Further Study

“Macro” level coverage of this field is in “Computer Forensics – Computer Crime Scene Investigation,”⁴⁵¹, by Vacca.

More technical is Computer Forensics⁴⁵² by Kruse and Heiser, providing an introduction to forensics on Windows and UNIX.

Various aspects of computer/network surveillance, initial response and evidence location on Cisco routers, Windows and UNIX are covered in Incident Response ⁴⁵³ by Mandia and Prosise, a great book with sheriff’s badge tips on how to make the best case, etc.

Sometimes computer forensics involves getting down to nearly the lowest possible levels of hardware. For details about disk drive hardware and formats of interest to those performing a forensic analysis of a disk drive’s contents, see Forensic Computing – A Practitioner’s Guide⁴⁵⁴ by Sammes and Jenkinson. This book also includes a small amount of coverage on forensics applied to handhelds.

Want to get an idea of how you’d do in a real incident response situation? If you want to try your hand at investigating/solving some incident scenarios before one happens on YOUR network, check out the innovative Hacker’s Challenge: Test Your Incident Response Skills Using 20 Scenarios⁴⁵⁵, by Mike Schiffman, which features descriptions of events observed, some log and other investigative info and then challenges the reader via questions as to what’s going on and how they know.

Firewall Forensics

Both system administrators and home users wrestling with personal firewalls will find a wealth of information at...

http://www.robertgraham.com/pubs/firewall-seen.html#1.1

Covering both *nix and Windows systems.

Quick navigation to subsections and regular topics in this section

• 5.6.1  Chain of Custody
• 5.6.2  Preservation of Evidence
• 5.6.3  Collection of evidence