Nihad A. Hassan - Digital Forensics Basics : A Practical Guide Using Windows OS

Chapter , Introduction: Understanding Digital Forensics: In this chapter, we introduce the term digital forensics and differentiate between it and other kinds of cybersecurity domains. We briefly cover the concept of digital evidence, its various types, and where we can find it in electronic devices. There is no formal process for applying digital forensics investigations across the globe; however, we introduce the general phases of any digital investigation process and what tasks are required as a part of each phase.

Chapter , Essential Technical Concepts: In this chapter, we cover important technical concepts about computers that must be well understood by any digital forensic examiner. We describe how computers store and represent data digitally, the concept of operating system file structure and its types, and hash algorithms and how we can use them to verify the authenticity of any piece of digital data. We also discuss types of computer storage and the file system types supported by Windows OS.

Chapter , Computer Forensics Lab Requirements: In this chapter, we cover the essential tools needed to assemble a digital forensic lab. We talk about the characteristics of the physical facility that are going to house the lab, needed electrical equipment, and lab furniture and hardware devices related to digital investigation work; we also cover the minimum technical requirements for the forensic workstation(s) we are going to use for analyzing digital evidence. We discuss the design and security requirements of the lab network, then we move to talk about forensic software and the importance of validating computer forensic tools by a credible body before using it officially in the investigation.

Chapter , Initial Response and First Responder Tasks: In this chapter, we talk about the mission and services provided by the first responder for any investigation that involves digital evidence. We cover the first responders toolkit, the first responders tasks upon arriving at the crime scene, and the practical aspects of identification, seizure, and transport of gathered evidence stored on electronic media to the forensic lab for detailed examination.

Chapter , Acquiring Digital Evidence: In this chapter, we cover the main task conducted during any digital forensics investigation, which is capturing computer memory images. We discuss how to capture volatile memory (live acquisition), such as RAM memory and other volatile data like network information, and nonvolatile memory (static acquisition), such as HDD, tape, SSD, flash thumb, and any similar digital storage medium. We also list possible challenges that a digital forensic examiner may face during the acquisition process.