Cybercrime Investigators Handbook

ISBN-13: 9781119596288 / Angielski / Twarda / 2019 / 320 str.

Graeme Edwards

Spis treści

List of Figures xiAbout the Author xiiiForeword xvAcknowledgments xviiChapter 1: Introduction 1Chapter 2: Cybercrime Offenses 9Potential Cybercrime Offenses 11Cybercrime Case Study 26Notes 26Chapter 3: Motivations of the Attacker 29Common Motivators 30Cybercrime Case Study I 33Cybercrime Case Study II 34Note 35Chapter 4: Determining That a Cybercrime is Being Committed 37Cyber Incident Alerts 38Attack Methodologies 41Cybercrime Case Study I 44Cybercrime Case Study II 44Notes 45Chapter 5: Commencing a Cybercrime Investigation 47Why Investigate a Cybercrime? 47The Cyber Investigator 48Management Support 48Is There a Responsibility to Try to Get the Data Back? 50Cybercrime Case Study 51Notes 52Chapter 6: Legal Considerations When Planning an Investigation 53Role of the Law in a Digital Crimes Investigation 54Protecting Digital Evidence 55Preservation of the Chain of Custody 56Protection of Evidence 59Legal Implications of Digital Evidence Collection 60Cybercrime Case Study 63Note 63Chapter 7: Initial Meeting with the Complainant 65Initial Discussion 65Complainant Details 68Event Details 68Cyber Security History 69Scene Details 70Identifying Offenses 71Identifying Witnesses 71Identifying Suspects 71Identifying the Modus Operandi of Attack 72Evidence: Technical 73Evidence: Other 74Cybercrime Case Study 74Chapter 8: Containing and Remediating the Cyber Security Incident 77Containing the Cyber Security Incident 77Eradicating the Cyber Security Incident 80Note 82Chapter 9: Challenges in Cyber Security Incident Investigations 83Unique Challenges 84Cybercrime Case Study 91Chapter 10: Investigating the Cybercrime Scene 93The Investigation Team 96Resources Required 101Availability and Management of Evidence 104Technical Items 105Scene Investigation 123What Could Possibly Go Wrong? 152Cybercrime Case Study I 155Cybercrime Case Study II 156Notes 158Chapter 11: Log File Identification, Preservation, Collection, and Acquisition 159Log Challenges 160Logs as Evidence 161Types of Logs 162Cybercrime Case Study 164Notes 165Chapter 12: Identifying, Seizing, and Preserving Evidence from Cloud-Computing Platforms 167What is Cloud Computing? 167What is the Relevance to the Investigator? 172The Attraction of Cloud Computing for the Cybercriminal 173Where is Your Digital Evidence Located? 174Lawful Seizure of Cloud Digital Evidence 175Preservation of Cloud Digital Evidence 177Forensic Investigations of Cloud-Computing Servers 178Remote Forensic Examinations 182Cloud Barriers to a Successful Investigation 196Suggested Tips to Assist Your Cloud-Based Investigation 203Cloud-Computing Investigation Framework 206Cybercrime Case Study 219Notes 221Chapter 13: Identifying, Seizing, and Preserving Evidence from Internet of Things Devices 225What is the Internet of Things? 225What is the Relevance to Your Investigation? 226Where is Your Internet of Things Digital Evidence Located? 228Lawful Seizure of Internet of Things Evidence 228Notes 229Chapter 14: Open Source Evidence 231The Value of Open Source Evidence 231Examples of Open Source Evidence 233Note 236Chapter 15: The Dark Web 237Crime and the Dark Web 238Notes 242Chapter 16: Interviewing Witnesses and Suspects 243Suspect Interviews 245Witness Interviews 246Preparing for an Interview 247The Interview Process 250Closing the Interview 254Review of the Interview 254Preparation of Brief for Referral to Police 255Chapter 17: Review of Evidence 257Chapter 18: Producing Evidence for Court 265Digital Evidence and Its Admissibility 267Preparing for Court 268Chapter 19: Conclusion 273Glossary 277Index 283

O autorze

DR. GRAEME EDWARDS, CFE, has been a cybercrime investigator with the Queensland Police Service Financial and Cyber Crime Group and has worked on numerous successful criminal investigations involving local and international jurisdictions. He facilitated the creation of the Victims of Financial Crimes Support Group to support those suffering losses associated with financial or cybercrime. Graeme is an experienced conference speaker and cybercrime investigation educator, provider of training in a corporate environment and conducts post investigation analysis. He has a Doctorate of Information Technology focusing on computer security, computer networking, and cloud computing investigation strategies.