from: . http://www.swgde.org.
12. Stuart, J., Nordby, J. J., & Bell, S. (2009). Forensic Science: An Introduction to Scientific and Investigative Techniques February 20, 2009 (3rd ed.). Boca Raton, FL: CRC Press.
13. U.S. Army. (n.d.). Document and Media Exploitation (DOMEX): 2010 Army Posture Statement. Retrieved February 23, 2011, from: . https://secureweb2.hqda.pentagon.mil/vdas_armyposturestatement/2010/information_papers/Document_and_Media_Exploitation_%28DOMEX%29.asp.
14. RCFL Annual Report for Fiscal Year 2009 2009, U.S. Department of Justice, U.S. Department of Justice, Washington, DC.
15. Zatyko, K. (n.d.). Commentary: Defining Digital Forensics. Retrieved February 19, 2011, from: . http://www.forensicmag.com/node/128.
16. Apple, Inc. (2004, March 5). Technical Note TN1150 HFS Plus Volume Format. Retrieved August 10, 2011, from: . http://developer.apple.com/library/mac/#technotes/tn/tn1150.html.
17. Casey E. Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet 2011, Academic Press, Waltham, MA.
18. Casey E. Handbook of Digital Forensics and Investigation 2009, Academic Press, Burlington, MA.
19. Cooper, B. (2004, August). What Is the Difference Between Memory and Storage? Retrieved August 10, 2011, from: . http://searchstorage.techtarget.com/answer/What-is-the-difference-between-memory-and-storage.
20. Dale N. Computer Science Illuminated 2009, Jones and Bartlett, Sudbury, MA. Fourth Edition.
21. Gupta M.R., Hoeschele M.D., Rogers M.K. Hidden Disk Areas: HPA and DCO. International Journal of Digital Evidence 2006, 5(1).
22. Microsoft Corporation. (n.d.). Comparing NTFS and FAT File Systems. Retrieved August 10, 2011, from: . http://windows.microsoft.com/en-US/windows-vista/Comparing-NTFS-and-FAT-file-systems.
23. (2000, December). Optical Media. Retrieved August 10, 2011, from: . http://searchstorage.techtarget.com/definition/optical-media.
24. Unicode Inc. (2010, September 17). What Is Unicode? Retrieved August 10, 2011, from: . http://www.unicode.org/standard/WhatIsUnicode.html.
25. About: American Society of Crime Laboratory Directors/Laboratory Accreditation Board. (n.d.). Retrieved June 4, 2011, from: . http://www.ascld-lab.org/about_us/aboutoverview.html.
26. AccessData Group, LLC. (2011, February). Downloads: AccessData. Retrieved August 24, 2011, from: . http://accessdata.com/downloads/media/FTK_3x_System_Specifications_Guide.pdf.
27. American Society of Crime Laboratory Directors/Laboratory Accreditation Board. (n.d.). Did You Know: American Society of Crime Laboratory Directors/Laboratory Accreditation Board. Retrieved June 4, 2011, from: . http://www.ascld-lab.org/largest_accreditation.html.
28. American Society of Crime Laboratory Directors/Laboratory Accreditation Board. (n.d.). Objectives: American Society of Crime Laboratory Directors/Laboratory Accreditation Board. Retrieved June 4, 2011, from: . http://www.ascld-lab.org/about_us/objectives.html.
29. Barbara, J. J. (n.d.). Digital Evidence Accreditation. Retrieved August 25, 2011, from: . http://www.forensicmag.com/article/digital-evidence-accreditation?page=0,3.
30. Barbara, J. J. (n.d.). Digital Evidence Accreditation: Forensic Magazine. Retrieved June 4, 2011, from: . http://www.forensicmag.com/article/digital-evidence-accreditation.
31. Brunty, J. (2011, March 2). Validation of Forensic Tools and Software: A Quick Guide for the Digital Forensic Examiner. Retrieved August 24, 2011, from: . http://www.dfinews.com/article/validation-forensic-tools-and-software-quick-guide-digital-forensic-examiner?page=0,2.
32. Carrier, B. B. (2002, October). Papers:Digital-evidence.org. Retrieved August 24, 2011, from: . http://www.digital-evidence.org/papers/opensrc_legal.pdf.
33. Chan, S. (1994, August 21). Scores of Convictions Reviewed as Chemist Faces Perjury Accusations. Retrieved from: (Accessed 21.08.94). http://articles.latimes.com/1994-08-21/news/mn-29449_1_lab-tests-fred-zain-double-murder.
34. Regional Computer Forensics Laboratory Annual Report Fiscal Year 2010 2010, Federal Bureau of Investigation, U.S. Department of Justice, Washington, DC.
35. James S., Nordby J.J. Forensic Science: An Introduction to Scientific and Investigative Techniques 2009, CRC Press, Boca Raton, FL. Third Edition.
36. Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004, National Institute of Justice, U.S. Department of Justice, Washington, DC.
37. Test Results for Hardware Write Block Device: T4 Forensic SCSI Bridge (FireWire Interface) 2009, National Institute of Justice, National Institute of Justice, Washington, DC, U.S. Department of Justice, Office of Justice Programs.
38. National Institute of Standards and Technology. (n.d.). Computer Forensics Tool Testing Project Web Site: National Institute of Standards and Technology. Retrieved June 6, 2011, from: . http://www.cftt.nist.gov/index.html.
39. Saferstein R. Criminalistics: An Introduction to Forensic Science (College Edition) 2006, Prentice Hall, Upper Saddle River, NJ. 9th ed.
40. Scientific Working Group on Digital Evidence. (2010, May 15). Minimum Requirements for Quality Assurance in the Processing of Digital and Multimedia Evidence. Retrieved August 24, 2011, from: . http://www.swgde.org/documents/current-documents/.
41. Whitcomb, C. A. (n.d.). Virtual Digital Forensics Lab. Largo, FL: National Center for Forensic Science.
42. WSAZ. (2011, April 1). UPDATE: Donald Good Receives Two Life Sentences in Mall Rape Case. Retrieved from: (Accessed 17.11.11). http://www.wsaz.com/news/headlines/UPDATE_Judge_OHanlon_Will_Preside_Over_Huntington_Mall_Rape_Case.html.
43. About: American Society of Crime Laboratory Directors/Laboratory Accreditation Board. (n.d.). Retrieved June 4, 2011, from: . http://www.ascld-lab.org/about_us/aboutoverview.html.
44. AccessData Group, LLC. (2011, February). Downloads: AccessData. Retrieved August 24, 2011, from: . http://accessdata.com/downloads/media/FTK_3x_System_Specifications_Guide.pdf.
45. American Society of Crime Laboratory Directors Laboratory Acceditation Board. (n.d.). ASCLD/LAB Guiding Principles of Professional Responsibility for Crome Laboratories and Forensic Scientists. Retrieved September 3, 2011, from: . http://www.ascld-lab.org/about_us/guidingprinciples.html.
46. American Society of Crime Laboratory Directors/Laboratory Accreditation Board. (n.d.). Did You Know: American Society of Crime Laboratory Directors/Laboratory Accreditation Board. Retrieved June 4, 2011, from: . http://www.ascld-lab.org/largest_accreditation.html.
47. American Society of Crime Laboratory Directors/Laboratory Accreditation Board. (n.d.). Objectives: American Society of Crime Laboratory Directors/Laboratory Accreditation Board. Retrieved June 4, 2011, from: . http://www.ascld-lab.org/about_us/objectives.html.
48. Good Practice Guide for Computer-Based Electronic Evidence 2011, Association of Chief Police Officers, 7Safe, Cambridge, MA.
49. ASTM International. (n.d.). ASTM Overview. Retrieved October 1, 2011, from: . http://www.astm.org/ABOUT/overview.html.
50. Barbara, J. J. (n.d.). Digital Evidence Accreditation. Retrieved August 25, 2011, from: . http://www.forensicmag.com/article/digital-evidence-accreditation?page=0,3.
51. Barbara, J. J. (n.d.). Digital Evidence Accreditation: Forensic Magazine. Retrieved June 4, 2011, from: . http://www.forensicmag.com/article/digital-evidence-accreditation.
52. Barbara, J. J. (n.d.). Triage a Computer. Retrieved June 14, 2011, from: . http://www.forensicmag.com/article/triage-computer.
53. Brunty, J. (2011, March 2). Validation of Forensic Tools and Software: A Quick Guide for the Digital Forensic Examiner. Retrieved August 24, 2011, from: . http://www.dfinews.com/article/validation-forensic-tools-and-software-quick-guide-digital-forensic-examiner?page=0,2.
54. Carrier, B. B. (2002, October). Papers: Digital-evidence.org. Retrieved August 24, 2011, from: . http://www.digital-evidence.org/papers/opensrc_legal.pdf.
55. Carvey H. Windows Forensic Analysis DVD Toolkit 2009, Syngress, Burlington, MA. 2nd ed.
56. Casey E. Handbook of Digital Forensics and Investigation 2009, Academic Press, Burlington, MA.
57. Casey E. Digital Evidence and Computer Crime, 3rd ed.: Forensic Science, Computers, and the Internet 2011, Academic Press, Waltham, MA.
58. Cellebrite Mobile Synchronization LTD. (n.d.). UFED Physical Pro. Retrieved October 2, 2011, from: . http://www.cellebrite.com/forensic-products/forensic-products/ufed-physical-pro.html.
59. Chan, S. (1994, August 21). Scores of Convictions Reviewed as Chemist Faces Perjury Accusations: Forensics. Retrieved September 27, 2011, from: . http://articles.latimes.com/1994-08-21/news/mn-29449_1_lab-tests-fred-zain-double-murder.
60. Craiger, P. J. (n.d.). Virtual Digital Evidence Laboratory. Retrieved September 16, 2011, from: . http://www.ncfs.org/VDEL.Craiger.Report.NIJ.final.pdf.
61. DNA Initiative, The. (n.d.). Glen Woodall (Huntington, West Virginia). Retrieved September 27, 2011, from: . http://www.dna.gov/postconviction/convicted_exonerated/woodall.
62. Computer Forensics: Investigation Procedures and Response 2009, EC-Council, Cengage Learning, Clifton Park, NY.
63. Favro, P. (2011, September 15) Breaking News: $919 Million Verdict for DuPont in Trade Secret Theft and eDiscovery Sanctions Case. E-Discovery blog: . http://www.clearwellsystems.com/e-discovery-blog/.
64. Regional Computer Forensics Laboratory Annual Report Fiscal Year 2010 2010, Federal Bureau of Investigation, U.S. Department of Justice, Washington, DC.
65. Henry, P. (2009, September 12). Best Practices in Digital Evidence Collection. Retrieved October 15, 2011, from: . http://computer-forensics.sans.org/blog/2009/09/12/best-practices-in-digital-evidence-collection/.
66. James S., Nordby J.J. Forensic Science: An Introduction to Scientific and Investigative Techniques 2009, CRC Press, Boca Raton, FL. 3rd ed.
67. Microsoft Corporation. (n.d.). Encarta: Michael Faraday. Retrieved June 13, 2011, from: . http://www.webcitation.org/5kwc3quLs.
68. National Institute of Justice. (n.d.). Collecting Digital Evidence Flowchart: National Institute of Justice. Retrieved June 14, 2011, from: . http://www.nij.gov/publications/ecrime-guide-219941/ch5-evidence-collection/collecting-digital-evidence-flowchart.htm.
69. National Institute of Justice. (n.d.). Digital Evidence and Forensics: National Institute of Justice. Retrieved June 14, 2011, from: . http://www.nij.gov/nij/topics/forensics/evidence/digital/welcome.htm.
70. Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004, National Institute of Justice, U.S. Department of Justice Office of Justice Programs, Washington, DC.
71. Electronic Crime Scene Investigation: A Guide for First Responders 2008, National Institute of Justice, U.S. Department of Justice, Washington, DC. 2nd ed.
72. Electronic Crime Scene Investigation: An On-the-Scene Reference for First Responders 2009, National Institute of Justice, U.S. Department of Justice, Washington, DC.
73. Test Results for Hardware Write Block Device: T4 Forensic SCSI Bridge (FireWire Interface) 2009, National Institute of Justice, National Institute of Justice, Washington, DC, U.S. Department of Justice, Office of Justice Programs.
74. National Institute of Standards & Technology. (n.d.). CFTT Project Overview. Retrieved September 30, 2011, from.gov: . http://www.cftt.nist.gov/project_overview.htm.
75. National Institute of Standards and Technology. (n.d.). Computer Forensics Tool Testing Project Web Site: National Institute of Standards and Technology. Retrieved June 6, 2011, from: . http://www.cftt.nist.gov/index.html.
76. Paraben Corporation. (n.d.). Device Seizure v4.5. Retrieved October 2, 2011, from: . http://www.paraben.com/device-seizure.html.
77. Phillip A., Cowen D., Davis C. Hacking Exposed Computer Forensics: Computer Forensics Secrets & Solutions 2009, McGraw-Hill, New York.
78. Princeton University Center for Information Technology Policy. (2008, February 21). Lest We Remember: Cold Boot Attacks on Encryption Keys. Retrieved October 19, 2011, from: . http://www.youtube.com/watch?v=JDaicPIgn9U.
79. Saferstein R. Criminalistics: An Introduction to Forensic Science (College Edition) 2006, Prentice Hall, Upper Saddle River, NJ. 9th ed.
80. Scientific Working Group on Digital Evidence. (2009, January 15). SWGDE Recommended Guidelines for Validation Testing v1.1. Retrieved September 19, 2011, from: . http://www.swgde.org/documents/current-documents/.
81. Scientific Working Group on Digital Evidence. (2010a, May 15). Minimum Requirements for Quality Assurance in the Processing of Digital and Multimedia Evidence. Retrieved August 24, 2011, from: . http://www.swgde.org/documents/current-documents/.
82. Sedona Conference. (2010, September). The Sedona Conference Glossary: E-Discovery & Digital Information Management (3rd ed.). Retrieved October 21, 2011, from: . http://www.thesedonaconference.org/publications_html.
83. Shipley, T. G. (n.d.). Collection of Evidence from the Internet: Part 1. Retrieved June 14, 2011, from: . http://www.dfinews.com/article/collection-evidence-internet-part-1?page=0,1.
84. Shipley, T. G. (n.d.). Collection of Evidence from the Internet: Part 2. Retrieved June 14, 2011, from: . http://www.dfinews.com/article/collection-evidence-internet-part-2.
85. Shipley T.G., Reeve H.R. Collecting Evidence from a Running Computer: A Technical and Legal Primer for the Justice Community 2006, Search Group, Incorporated, Sacramento, CA.
86. Warrington, D. (n.d.). Crime Scene 101: Locating and Documenting Evidence. Retrieved June 14, 2011, from: . http://www.forensicmag.com/article/crime-scene-101-locating-and-documenting-evidence.
87. Whitcomb, C. (n.d.). A Virtual Digital Forensics Lab. Retrieved September 28, 2011, from: . http://www.ascld.org/files/digital%20VDEL%20Craiger%20ASCLD%20cmw.pdf.
88. WSAZ. (2011, April 1). UPDATE: Donald Good Receives Two Life Sentences in Mall Rape Case. Retrieved September 27, 2011, from: . http://www.wsaz.com/news/headlines/105522183.html.
89. Bard, J. (n.d.). The Windows Registry. Retrieved May 2, 2011, from: . http://technet.microsoft.com/en-us/library/cc751049.aspx.
90. Brodkin, J. (n.d.). Windows on Verge of Dropping Below 90% Market Share. Retrieved May 2, 2011, from: . http://www.networkworld.com/news/2011/011311-windows-on-verge-of-dropping.html.
91. Casey E. Handbook of Digital Forensics and Investigation 2009, Academic Press, Burlington, MA.
92. Gupta M.R., Hoeschele M.D., Rogers M.K. Hidden Disk Areas: HPA and DCO. International Journal of Digital Evidence 2006, 1-8.
93. Larson, T. (2010, July 8). Windows 7: Current Events in the World of Windows Forensics. Retrieved May 3, 2011, from: . http://computer-forensics.sans.org/summit-archives/2010/files/12-larson-windows7-foreniscs.pdf.
94. Microsoft Corporation. (n.d.). How the Recycle Bin Stores Files. Retrieved May 2, 2011, from: . http://support.microsoft.com/kb/136517.
95. Microsoft Corporation. (n.d.). Sleep and Hibernation: Frequently Asked Questions. Retrieved May 2, 2011, from: . http://windows.microsoft.com/en-US/windows7/Sleep-and-hibernation-frequently-asked-questions.
96. Microsoft Corporation. (n.d.). System Restore: Frequently Asked Questions. Retrieved May 2, 2011, from: . http://windows.microsoft.com/en-US/windows-vista/System-Restore-frequently-asked-questions.
97. Microsoft Corporation. (n.d.). User Accounts Overview: Microsoft Corporation. Retrieved May 2, 2011, from: . http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/usercpl_overview.mspx?mfr=true.
98. Phillip A., Cowen D., Davis C. Hacking Exposed Computer Forensics: Computer Forensics Secrets & Solutions 2009, McGraw-Hill, New York.
99. TechTarget. (n.d.). Spool: Whatis.com. Retrieved May 2, 2011, from: . http://whatis.techtarget.com/definition/0, sid9_gci214229,00.html.
100. AntiForensics Community. (n.d.). About AntiForensics: AntiForenics. Retrieved May 13, 2011, from: . http://www.antiforensics.com/.
101. OS X Lion: About FileVault 2011, July 26, 2. Apple, Inc, Retrieved August 14, 2011, from:. http://support.apple.com/kb/HT4790.
102. Backbone's Digital Steganography Database Exceeds 925 Applications 2011, April 26, Backbone Security.com, Retrieved August 14, 2011, from:. http://www.sarc-wv.com/news/press_releases/2011/safdb_v39.aspx.
103. Barbara, J. (2008, December 01). Anti-Digital Forensics, The Next Challenge: Part 1. Retrieved August 15, 2011, from: . http://www.forensicmag.com/article/anti-digital-forensics-next-challenge-part-1.
104. Bauchie R., Hazen F., Lund J., Oakley G., Rundatz F. Encryption 2000, July, Retrieved August 17, 2011, from:. http://searchsecurity.techtarget.com/definition/encryption.
105. Berghel H. Hiding Data, Forensics, and Anti-forensics. Communications of the ACM 2007, 15-20.
106. Caproni V. Going Dark: Lawful Electronic Surveillance in the Face of New Technologies 2011, February 17, Retrieved August 15, 2011, from:. http://www.fbi.gov/news/testimony/going-dark-lawful-electronic-surveillance-in-the-face-of-new-technologies.
107. Casey E. Handbook of Digital Forensics and Investigation 2009, Academic Press, Burlington, MA.
108. Casey E. Digital Evidence and Computer Crime, 3rd ed.: Forensic Science, Computers, and the Internet 2011, Academic Press, Waltham, MA.
109. FBI: 10 Russian Spies Arrested in U.S 2010, June 29, CBS News, Retrieved September 11, 2011, from:. http://www.cbsnews.com/stories/2010/06/28/world/main6627393.shtml.
110. Dick, Ronald L. Issue of Intrusions into Government Computer Networks 2001, April 5, Retrieved August 14, 2011, from:. http://www.fbi.gov/news/testimony/issue-of-intrusions-into-government-computer-networks.
111. Elcomsoft Co. Ltd. (n.d.). System & Security Software. Retrieved August 27, 2011, from: . http://www.elcomsoft.com/esr.html#forgot%20administrator%20password.
112. Geiger M. Evaluating Commercial Counter-Forensic Software. DFRWS 2005, New Orleans.
113. Gupta M.R., Hoeschele M.D., Rogers M.K. Hidden Disk Areas: HPA, and DCO. International Journal of Digital Evidence 2006, 1-8.
114. Feds Forced to Get Creative to Bypass Encryption 2011, March 18, Homeland Security Newswire, Retrieved August 14, 2011, from:. http://www.homelandsecuritynewswire.com/feds-forced-get-creative-bypass-encryption.
115. HowStuffWorks, Inc. (n.d.). What Is a Computer Algorithm? Retrieved August 17, 2011, from: . http://computer.howstuffworks.com/question717.htm.
116. Kelley J. Terrorist Instructions Hidden Online 2005, February 5, Retrieved August 14, 2011, from:. http://www.usatoday.com/life/cyber/tech/2001-02-05-binladen-side.htm.
117. Microsoft Corporation. (n.d.). BitLocker Drive Encryption Overview. Retrieved June 20, 2011, from: . http://windows.microsoft.com/en-US/windows-vista/BitLocker-Drive-Encryption-Overview.
118. Microsoft Corporation. (n.d.). Compare Windows. Retrieved June 20, 2011, from: . http://windows.microsoft.com/en-US/windows7/products/compare.
119. Microsoft Corporation. (n.d.). Create Strong Passwords. Retrieved August 13, 2011, from: . http://www.microsoft.com/security/online-privacy/passwords-create.aspx.
120. Microsoft Corporation. (n.d.). The Encrypting File System. Retrieved September 11, 2011, from: . http://technet.microsoft.com/en-us/library/cc700811.aspx.
121. Microsoft Corporation. (n.d.). Unique Technology for Enterprise Customers. Retrieved August 27, 2011, from: . http://www.microsoft.com/windows/enterprise/products/windows-7/features.aspx#bitlocker.
122. Microsoft Corporation. (n.d.). What Is Encrypting File System (EFS)? Retrieved June 20, 2011, from: . http://windows.microsoft.com/en-US/windows7/What-is-Encrypting-File-System-EFS.
123. Microsoft Corporation. (n.d.). Windows BitLocker Drive Encryption Step-by-Step Guide: Microsoft Corporation. Retrieved May 13, 2011, from: . http://technet.microsoft.com/en-us/library/cc766295%28WS.10%29.aspx.
124. Windows BitLocker Drive Encryption Frequently Asked Questions 2009, July 10, Microsoft Corporation, Retrieved August 18, 2011, from:. http://technet.microsoft.com/enus/library/cc766200%28WS.10%29.aspx#BKMK_EntireDiskMicrosoft.
125. Mozilla Foundation. (n.d.). Private Browsing. Retrieved August 27, 2011, from: . http://support.mozilla.com/enUS/kb/Private%20Browsing#w_what-does-private-browsing-not-save.
126. Phillip A., Cowen D., Davis C. Hacking Exposed Computer Forensics: Computer Forensics Secrets & Solutions 2009, McGraw-Hill, New York.
127. Rogers M. Anti-Forensics. Lockheed Martin 2005, San Diego.
128. Schneier B. Crypto-Gram Newsletter 2002, May 15, Retrieved June 20, 2011, from:. http://www.schneier.com/crypto-gram-0205.html#1.
129. Schneier B. Secure Passwords Keep You Safer 2007, January 15, Retrieved August 25, 2011, from:. http://www.schneier.com/essay-148.html.
130. Strickland, J. (n.d.). How Stuff Works: How Computer Forensics Works. Retrieved May 13, 2011, from: . http://computer.howstuffworks.com/computer-forensic3.htm.
131. Symantec Corporation. (n.d.). PGP Encryption Products. Retrieved May 13, 2011, from: . http://www.symantec.com/business/theme.jsp?themeid=pgp.
132. Symantec Corporation. (n.d.). Whole Disk Encryption: Symantec Corporation. Retrieved May 13, 2011, from: . http://www.symantec.com/business/whole-disk-encryption.
133. Steganography 2000, December, TechTarget, Retrieved August 15, 2011, from:. http://searchsecurity.techtarget.com/definition/steganography.
134. System Encryption 2011, July 11, TrueCrypt Developers Association, Retrieved August 14, 2011, from:. http://www.truecrypt.org/docs/?s=version-history.
135. TrueCrypt Developers Association. (n.d.). Documentation: TrueCrypt Developers Association. Retrieved May 13, 2011, from: . http://www.truecrypt.org/docs/.
136. Tyma P. Encryption, Hashing, and Obfuscation 2003, April 8, Retrieved June 20, 2011, from:. http://www.zdnet.com/news/encryption-hashing-and-obfuscation/128604.
137. United States of America v. Christopher R. Metsos, et al. (2010, June 1). Southern District, New York.
138. Vijayan J. Updated Encryption Tool for al-Qaeda Backers Improves on First Version, Researcher Says: Computerworld 2008, February 4, Retrieved May 13, 2011, from:. http://www.computerworld.com/s/article/9060939/Updated_encryption_tool_for_al_Qaeda_backers_improves_on_first_version_researcher_says.
139. Wawro A. US Government Using PS3s to Crack Encryption, Catch Paedophiles 2009, November 19, Retrieved August 17, 2011, from:. http://www.computerworlduk.com/news/security/17680/us-government-using-ps3s-to-crack-encryption-catch-paedophiles/.
140. Wetstone Technologies, Inc. (n.d.). Stego Suite™-Discover the Hidden. Retrieved August 18, 2011, from: . http://www.wetstonetech.com/product/stego-suite/.
141. What IsAnti-Forensics.com? (n.d.). Retrieved August 14, 2011, from: . http://www.anti-forensics.com/about-anti-forensics.
142. Casey E. Digital evidence and computer crime, 3rd ed.: Forensic science, computers, and the Internet 2011, Academic Press, Waltham, MA.
143. Daubert v. Merrell Dow Pharmaceuticals,Inc., 509 U.S. 579 (1993).
144. Prosecuting computer crime 2007, Executive Office for United States Attorneys, United States Department of Justice, Washington, DC, Office of Legal Education.
145. Searching and seizing computers and obtaining electronic evidence in criminal investigations 2009, Executive Office for United States Attorneys, United States Department of Justice, Washington, DC, Office of Legal Education.
146. Frye v. United States, .293 F. 1013 ( D.C. Cir 1923).
147. FindLaw. (n.d.). Fourth Amendment-Search and Seizure. Retrieved October 4, 2011, from: . http://caselaw.lp.findlaw.com/data/constitution/amendment04/.
148. Goldfoot J. The physical computer and the Fourth Amendment. Berkley Journal of Criminal Law 2011, 16(1):112-167.
149. Illinois v. Gates, 462 U.S. 213, 238, (1983).
150. Kerr O.S. Digital evidence and the new criminal procedure. Columbia Law Review 2005, 105(1):279-318.
151. Kerr O.S. Searches and seizures in a digital world. Harvard Law Review 2005, 119(2):532-585.
152. Kroll OnTrack, Inc. (n.d.). Zubulake v. UBS Warburg. Retrieved October 10, 2011, from: . http://www.krollontrack.co.uk/zubulake/.
153. McCullagh, D. (2007, December 14). Judge: Man Can't Be Forced to Divulge Encryption Passphrase. Retrieved October 3, 2011, from: . http://news.cnet.com/8301-13578_3-9834495-38.html.
154. Scheindlin S., Capra D.J. Electronic discovery and digital evidence: Cases and materials 2008, Eagan, MN: Thomson West.
155. The Sedona Conference glossary: E-Discovery & digital information management 2007, Sedona Conference, Sedona Conference, Sedona, AZ. 2nd ed.
156. Electronic Discovery. Retrieved November 6, 2011, from Search Financial Security 2007, TechTarget, www.TechTarget.com: http://searchfinancialsecurity.techtarget.com/definition/electronic-discovery.
157. U.S. Department of Justice, Office of Justice Programs. (2010). Privacy and Civil Liberties. Retrieved October 10, 2011, from: . http://it.ojp.gov/default.aspx?area=privacy%26page=1284#contentTop.
158. United States v. Megahed, 2009 WL 722481, at 3 (M.D. Fla. Mar. 18, 2009).
159. United States v. Slanina, 283 F.3d 670, 680 (5th Cir. 2002).
160. United States v. Walser, 275 F.3d 981, 986 (10th Cir. 2001).
161. Zubulake v. UBS Warburg, 217 F.R.D. 309 (S.D.N.Y. 2003).
162. Casey E. Handbook of Digital Forensics and Investigation 2009, Academic Press, Burlington, MA.
163. Casey E. Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet 2011, Academic Press, Waltham, MA.
164. E.I. du Pont de Nemours and Company v. Kolon Industries, Inc., 2011 U.S. Dist. LEXIS 45888 (E.D. Va. April 27, 2011).
165. Google. (2011, September 21). Reading Full Email Headers. Retrieved October 24, 2011, from: . http://mail.google.com/support/bin/answer.py?hl=en%26answer=29436.
166. Network Solutions, LLC. (n.d.). WHOIS Behind That Domain Name? Retrieved October 13, 2011, from: . http://www.networksolutions.com/whois/index.jsp.
167. Refsnes Data. (n.d.). HTML Introduction. Retrieved October 13, 2011, from: . http://www.w3schools.com/html/html_intro.asp.
168. Bowden M. Worm: The First Digital World War 2011, Atlantic Monthly Press, New York.
169. Casey E. Handbook of Digital Forensics and Investigation 2009, Academic Press, Burlington, MA.
170. Casey E. Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet 2011, Academic Press, Waltham, MA.
171. Conrad E., Misenar S., Feldman J. CISSP Study Guide 2010, Elsevier, Burlington, MA.
172. Garfinkel, S. (2002, October 7). Kevin Mitnick and Anti-Social Engineering. Retrieved November 9, 2011, from CSOOnline.com: . http://www.csoonline.com/article/217395/kevin-mitnick-and-anti-social-engineering-.
173. Hadnagy C. Social Engineering: The Art of Human Hacking 2011, Wiley, Indianapolis.
174. Krebs, B. (n.d.). Coordinated ATM Heist Nets Thieves $13M. Retrieved September 19, 2011, from: . http://krebsonsecurity.com/2011/08/coordinated-atm-heist-nets-thieves-13m/.
175. Keeney, M., Kowalski, E., Cappelli, D., Moore, A., Shimeall, T., and Rogers, S. (2005, May). Insider threat study: Computer sabotage in critical infrastructure sectors. United States Secret Service and CERT program. Report available at . http://www.secretservice.gov.
176. Maggiora P.D., Doherty J. Cisco Networking Simplified 2003, Cisco Press, Indianapolis.
177. McClure S., Scambray J., Kurtz G. Hacking Exposed: Network Security Secrets and Solutions 2009, McGraw-Hill, New York.
178. Microsoft Corporation. (n.d.). IPv6. Retrieved September 17, 2011, from: . http://technet.microsoft.com/en-us/network/bb530961.aspx.
179. Mitnick K. Ghost in the Wires: My Adventures as the World's Most Wanted Hacker 2011, Little, Brown and Company, New York.
180. Morris, D. A. (2005, May 3). Tracking a Computer Hacker. Retrieved September 19, 2011, from: . http://www.justice.gov/criminal/cybercrime/usamay2001_2.htm.
181. Nikkel, B. J. (2007). An Introduction to Investigating IPv6 Networks. Digital Investigation: The International Journal of Digital Forensics and Incident Response Vol. 4, No. 2. Oxford, England: Elsevier.
182. Poulsen K. Kingpin: How One Hacker Took Over the Billion-Dollar Cybercrime Underground 2011, Crown, New York.
183. Prowell S., Kraus R., Borkin M. Seven Deadliest Network Attacks 2010, Syngress, Burlington, MA.
184. Scarphone, K., Grance, T., & Masone, K. (2008). Computer Security Incident Handling Guide. National Institute of Standards and Technology, Computer Security Division. Gaithersburg, TN: National Institute of Standards & Technology.
185. TechTarget. (2000, August). Intrusion Detection (ID). Retrieved September 17, 2011, from: . http://searchmidmarketsecurity.techtarget.com/definition/intrusion-detection.
186. TechTarget. (2000, October). Firewall. Retrieved September 17, 2011, from: . http://searchsecurity.techtarget.com/definition/firewall.
187. TechTarget. (2001, March). Social Engineering. Retrieved September 18, 2011, from: . http://searchsecurity.techtarget.com/definition/social-engineering.
188. TechTarget. (2002, January). Snort. Retrieved September 17, 2011, from: . http://searchmidmarketsecurity.techtarget.com/definition/Snort.
189. Vacca J.R., Rudolph K. System Forensics, Investigation, and Response 2011, Jones and Bartlett Learning, Sudbury, MA.
190. 2011 Data Breach Investigations Report 2011, Verizon Business Global LLC, & United States Secret Sevice, Verizon Business Global LLC, Ashburn.
191. Barbara, J. J. (2010, October 17). Understanding the World of Cellular Telephones: Part 1. Retrieved November 13, 2011, from Forensicmag.com: . http://www.forensicmag.com/article/understanding-world-cellular-telephones-part-1?page=0,1.
192. Barbara, J. J. (n.d.). SIM Forensics: Part 1. Retrieved September 19, 2011, from: . http://www.forensicmag.com/article/sim-forensics-part-1.
193. Barbara, J. J. (n.d.). Sim Forensics: Part 2. Retrieved September 19, 2011, from: . http://www.forensicmag.com/article/sim-forensics-part-2.
194. Barbara, J. J. (n.d.). SIM Forensics: Part 3. Retrieved September 18, 2011, from: . http://www.forensicmag.com/article/sim-forensics-part-3.
195. Barbara, J. J. (n.d.). Understanding the World of Cellular Telephones: Part 1. Retrieved September 21, 2011, from: . http://www.forensicmag.com/article/understanding-world-cellular-telephones-part-1.
196. Barbara, J. J. (n.d.). Understanding the World of Cellular Telephones: Part 2. Retrieved September 21, 2011, from: . http://www.forensicmag.com/article/understanding-world-cellular-telephones-part-2.
197. Barbara, J. J. (n.d.). Understanding The World of Cellular Telephones: Part 3. Retrieved September 21, 2011, from: . http://www.forensicmag.com/article/understanding-world-cellular-telephones-part-3.
198. BitPim. (n.d.). BitPim. Retrieved September 22, 2011, from: . http://www.bitpim.org/.
199. Brian, M., & Harris, T. (n.d.). How GPS Receivers Work. Retrieved September 14, 2011, from: . http://electronics.howstuffworks.com/gadgets/travel/gps.htm.
200. Casey E. Handbook of Digital Forensics and Investigation 2009, Academic Press, Burlington, MA.
201. Casey E. Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet 2011, Academic Press, Waltham, MA.
202. Hartenstein, M., & Sheridan, M. (2010, December 21). Missing Vegas Showgirl Debbie Flores-Narvaez was Pregnant, Beaten by her ex, According to Police. Retrieved September 25, 2011, from: . http://articles.nydailynews.com/2010-12-21/news/27085062_1_license-plates-cell-phone-police.
203. Hoog, A. (2010, April 30). An Introduction to Android Forensics. Retrieved September 2011, 2011, from: . http://www.dfinews.com/article/introduction-android-forensics?page=0,0.
204. Hoog A. Android forensics: Investigation, Analysis and Mobile Security for Google Android 2011, Elsevier, Waltham, MA.
205. Jansen W., Ayers R. Guidelines on Cell Phone Forensics 2007, National Institute of Standards and Technology, Gaithersburg, TN.
206. Kessler, G. C. (2011, June). Cell Phone Analysis: Technology, Tools, and Processes. Retrieved September 12, 2011, from: . http://www.garykessler.net/presentations/CellPhone_201106_ICAC-sanitized.pdf.
207. LeMere, B. (n.d.). Enhancing Investigations with GPS Evidence. Retrieved September 15, 2011, from: . http://www.forensicmag.com/article/enhancing-investigations-gps-evidence.
208. LeMere, B. (2011, April 25). Enhancing Investigations with GPS Evidence. Retrieved September 15, 2011, from: . http://www.forensicmag.com/article/enhancing-investigations-gps-evidence.
209. Mobile-phone-directory.org. (n.d.). Predictive Text Input. Retrieved September 17, 2011, from: . http://www.mobile-phone-directory.org/Glossary/P/Predictive_Text_Input.html.
210. Morrissey S. iOS forensic analysis: for iPhone, iPad, and iPod Touch 2010, Apress, New York.
211. Open Handset Alliance. (2007, November). FAQ. Retrieved September 19, 2011, from: . http://www.openhandsetalliance.com/oha_faq.html.
212. Shachtman, N. (2006, May 3). Fighting Crime With Cellphones' Clues. Retrieved September 19, 2011, from: . http://www.nytimes.com/2006/05/03/technology/techspecial3/03cops.html.
213. Bell, Graeme B., Boddington, Richard (December 2010). Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery? Journal of Digital Forensics, Security and Law.
214. Mell, P., & Grance, T. (2011, January). The NIST Definition of Cloud Computing. Retrieved October 9, 2011, from: . http://csrc.nist.gov/publications/drafts/800-145/Draft-SP-800-145_cloud-definition.pdf.
215. Microsoft Corporation. (n.d.). IPv6. Retrieved September 17, 2011, from: . http://technet.microsoft.com/en-us/network/bb530961.aspx.
216. Ruan, K., Baggili, I., Carthy, J., & Kechadi, T. (n.d.). Survey on Cloud Forensics and Critical Criteria for Cloud Forensic Capability: A Preliminary Analysis. Dublin, Ireland: University College Dublin.
217. Ruan K., Carthy J., Kechadi T., Crosbie M. Cloud Forensics: An Overview 2011, IBM Ireland Ltd, Dublin, Ireland.
218. TechTarget. (2007, December). Cloud Computing. Retrieved October 11, 2011, from: . http://searchcloudcomputing.techtarget.com/definition/cloud-computing.