Digital Evidence and Computer Crime, 3rd Edition

Chapter 22

Applying Forensic Science to Networks

Eoghan Casey

Contents

Preparation and Authorization

Identification

Documentation, Collection, and Preservation

Filtering and Data Reduction

Class/Individual Characteristics and Evaluation of Source

Evidence Recovery

Investigative Reconstruction

Reporting Results

Like computers, networks contain digital evidence that can be used to establish that a crime has been committed, determine how a crime was committed, provide investigative leads, reveal links between an offender and victim, disprove or support witness statements, and identify likely suspects. For instance, several hours after the Columbia Space Shuttle crash in 2003, it became evident that a crime was being committed when pieces of the ...