Årnes André - Cyber Investigations : A Research Based Textbook for Advanced Studies

1. Chapter 6

1. Chapter 2
2. Chapter 4
3. Chapter 5
4. Chapter 6
5. Chapter 7

Edited by

Andr rnes

Norwegian University of Science and Technology (NTNU)

This edition first published 2023
2023 John Wiley & Sons Ltd

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, except as permitted by law. Advice on how to obtain permission to reuse material from this title is available at http://www.wiley.com/go/permissions.

The right of Andr rnes to be identified as the author of this work has been asserted in accordance with law.

Registered Offices
John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, USA
John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex, PO19 8SQ, UK

Editorial Office
The Atrium, Southern Gate, Chichester, West Sussex, PO19 8SQ, UK

For details of our global editorial offices, customer services, and more information about Wiley products visit us at www.wiley.com.

Wiley also publishes its books in a variety of electronic formats and by printondemand. Some content that appears in standard print versions of this book may not be available in other formats.

Limit of Liability/Disclaimer of Warranty
In view of ongoing research, equipment modifications, changes in governmental regulations, and the constant flow of information relating to the use of experimental reagents, equipment, and devices, the reader is urged to review and evaluate the information provided in the package insert or instructions for each chemical, piece of equipment, reagent, or device for, among other things, any changes in the instructions or indication of usage and for added warnings and precautions. While the publisher and authors have used their best efforts in preparing this work, they make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives, written sales materials or promotional statements for this work. The fact that an organization, website, or product is referred to in this work as a citation and/or potential source of further information does not mean that the publisher and authors endorse the information or services the organization, website, or product may provide or recommendations it may make. This work is sold with the understanding that the publisher is not engaged in rendering professional services. The advice and strategies contained herein may not be suitable for your situation. You should consult with a specialist where appropriate. Further, readers should be aware that websites listed in this work may have changed or disappeared between when this work was written and when it is read. Neither the publisher nor authors shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.

Library of Congress CataloginginPublication Data applied for:
Paperback ISBN: 9781119582311

Cover Design: Wiley
Cover Images: Background Mike Pellinni/Shutterstock; Lefthand image Courtesy of Lasse verlier; Righthand image Courtesy of JensPetter Sandvik

Dear cyber investigation student. You are holding in your hand the Cyber Investigation textbook written by faculty, associates, and former students of cyber security and digital forensics at the Norwegian University of Science and Technology (NTNU). The book is a sequel to our previous textbook on Digital Forensics, and it represents our shared philosophy of learning cyber investigations. The book covers both technical, legal, and process aspects of cyber investigations, and it is intended for advanced and graduate students of cyber investigations, digital forensics, and cyber security. It is based on research, teaching material, experiences, and student feedback over several years.

The reason for embarking on this project is that there was no literature currently available within the area suitable as a standalone curriculum at an academic level, as most of the available literature is primarily intended for practitioners and technical readers. Consequently, literature tailored to academic education in cyber investigations is needed. As you can probably imagine, writing a textbook is a daunting task. While the authors have put much effort into making this version readable and easily available, we are keen to hear your feedback so that we can improve our teaching material over time.

I would like to thank the chapter authors for their dedicated and collaborative efforts to this project, as well as Professor Katrin Franke of the NTNU Digital Forensics Research Group. We are grateful for the support provided by the Norwegian Research Council through the ArsForensica project (project number 248094), the NTNU Center for Cyber and Information Security (CCIS), the Norwegian Police Directorate, Telenor Group, and the U.S. Embassy in Norway grant (grant number SNO60017IN0047) awarded by the U.S. State Department toward this work.

Good luck with learning Cyber Investigations!

Andr rnes
Norway, May 2022

The figures and tables from this book are available for Instructors at:

http://www.wiley.com/go/cyber

Andr rnes, PhD, Siv.ing. (MSc), BA Oslo, Norway Professor, Norwegian University of Science and Technology (NTNU) and Partner & Coowner White Label Consultancy, Oslo, Norway PhD and MSc in information security from NTNU, visiting researcher at UCSB, USA and Queens's University, Canada White Label Consultancy 2022: Partner and Coowner, with responsibility for cyber security Telenor 20102022: SVP and Chief Security Officer (from 2015 to 2022), CIO Global Shared Services (from 2013 to 2015) National Criminal Investigation Service (Kripos) 20032007: Special Investigator within computer crime and digital forensics GIAC Certified Forensic Analyst (GCFA), IEEE Senior Member, and member of the Europol Cyber Crime Centre (EC3) Advisory Group for communications providers.

Petter Christian Bjelland, MSc Oslo, Norway Digital Forensics and Cyber Investigations Expert, Oslo, Norway Manager Digital Forensics, EY Norway (20172018) Advisor Digital Investigations at the National Criminal Investigation Service Kripos (20152017)