PDF Implementing Digital Forensic Readiness From Reactive To Proactive Process 2Nd Edition Jason Sachowski Ebook Full Chapter

Implementing Digital Forensic
Readiness: From Reactive to Proactive

Process 2nd Edition Jason Sachowski
Visit to download the full and correct content document:
https://textbookfull.com/product/implementing-digital-forensic-readiness-from-reactive
-to-proactive-process-2nd-edition-jason-sachowski/
More products digital (pdf, epub, mobi) instant
download maybe you interests ...
Digital Forensics and Investigations: People, Process,

and Technologies to Defend the Enterprise 1st Edition
Jason Sachowski (Author)
https://textbookfull.com/product/digital-forensics-and-
investigations-people-process-and-technologies-to-defend-the-
enterprise-1st-edition-jason-sachowski-author/
Veterinary Forensic Pathology 2 1st Edition Jason W.

Brooks
https://textbookfull.com/product/veterinary-forensic-
pathology-2-1st-edition-jason-w-brooks/
Forensic Uses of Digital Imaging Second Edition Russ
https://textbookfull.com/product/forensic-uses-of-digital-
imaging-second-edition-russ/
NATO and the Western Balkans: From Neutral Spectator to

Proactive Peacemaker 1st Edition Niall Mulchinock
(Auth.)
https://textbookfull.com/product/nato-and-the-western-balkans-
from-neutral-spectator-to-proactive-peacemaker-1st-edition-niall-
mulchinock-auth/
Forensic Data Collections 2.0: A Selection of Trusted
Digital Forensics Content 2nd Edition Robert B. Fried
https://textbookfull.com/product/forensic-data-
collections-2-0-a-selection-of-trusted-digital-forensics-
content-2nd-edition-robert-b-fried/
Digital Forensic Art Techniques A Professionals Guide

to Corel Painter First Edition Natalie Murry
https://textbookfull.com/product/digital-forensic-art-techniques-
a-professionals-guide-to-corel-painter-first-edition-natalie-
murry/
Cybersecurity Readiness First Edition Dave Chatterjee
https://textbookfull.com/product/cybersecurity-readiness-first-
edition-dave-chatterjee/
The Law Enforcement and Forensic Examiner s

Introduction to Linux A Comprehensive Beginner s Guide
to Linux as a Digital Forensic Platform Barry J. Grundy
https://textbookfull.com/product/the-law-enforcement-and-
forensic-examiner-s-introduction-to-linux-a-comprehensive-
beginner-s-guide-to-linux-as-a-digital-forensic-platform-barry-j-
grundy/
Feedstock Technology for Reactive Metal Injection

Molding: Process, Design, and Application 1st Edition
Peng Cao
https://textbookfull.com/product/feedstock-technology-for-
reactive-metal-injection-molding-process-design-and-
application-1st-edition-peng-cao/
Implementing Digital
Forensic Readiness
Implementing Digital
Forensic Readiness
From Reactive to Proactive Process
Second Edition
Jason Sachowski
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2019 by Taylor & Francis Group, LLC

CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed on acid-free paper
International Standard Book Number-13: 978-1-1383-3895-1 (Hardback)
This book contains information obtained from authentic and highly regarded sources. Reasonable efforts
have been made to publish reliable data and information, but the author and publisher cannot assume
responsibility for the validity of all materials or the consequences of their use. The authors and publishers
have attempted to trace the copyright holders of all material reproduced in this publication and apologize
to copyright holders if permission to publish in this form has not been obtained. If any copyright material
has not been acknowledged please write and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, trans-
mitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter
invented, including photocopying, microfilming, and recording, or in any information storage or retrieval
system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copyright.com
(http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Dan-
vers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and registration for a
variety of users. For organizations that have been granted a photocopy license by the CCC, a separate system of
payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are
used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at

http://www.crcpress.com
Contents
Preface xvii
Acknowledgments xviii
Introduction xix
Author xxi
Section I
ENABLING DIGITAL FORENSICS
1 Understanding Digital Forensics 2

Introduction 2
The Role of Technology in Crime 2
History of Digital Crime and Forensics 4
Prologue (1960s–1980s) 4
Infancy (1980–1995) 5
Childhood (1995–2005) 6
Adolescence (2005–2015) 7
The Future (2015 and Beyond) 8
Evolutionary Cycle of Digital Forensics 9
“Ad Hoc” Phase 9
“Structured” Phase 10
“Enterprise” Phase 11
Principles of Digital Forensics 11
Evidence Exchange 11
Forensics Soundness 12
Authenticity and Integrity 13
Chain of Custody 14
Types of Forensics Investigations 15
Legal Aspects 16
Jurisdiction 16
Digital Forensics Resources 17
Summary 17
v
vi Contents
2 Investigative Process Methodology 18

Introduction 18
Existing Process Models 18
Digital Forensics Readiness Model 22
Summary 23
3 Digital Evidence Management 24

Introduction 24
Types of Digital Evidence 24
Common Sources of Digital Evidence 26
Log Files 27
Computer Systems 28
Infrastructure Devices 29
Virtual Systems 29
Cloud Computing 30
Mobile Devices 31
External Sources 31
Federal Rules of Evidence 32
Investigative Process Methodology 34
Preparation 35
Information Security Management 35
Lab Environment 39
Hardware and Software 43
Gathering 45
Operating Procedures 45
Processing 50
Presentation 50
Evidence Storage Networks 51
Summary 52
4 Ethics and Conduct 53

Introduction 53
Importance of Ethics 53
Principles of Ethics 53
Personal Ethics 54
Professional Ethics 54
Computer Ethics 54
Business Ethics 55
Ethics in Digital Forensics 56
Certifications and Professional Organizations 56
Digital Forensics Certification Board (DFCB) 57
Contents vii
International Association of Computer Investigative

Specialists (IACIS) 58
International Society of Forensics Computer Examiners
(ISFCE) 58
Principles for Digital Forensics 59
Impartiality and Objectivity 60
Openness and Disclosure 60
Confidentiality and Trust 60
Due Diligence and Duty of Care 60
Certifications and Accreditations 61
Summary 61
5 Digital Forensics as a Business 62

Introduction 62
The Role of Digital Forensics in an Enterprise 62
Starting a Digital Forensics Program 63
Step #1: Understand Business Risks 63
Step #2: Outline Business Scenarios 64
Step #3: Establish Governance Framework 66
Step #4: Enable Technical Execution 69
Step #5: Define Service Offerings 70
Maintaining a Digital Forensics Program 70
Educational Roadmap 71
Forensics Toolkit Maintenance 71
Key Performance Indicators (KPI) 72
Resource Capacity 73
Challenges and Strategies 75
Team Placement 75
Industry Regulation 76
Political Influences 77
Summary 77
Section II
ENHANCING DIGITAL FORENSICS
6 Understanding Digital Forensic Readiness 80

Introduction 80
What Is Digital Forensics Readiness? 80
Costs and Benefits of Digital Forensics Readiness 82
Cost Assessment 82
viii Contents
Benefits Analysis 83
Implementing Forensics Readiness 85
Summary 86
7 Defining Business Risk Scenarios 87

Introduction 87
What Is Business Risk? 87
Forensics Readiness Scenarios 88
Scenario #1: Reduce the Impact of Cybercrime 89
Scenario #2: Validate the Impact of Cybercrime or Disputes 90
Mitigating Control Logs 90
Overhead Time and Effort 91
Indirect Business Loss 91
Recovery and Continuity Expenses 92
Scenario #3: Produce Evidence to Support Organizational
Disciplinary Issues 92
Scenario #4: Demonstrating Compliance with Regulatory
or Legal Requirements 93
Scenario #5: Effectively Manage the Release of Court-
Ordered Data 94
Scenario #6: Support Contractual and Commercial
Agreements 94
Scenario Assessment 95
Summary 95
8 Identify Potential Data Sources 96

Introduction 96
What Is a Data Source? 96
Background Evidence 97
Foreground Evidence 97
Cataloguing Data Sources 98
Phase #1: Prepare an Action Plan 98
Phase #2: Identify Data Sources 99
Phase #3: Document Deficiencies 101
Insufficient Data Availability 101
Unidentified Data Sources 104
External Data Considerations 104
Data Exposure Concerns 105
Forensic Architectures 105
Systems Lifecycle 106
Waterfall and Agile Models 106
Summary 108
Contents ix
9 Determine Collection Requirements 109

Introduction 109
Pre-collection Questions 109
Evidence Collection Factors 112
Best Evidence Rule 112
Time 112
Metadata 113
Cause and Effect 114
Correlation and Association 115
Corroboration and Redundancy 117
Storage Duration 117
Storage Infrastructure 118
Data Security Requirements 119
Summary 120
10 Establishing Legal Admissibility 121

Introduction 121
Legal Admissibility 121
Preservation Challenges 123
Preservation Strategies 124
Administrative Controls 124
Policies 124
Guidelines 124
Standards 124
Procedures 125
Technical Controls 125
Storage Security 125
Integrity Monitoring 126
Cryptographic Algorithms 126
Remote Logging 127
Secure Delivery 128
Physical Controls 128
Deter 128
Detect 129
Deny 129
Delay 130
Summary 130
11 Establish Secure Storage and Handling 131

Introduction 131
Secure Storage Attributes 131
x Contents
Least Privilege Access 132

End-to-End Cryptography 132
Integrity Checking 133
Physical Security 134
Administrative Governance Foundations 135
Personnel 136
Evidence Storage 137
Evidence Handling 137
Incident and Investigative Response 137
Assurance Controls 138
Backup and Restoration Strategies 138
Near Real-Time Data Replication 139
Data Replication 139
Data Restoration from On-line Backup Media 139
Data Restoration from Off-line Backup Media 140
Summary 140
12 Enabling Targeted Monitoring 141

Introduction 141
What Is (un)acceptable Activity? 141
Digital Forensics in Enterprise Security 142
Information Security vs. Cyber Security 144
Defense-in-Depth 145
Traditional Security Monitoring 145
Modern Security Monitoring 146
Positive Security 148
Australian Signal Directorate (ASD) 149
Analytical Techniques 150
Misuse Detection 150
Anomaly Detection 151
Specification-Based Detection 152
Machine Learning 152
Extractive Forensics 153
Inductive Forensics 154
Deductive Forensics 154
Implementation Concerns 156
Summary 156
13 Mapping Investigative Workflows 157

Introduction 157
Incident Management Lifecycle 157
Integrating the Digital Forensic Readiness Model 158
Contents xi
Incident Handling and Response 159

Phase #1: Preparation 159
“Event” versus “Incident” 160
Policies, Plans, and Procedures 160
Team Structure and Models 161
Communication and Escalation 163
Escalation Management 164
Phase #2: Respond 166
Detection 166
Analysis 166
Prioritization 168
Phase #3: Restore 169
Containment 169
Eradication and Recovery 170
Phase #4: Learn 171
The Incident Response Team (IRT) 172
The Role of Digital Forensics During an Incident 174
Practitioner 174
Advisor 174
Investigation Workflow 175
Types of Security Investigations 175
Summary 176
14 Establish Continuing Education 177

Introduction 177
Types of Education and Training 177
Awareness 178
Basic Knowledge 179
Functional Knowledge 180
Professional Certification 180
Specialized Knowledge 180
Organizational Roles and Responsibilities 182
The Digital Forensics Team 183
Roles 183
Titles 184
An Educational Roadmap 185
Technical Knowledge 186
Introductory 186
Intermediate 187
Advanced 188
Non-Technical Knowledge 189
Introductory 189
xii Contents
Intermediate 190
Advanced 191
Digital Forensics Experts 192
Summary 194
15 Maintaining Evidence-Based Reporting 195

Introduction 195
Importance of Factual Reports 195
Types of Reports 196
Creating Understandable Reports 197
Arranging Written Reports 198
Inculpatory and Exculpatory Evidence 199
Summary 200
16 Ensuring Legal Review 201

Introduction 201
The Role of Technology in Crime 201
Laws and Regulations 203
Information Technology (IT) Law 203
Cyberlaw or Internet Law 204
Computer Law 205
Legal Precedence 207
Brady Rule: Inculpatory and Exculpatory Evidence 207
Frye versus Daubert Standard: General Acceptance Testing 208
Jurisdiction 209
Technology Counselling 209
Obtaining Legal Advice 210
Constraints 210
Disputes 210
Employees 211
Liabilities 211
Prosecution 211
Communication 211
Involving Law Enforcement 212
Summary 212
17 Accomplishing Digital Forensic Readiness 213

Introduction 213
Maintain a Business-Centric Focus 213
Don’t Reinvent the Wheel 214
Understand Costs and Benefits 214
Summary 215
Contents xiii
Section III
INTEGRATING DIGITAL FORENSICS
18 Forensics Readiness in Cloud Environments 218
Introduction 218
Brief History of Cloud Computing 218
What Is Cloud Computing? 219
Characteristics 220
Service Models 221
Delivery Models 221
Isolation Models 222
Challenges with Cloud Environments 223
Mobility 223
Hyper-Scaling 223
Containerization 224
First Responders 224
Evidence Gathering and Processing 224
Forensics Readiness Methodology 225
Step #1: Define Business Risk Scenarios 225
Step #2: Identify Potential Data Sources 226
Step #3: Determine Collection Requirements 227
Enterprise Management Strategies 228
Cloud Computing Governance 228
Security and Configuration Standards 229
Reference Architectures 229
Step #4: Establish Legal Admissibility 232
Layers of Trust 232
Step #5: Establish Secure Storage and Handling 234
Step #6: Enable Targeted Monitoring 235
Step #7: Map Investigative Workflows 236
Phase #2: Gathering 237
Phase #3: Processing 238
Phase #4: Presentation 238
Step #8: Establish Continuing Education 238
General Awareness 239
Basic Training 239
Formal Education 239
Step #9: Maintain Evidence-Based Presentations 240
Step #10: Ensure Legal Review 240
Contractual Agreements 241
Summary 242
xiv Contents
19 Forensics Readiness with Mobile Devices 243

Introduction 243
Brief History of Mobile Devices 243
Challenges with Mobile Devices 245
Loss 245
Theft 245
Replacement 246
Local Storage 246
Cloud Storage 246
Encryption 246
“Burner” Phones 247
Enterprise Management Strategies 251
Basic Training 265
Step #9: Maintain Evidence-Based Presentation 266
Summary 267
20 Forensics Readiness and the Internet of Things 268

Introduction 268
Brief History of the Internet of Things (IoT) 268
What Is the Internet of Things (IoT)? 269
Challenges with the Internet of Things (IoT) 270
Form Factor 271
Security 271
Privacy 271
Contents xv
Evidence Gathering and Processing 271

Forensics Toolkits 272
Zones of Trust 275
Basic Training 285
Step #9: Maintain Evidence-Based Presentation 285
Discrimination 286
Privacy 287
Security 287
Consent 287
Summary 287
Section IV
ADDENDUMS
Addendum A: Tool and Equipment Validation Program 290

Addendum B: Service Catalog 297
Addendum C: Cost-Benefit Analysis 301
Addendum D: Building a Taxonomy 313
Addendum E: Risk Assessment 320
Addendum F: Threat Modeling 336
Addendum G: Data Warehousing Introduction 344
Addendum H: Requirements Analysis 355
xvi Contents
Section V
APPENDIXES
Appendix A: Investigative Process Models 362

Appendix B: Education and Professional Certifications 383
Appendix C: Investigative Workflow 394
Section VI
TEMPLATES
Template 1: Test Case 400

Template 2: Logbook 404
Template 3: Chain of Custody 405
Template 4: Investigative Final Report 408
Template 5: Service Catalog 411
Template 6: Business Case 412
Template 7: Net Present Value (NPV) 420
Template 8: Threat Risk Assessment 421
Template 9: Data Source Inventory Matrix 426
Template 10: Project Charter 427
Template 11: Requirement Analysis Report 437
Bibliography 444
Resources 456
Glossary 461
Index 469
Preface
The art of war teaches us to rely not on the likelihood of the enemy’s not coming,
but on our own readiness to receive him; not on the chance of his not attack-
ing, but rather on the fact that we have made our position unassailable.
—Sun Tzu
The Art of War
xvii
Acknowledgments
I would like to most of all thank my wife and my children for showing me that
no matter what I do in my lifetime, they will always be my greatest success.
Thank you to my parents for providing me with countless opportuni-
ties to become who I am today and for encouraging me to keep pushing my
boundaries.
Thank you to my colleagues for allowing me the honor of working with
you and for the infinite wisdom and knowledge you have given me.
Lastly, thank you to Blair for opening doors.
xviii
Introduction
Digital forensics has been a discipline of information security for decades.

Since the digital forensics profession was formalized as a scientific discipline,
the principles, methodologies, and techniques have remained consistent
despite the evolution of technology and can ultimately be applied to any form
of digital data. Within a corporate environment, digital forensics practitio-
ners are often relied upon to maintain the legal admissibility and forensic
viability of digital evidence in support of a broad range of different business
functions.
Why This Book

Regardless of how strong an organization’s defenses are, there will come a
time when the weakest link is exposed, leading to some type of incident or
event. When that time comes, organizations turn to the highly specialized
skills of digital forensics practitioners to parse through and extract evidence
from the complex volumes of data.
Unfortunately, there are times when an incident or event occurs and
organizations are unable to support the digital investigation process with
the electronic data needed to conduct analysis and arrive at conclusions.
Not only does this slow down the digital investigation process, it also places
additional overhead on people and systems to reactively identify where rele-
vant electronic data is and work to have it properly collected and preserved to
support the investigation. In comparison, the ability to collect and preserve
electronic data before something happens enhances the digital investigation
process by streamlining activities, reducing overhead, and enabling a proac-
tive approach to incidents or events.
Who Will Benefit from This Book

This book was written from a non-technical business perspective to provide
readers with realistic methodologies and strategies related to how the people,
process, and technology aspects of digital forensics are integrated through-
out an enterprise to support different business operations.
While this book does cover the fundamental principles, methodolo-
gies, and techniques of digital forensics, it largely focuses on outlining how
xix
xx Introduction
the people, process, and technology areas are used to defend the enterprise
through integrating digital forensics capabilities with key business functions.
The information contained in this book has been written to benefit peo-
ple who:
• Are employed, both directly or indirectly, in the digital forensics

profession and are working to implement digital forensics readiness
capabilities within their organization
• Are employed in the information security profession and are inter-
ested in implementing security controls that enable proactive digital
forensics capabilities
• Are academic scholars pursuing non-technical business knowledge
about requirements for enabling proactive digital forensics capabili-
ties throughout an enterprise environment
Who Will NOT Benefit from This Book

This book is not designed to provide readers with technical knowledge about
digital forensics, including the “hands-on” and “how-to” aspects of the
discipline; such as how to forensically acquire a hard drive.
How This Book Is Organized

This book is organized into six thematic sections:
Section 1: Enabling Digital Forensics outlines the fundamental princi-

ples, methodologies, and techniques applied unanimously through-
out the digital forensic discipline.
Section 2: Enhancing Digital Forensics analyses additional consid-
erations for enabling and enhancing digital forensic capabilities
throughout an enterprise environment.
Section 3: Integrating Digital Forensics addresses best practices for
integrating the people, process and technologies components of digi-
tal forensics across an enterprise environment.
Section 4: Addendums provides complimentary content that discusses
topics and subject areas not directly related to Digital Forensics.
Section 5: Appendixes provides supplementary content that expand
topics and subject areas discussed in throughout other sections of
this book.
Section 6: Templates supply structured templates and forms used in
support of the digital forensic and business functions/processes cov-
ered throughout.
Author
Jason Sachowski is a seasoned professional in the fields of information

security and digital forensics. He has an extensive history of working in a
fast-paced corporate environment where he has led digital forensics inves-
tigations, directed incident response activities, developed and maintained
processes and procedures, managed large information security budgets, and
governed the negotiation of third-party contracts.
In addition to his professional career, Jason is the author of the books
Implementing Digital Forensic Readiness: From Reactive to Proactive Process
and Digital Forensics and Investigations: People, Process, and Technologies to
Defend the Enterprise. He has also served as a contributing author and content
moderator for DarkReading, a subject matter expert for information security
and digital forensic professional exam development, and volunteering as an
advocate for cyberbullying prevention and cybersecurity awareness.
Jason holds several information security and digital forensics certifi-
cations, including Certified Information Systems Security Professional—
Information Systems Security Architecture Professional (CISSP-ISSAP),
Certified Secure Software Lifecycle Professional (CSSLP), Systems Security
Certified Practitioner (SSCP), and EnCase Certified Examiner (EnCE).
xxi
Enabling
Digital Forensics I
Understanding
Digital Forensics
1
Introduction
What is now commonly referred to as digital forensics is a profession

that was once made up of unstructured processes, custom home-grown
toolsets, and knowledge based on the collective work of hobbyists. Over the
past 50 years, the profession of digital forensics has evolved significantly
alongside technological advancements to become a mature discipline where a
common body of knowledge (CBK)—made up of proven scientific principles,
methodologies, and techniques—has brought about a globally adopted level
of standardization and formal structure.
While it is relatively well known that there are legal aspects involved with
digital forensics, most people are surprised to learn that the profession involves
a great deal of scientific principles, methodologies, and techniques. Not only
does digital forensics require a significant amount of specialized training and
skills to properly apply these scientific fundamentals, digital forensics is also
somewhat of an art form where analytical experience comes into play.
The Role of Technology in Crime
In relation to crime, technology can play multiple roles that in turn

produce many types of digital artifacts that can be used as digital evidence.
Depending on how much digital evidence is contained within any given
piece of technology, it may or may not be authorized for seizure and
subsequent collection of evidence as part of an investigation. In any case,
when technology plays a role in criminal activity, it is much easier to justify
its seizure so evidence can be processed.
Through the years, several authors have tried to develop a standard
classification scheme for the distinct roles technology can play in crime.
In the 1970s, Donn Parker was one of the first individuals to recognize the
potential seriousness of technology-relates crimes which led him to create
the following four categories which remain relevant today:
1. Object of Crime applies when technology is affected by the crime

(e.g., when a device is stolen or damaged).
2. Subject of Crime applies when technology is in the environment in
which the crime was committed (e.g., system infected by malware).
2
Understanding Digital Forensics 3
3. Tool of Crime applies when technology is used to conduct or plan

crime (e.g., illegally forged documents).
4. Symbol of Crime applies when technology is used to deceive or intimidate
(e.g., falsified investment profits).
Distinguishing when technology plays one role or another is important
on many levels. For example, knowing when technology is an object or
subject is important because, from the perspective of the practitioner, this
demonstrates intent of the perpetrator. Also, when technology is a tool, like
a gun or other weapon, this could lead to additional charges or increased
punishment. However, although technology as a symbol may seem irrelevant
because no actual system is involved in the crime, when categorized under
this role technology is represented as an idea, belief, or any entity that can
be useful in understanding motivations for committing the crime. As an
example, CEOs are a symbol of their organization and as such can become
either the victim or target of crime because of what they symbolize.
In 1994, the U.S. Department of Justice (USDOJ) developed their own
categorization scheme that made a clear distinction between hardware, being
physical components, and information, being data and programs that are
stored or transmitted. It is important to note that with a single crime there is
the potential to fall into one or more of these categories; for example, when a
system is used as the instrument of crime, it may also contain information as
evidence. The categories proposed by the USDOJ include:
• Hardware as Contraband or Fruits of Crime (i.e., any item that is

illegal to be possessed or was obtained illegally)
• Hardware as an Instrumentality (i.e., when technology played a role
in committing the crime; such as a gun or weapon)
• Hardware as Evidence (i.e., scanners with unique characteristics that
can be used and linked to the creation of digitized content)
• Information as Contraband or Fruits of Crime (i.e., computer
programs that can encrypt content to conceal evidence)
• Information as an Instrumentality (i.e., programs used to break into
other systems)
• Information as Evidence (i.e., digital artifacts revealing a user’s
activities on a system)
In 2002, the USDOJ updated their categorization scheme as part of

their publication titled Searching and Seizing Computers and Obtaining
Electronic Evidence in Criminal Investigations. The most notable
difference in the updated categorization was the realization that data and
program content, not the hardware, are usually the target of the crime;
but even when information is the target it may be necessary to collect the
hardware.
4 Understanding Digital Forensics
History of Digital Crime and Forensics
Information technology has been involved in criminal activities for more

than half of a century. Dating as far back as the 1960s, computer crimes
were first committed as either physical damage or as sabotage to computer
systems. But when technology first arrived, most people did not think that it
would one day become such an integral part of our everyday lives. If history
has taught us anything, it’s that as information technology advances there
will always be new and evolved digital crimes.
With the growing commercialization of technology and the expansion
of the Internet, computer crimes continue to take the next step in an ever-
evolving threat landscape. Moving forward from the 1970s and into the new
millennium, computer crimes expanded from just damage and sabotage
to digital crimes such as fraud, denial of service (DoS), SPAM, advanced
persistent threats (APT), and extortion.
Prologue (1960s–1980s)
From the 1960s to 1980s, computers were owned and operated by corporations,
universities, research centers, and government agencies. Computers were used
primarily as industrial systems largely supporting data processing functions and
were, for the most part, not connected to the outside world. Responsibility for
securing these computer systems was left to administrators who would perform
routine audits to ensure the efficiency and accuracy of the data processing
functions. These activities were essentially the first systematic approach to a
computer security discipline.
It was during this time that the computer first became a point of
interest to the information security, legal, and law enforcement communities.
Several government agencies started creating small ad hoc groups of
individuals who were then provided with basic training on computer systems.
These “investigators” would work with administrators to gather information
from the computer systems to be used as evidence in criminal matters.
In 1968, in Olympia, Washington, an IBM 1401 Data Processing System

was shot twice by a pistol-toting intruder.
Following closely behind in February 1969, the largest student riot in
Canada ignited when police were called in to stop a student occupation
of several floors of the Hall Building at Concordia University. When the
police arrived to control the protest, a fire broke out, resulting in
computer data and university property being destroyed. The damages
totaled $2 million, and 97 people were arrested.
Understanding Digital Forensics 5
Prior to the 1980s, computer crimes were largely dealt with under existing
laws. However, in response to an increasing number of computer crimes,
law enforcement agencies began establishing new laws to address computer
crimes. The first computer crime law, the Florida Computer Crimes Act, was
created in 1978 to address fraud, intrusion, and all unauthorized access to
computer systems. The evolution of crime into computer systems during this
time led to new terms such as computer forensics, forensics computer analysis,
and forensics computing.
Infancy (1980–1995)
With the arrival of the IBM personal computer (PC), there was a sudden
explosion of computer hobbyists around the world. These PCs had very few
applications and were not user friendly, which enticed hobbyists to write
program code and access the internals of both the hardware and operating
system (OS) to better understand how they worked. Amongst the hobbyists
were individuals from law enforcement, government agencies, and other
organizations who collectively shared their understanding of computer
systems and how technology could play a larger role as a source of evidence.
Much of the time and money spent by these individuals to learn about these
modern technologies was done of their own accord because their respective
agencies did not necessarily support their efforts.
Investigations performed by these pioneers were rudimentary from
today’s perspective. The Internet was not yet widely available for consumer use,
which limited the scope of most investigations to data recovery on standalone
computer systems. Cyber criminals mostly consisted of a mix of traditional
criminals who used technology to support their activities (e.g., phreaking)
and people who used their technical skills to illegally access other computers.
During this time, there were very few tools available, which left
investigators to either build their own or use available data protection and
recovery applications to perform analysis. Additionally, the only means of
preserving evidence was taking logical backups of data onto magnetic tape,
hoping that the original attributes were preserved, and restoring the data to
another disk, where analysis was performed using command-line utilities.
Throughout the 1990s, forensics tools began to emerge from both the hob-
byists (e.g., Dan J. Mare’s Maresware, Gord Hama’s RCMP Utilities) and larger
software vendors (e.g., Norton’s Utilities, Mace Utilities). These applications and
software suites were developed to solve specific forensics activities (e.g., imaging,
file recovery) and proved to be powerful tools for the computer forensics practice.
As technology became more widely available and reports of different
types of computer crimes were becoming more widely known, law
enforcement agencies around the world started responding by enacting laws
similar to that passed by Florida. In 1983, Canada was the first to respond by
6 Understanding Digital Forensics
amending their criminal code to address computer crimes. Following their

lead, several other nations began implementing legislation in response to
computer crimes, including the 1984 U.S. Federal Computer Fraud and Abuse
Act, the 1989 amendment of the Australian Crimes Act to include Offenses
Relating to Computers, and the 1990 British Computer Abuse Act.
Parallel to the establishment of computer laws, interest in the forensics
community was growing, as was its popularity. Agencies recognized that
many forensics investigations were performed by individuals who had
minimal training, operated on their own terms, used their own equipment,
and did not follow any formal quality control. From this, efforts began to
create a CBK of principles, methodologies, and techniques that could be
applied to standardize and bring formal structure to computer forensics.
Childhood (1995–2005)
The next decade proved to be a major step forward in the maturity of digital
forensics. Technology quickly became pervasive amongst consumers, where
it was embedded in many facets of our daily lives, which drove significant
technology innovation (e.g., mobile devices). Plus, the Internet had gained
enough momentum for it to become more readily available for use in homes
and businesses, introducing personal accessibility to email and web browsing.
Accompanied by these advances in technology was the opportunity for
criminals to commit new cybercrimes. An example of this opportunity
being made available through technology occurred following the events on
September 11, 2001, when investigators realized that digital evidence of the
attack was recoverable on computers located across the world. This revelation
reinforced the fact that criminals were using technology in the same
ubiquitous ways as the everyday consumer.
From the technology-sponsored growth of digital crime, the term computer
forensics became increasing challenging to use because both crimes and evidence
could now be found throughout networks, printers, and other devices. In 2001,
the first annual Digital Forensics Research Workshop (DFRWS) recognized
that computer forensics was considered a specialization and proposed the use of
the term digital forensics to describe the discipline as a whole.
Expansion of the field into the all-encompassing digital forensics resulted
in the creation of specializations for investigating different technologies.
In addition to the traditional computer forensics becoming a concentration,
there was the introduction of network forensics and mobile forensics.
However, with the formation of these specializations came increased
technical sophistication and legal scrutiny over requirements to follow
standardized principles, methodologies, and techniques.
The formalization of digital forensics led to the first publication of
standardized principles being issued between 1999 and 2000 from the
Another random document with
no related content on Scribd:
TO STEW A SHOULDER OF VENISON.
Bone the joint, by the directions given for a shoulder of veal or

mutton (see Chapter XI.); flatten it on a table, season it well with
cayenne, salt, and pounded mace, mixed with a very small
proportion of allspice; lay over it thin slices of the fat of a loin of well-
fed mutton, roll and bind it tightly, lay it into a vessel nearly of its size,
and pour to it as much good stock made with equal parts of beef and
mutton as will nearly cover it; stew it as slowly as possible from three
hours to three and a half or longer, should it be very large, and turn it
when it is half done. Dish and serve it with a good Espagnole, made
with part of the gravy in which it has been stewed; or thicken this
slightly with rice-flour, mixed with a glass or more of claret or of port
wine, and as much salt and cayenne as will season the gravy
properly. Some cooks soak the slices of mutton-fat in wine before
they are laid upon the joint; but no process of the sort will ever give
to any kind of meat the true flavour of the venison, which to most
eaters is far finer than that of the wine, and should always be
allowed to prevail over all the condiments with which it is dressed.
Those, however, who care for it less than for a dish of high artificial
savour can have eschalots, ham, and carrot, lightly browned in good
butter added to the stew when it first begins to boil.
3-1/2 to 4 hours.
TO HASH VENISON.[92]
92. Minced collops of venison may be prepared exactly like those of beef; and
venison-cutlets like those of mutton: the neck may be taken for both of these.
For a superior hash of venison, add to three quarters of a pint of

strong thickened brown gravy, Christopher North’s sauce, in the
proportion directed for it in the receipt of page 295.[93] Cut the
venison in small thin slices of equal size, arrange them in a clean
saucepan, pour the gravy on them, let them stand for ten minutes or
more, then place them near the fire, and bring the whole very slowly
to the point of boiling only: serve the hash immediately in a hot-water
dish.
93. Having been inadvertently omitted from its proper place, this receipt is
transferred to the end of the present Chapter.
For a plain dinner, when no gravy is at hand, break down the

bones of the venison small, after the flesh has been cleared from
them, and boil them with those of three or four undressed mutton-
cutlets, a slice or two of carrot, or a few savoury herbs, and about a
pint and a half of water or broth, until the liquid is reduced quite one
third. Strain it off, let it cool, skim off all the fat, heat the gravy,
thicken it when it boils with a dessertspoonful or rather more of
arrow-root, or with the brown roux of page 107, mix the same sauce
with it, and finish it exactly as the richer hash above. It may be
served on sippets of fried bread or not, at choice.
TO ROAST A HARE.
[In season from September to the 1st of March.]

After the hare has been
skinned, or cased, as it is called,
wash it very thoroughly in cold
water, and afterwards in warm. If
in any degree overkept, or
musty in the inside, which it will
sometimes be when emptied
before it is hung up and
neglected afterwards, use
Hare trussed.
vinegar, or the pyroligneous
acid, well diluted, to render it
sweet; then again throw it into abundance of water, that it may retain
no taste of the acid. Pierce with the point of a knife any parts in
which the blood appears to have settled, and soak them in tepid
water, that it may be well drawn out. Wipe the hare dry, fill it with the
forcemeat No. 1, Chapter VIII., sew it up, truss and spit it firmly,
baste it for ten minutes with lukewarm water mixed with a very little
salt; throw this away, and put into the pan a quart or more of new
milk; keep it constantly laded over the hare until it is nearly dried up,
then add a large lump of butter, flour the hare, and continue the
basting steadily until it is well browned; for unless this be done, and
the roast be kept at a proper distance from the fire, the outside will
become so dry and hard as to be quite uneatable. Serve the hare
when done, with good brown gravy (of which a little should be
poured round it in the dish), and with fine red currant jelly. This is an
approved English method of dressing it, but we would recommend in
preference, that it should be basted plentifully with butter from the
beginning (the strict economist may substitute clarified beef-dripping,
or marrow, and finish with a small quantity of butter only); and that
the salt and water should be altogether omitted. First-rate cooks
merely wipe the hare inside and out, and rub it with its own blood
before it is laid to the fire; but there is generally a rankness about it,
especially after it has been many days killed, which, we should say,
renders the washing indispensable, unless a coarse game-flavour be
liked.
1-1/4 to 1-3/4 hour.
ROAST HARE.
(Superior Receipt.)
A hare may be rendered far more plump in appearance, and
infinitely easier to carve, by taking out the bones of the back and
thighs, or of the former only: in removing this a very sharp knife
should be used, and much care will be required to avoid cutting
through the skin just over the spine, as it adheres closely to the
bone. Nearly double the usual quantity of forcemeat must be
prepared: with this restore the legs to their original shape, and fill the
body, which should previously be lined with delicate slices of the
nicest bacon, of which the rind and edges have been trimmed away.
Sew up the hare, truss it as usual; lard it or not, as is most
convenient, keep it basted plentifully with butter while roasting, and
serve it with the customary sauce. We have found two
tablespoonsful of the finest currant jelly, melted in half a pint of rich
brown gravy, an acceptable accompaniment to hare, when the taste
has been in favour of a sweet sauce.
To remove the back-bone, clear from it first the flesh in the inside;
lay this back to the right and left from the centre of the bone to the
tips; then work the knife on the upper side quite to the spine, and
when the whole is detached except the skin which adheres to this,
separate the bone at the first joint from the neck-bone or ribs (we
know not how more correctly to describe it), and pass the knife with
caution under the skin down the middle of the back. The directions
for boning the thighs of a fowl will answer equally for those of a hare,
and we therefore refer the reader to them.
STEWED HARE.
Wash and soak the hare thoroughly, wipe it very dry, cut it down
into joints dividing the largest, flour and brown it slightly in butter with
some bits of lean ham, pour to them by degrees a pint and a half of
gravy, and stew the hare very gently from an hour and a half to two
hours: when it is about one third done add the very thin rind of half a
large lemon, and ten minutes before it is served stir to it a large
dessertspoonful of rice-flour, smoothly mixed with two tablespoonsful
of good mushroom catsup, a quarter of a teaspoonful or more of
mace, and something less of cayenne. This is an excellent plain
receipt for stewing a hare; but the dish may be enriched with
forcemeat (No. 1, Chapter VIII.) rolled into small balls, and simmered
for ten minutes in the stew, or fried and added to it after it is dished;
a higher seasoning of spice, a couple of glasses of port wine, with a
little additional thickening and a tablespoonful of lemon-juice, will all
serve to give it a heightened relish.
Hare, 1; lean of ham or bacon, 4 to 6 oz.; butter, 2 oz.; gravy, 1-1/2
pint; lemon-rind: 1 hour and 20 to 50 minutes. Rice-flour, 1 large
dessertspoonful; mushroom catsup, 2 tablespoonsful; mace, 1/3 of
teaspoonful; little cayenne (salt, if needed): 10 minutes.
TO ROAST A RABBIT.
This, like a hare, is much improved by

having the back-bone taken out, and the
directions we have given will enable the
cook, with very little practice, to remove it
without difficulty. Line the inside, when this Rabbit for roasting.
is done, with thin slices of bacon, fill it with
forcemeat (No. 1, Chapter VIII), sew it up,
truss, and roast it at a clear, brisk fire, and baste it constantly with
butter. Flour it well soon after it is laid down. Serve it with good
brown gravy, and with currant jelly, when this last is liked. For
change, the back of the rabbit may be larded, and the bone left in, or
not, at pleasure; or it can be plain roasted when more convenient.
3/4 to 1 hour; less, if small.
TO BOIL RABBITS.
Rabbits that are three parts grown, or, at

all events, which are still quite young,
should be chosen for this mode of cooking.
Wash them well, truss them firmly, with the
heads turned and skewered to the sides,
Rabbit for boiling. drop them into sufficient boiling water to
keep them quite covered until they are
cooked, and simmer them gently from thirty
to forty-five minutes: when very young they will require even less
time than this. Cover them with rich white sauce, mixed with the
livers parboiled, finely pounded, and well seasoned with cayenne
and lemon-juice; or with white onion sauce, or with parsley and
butter, made with milk or cream instead of water (the livers, minced,
are often added to the last of these), or with good mushroom sauce.
30 to 45 minutes.
FRIED RABBIT.
After the rabbit has been emptied, thoroughly washed and soaked,
should it require it to remove any mustiness of smell, blanch it, that is
to say, put it into boiling water and let it boil from five to seven
minutes; drain it, and when cold or nearly so, cut it into joints, dip
them into beaten egg, and then into fine bread-crumbs, seasoned
with salt and pepper, and when all are ready, fry them in butter over
a moderate fire, from twelve to fifteen minutes. Simmer two or three
strips of lemon-rind in a little gravy, until it is well flavoured with it;
boil the liver of the rabbit for five minutes, let it cool, and then mince
it; thicken the gravy with an ounce of butter and a small teaspoonful
of flour, add the liver, give the sauce a minute’s boil, stir in two
tablespoonsful of cream if at hand, and last of all, a small quantity of
lemon-juice. Dish the rabbit, pour the sauce under it, and serve it
quickly. If preferred, a gravy can be made in the pan as for veal
cutlets, and the rabbit may be simply fried.
TO ROAST A PHEASANT.
[In season from the beginning of October to the end of January.

The licensed term of pheasant shooting commences on the 1st of
October, and terminates on the 2nd of February, but as the birds will
remain perfectly good in cold weather for two or three weeks, if from
that time hung in a well-ventilated larder, they continue, correctly
speaking, in season so long as they can be preserved fit for table
after the regular market for them is closed: the same rule applies
equally to other varieties of game.]
Unless kept to the proper point, a
pheasant is one of the most tough, dry, and
flavourless birds that is sent to table; but
when it has hung as many days as it can
without becoming really tainted, and is well
roasted and served, it is most excellent
eating. Pluck off the feathers carefully, cut a
slit in the back of the neck to remove the
crop, then draw the bird in the usual way,
and either wipe the inside very clean with a
damp cloth, or pour water through it; wipe
the outside also, but with a dry cloth; cut off
the toes, turn the head of the bird under the
wing, with the bill laid straight along the Pheasant trussed
breast, skewer the legs, which must not be without the head.
crossed, flour the pheasant well, lay it to a
brisk fire, and baste it constantly and
plentifully with well flavoured butter. Send bread-sauce and good
brown gravy to table with it. The entire breast of the bird may be
larded by the directions of Chapter IX When a brace is served, one is
sometimes larded, and the other not; but a much handsomer
appearance is given to the dish by larding both. About three quarters
of an hour will roast them.
3/4 hour; a few minutes less, if liked very much underdone; five or
ten more for thorough roasting, with a good fire in both cases.
BOUDIN OF PHEASANT À LA RICHELIEU. (ENTRÉE.)
Take, quite clear from the bones, and from all skin and sinew, the
flesh of a half-roasted pheasant; mince, and then pound it to the
smoothest paste; add an equal bulk of the floury part of some fine
roasted potatoes, or of such as have been boiled by Captain Kater’s
receipt (see Chapter XVII.), and beat them together until they are
well blended; next throw into the mortar something less (in volume)
of fresh butter than there was of the pheasant-flesh, with a high
seasoning of mace, nutmeg, and cayenne, and a half-teaspoonful or
more of salt; pound the mixture afresh for ten minutes or a quarter of
an hour, keeping it turned from the sides of the mortar into the
middle; then add one by one, after merely taking out the germs with
the point of a fork, two whole eggs and a yolk or two without the
whites, if these last will not render the mixture too moist. Mould it into
the form of a roll, lay it into a stewpan rubbed with butter, pour boiling
water on it and poach it gently from ten to fifteen minutes. Lift it out
with care, drain it on a sieve, and when it is quite cold cover it
equally with beaten egg, and then with the finest bread-crumbs, and
broil it over a clear fire, or fry it in butter of a clear golden brown. A
good gravy should be made of the remains of the bird and sent to
table with it; the flavour may be heightened with ham and eschalots,
as directed in Chapter IV., page 96, and small mushrooms, sliced
sideways, and stewed quite tender in butter, may be mixed with the
boudin after it is taken from the mortar; or their flavour may be given
more delicately by adding to it only the butter in which they have
been simmered, well pressed, from them through a strainer. The
mixture, which should be set into a very cool place before it is
moulded, may be made into several small rolls, which will require
four or five minutes’ poaching only. The flesh of partridges will
answer quite as well as that of pheasants for this dish.
SALMI OF PHEASANT.
(See page 292.)
PHEASANT CUTLETS.
(See page 275.)
TO ROAST PARTRIDGES.
[In season from the first of September to the second of February,

and as long as they can be preserved fit for table from that time.]
Let the birds hang as long as they can
possibly be kept without becoming
offensive; pick them carefully, draw, and
singe them; wipe the insides thoroughly
with a clean cloth; truss them with the head
turned under the wing and the legs drawn
close together, not crossed. Flour them
when first laid to the fire, and baste them
plentifully with butter. Serve them with
bread sauce, and good brown gravy, a little
of this last should be poured over them. In
some counties they are dished upon fried
bread-crumbs, but these are better handed Partridge trussed.
round the table by themselves. Where
game is plentiful we recommend that the
remains of a cold roasted partridge should be well bruised and boiled
down with just so much water, or unflavoured broth, as will make
gravy for a brace of other birds: this, seasoned with salt, and
cayenne only, or flavoured with a few mushrooms, will be found a
very superior accompaniment for roast partridges, to the best meat-
gravy that can be made. A little eschalot, and a few herbs, can be
added to it at pleasure. It should be served also with boiled or with
broiled partridges in preference to any other.
30 to 40 minutes.
Obs.—Rather less time must be allowed when the birds are liked
underdressed. In preparing them for the spit, the crop must be
removed through a slit cut in the back of the neck, the claws clipped
close, and the legs held in boiling water for a minute, that they may
be skinned the more easily.
BOILED PARTRIDGES.
This is a delicate mode of dressing young and tender birds. Strip

off the feathers, clean, and wash them well; cut off the heads, truss
the legs like those of boiled fowls, and when ready, drop them into a
large pan of boiling water; throw a little salt on them, and in fifteen, or
at the utmost in eighteen minutes they will be ready to serve. Lift
them out, dish them quickly, and send them to table with white
mushroom sauce, with bread sauce and game gravy (see preceding
receipt), or with celery sauce. Our own mode of having them served
is usually with a slice of fresh butter, about a tablespoonful of lemon-
juice, and a good sprinkling of cayenne placed in a very hot dish,
under them.
15 to 18 minutes.
PARTRIDGES WITH MUSHROOMS.
For a brace of young well-kept birds, prepare from half to three

quarters of a pint of mushroom-buttons, or very small flaps, as for
pickling. Dissolve over a gentle fire an ounce and a half of butter,
throw in the mushrooms with a slight sprinkling of salt and cayenne,
simmer them from eight to ten minutes, and turn them with the butter
on to a plate; when they are quite cold, put the whole into the bodies
of the partridges, sew them up, truss them securely, and roast them
on a vertical jack with the heads downwards; or should an ordinary
spit be used, tie them firmly to it, instead of passing it through them.
Roast them the usual time, and serve them with brown mushroom
sauce, or with gravy and bread sauce only. The birds may be trussed
like boiled fowls, floured, and lightly browned in butter, half covered
with rich brown gravy and stewed slowly for thirty minutes; then
turned, and simmered for another half hour with the addition of some
mushrooms to the gravy; or they may be covered with small
mushrooms stewed apart, when they are sent to table. They can
also be served with their sauce only, simply thickened with a small
quantity of fresh butter, smoothly mixed with less than a teaspoonful
of arrow-root and flavoured with cayenne and a little catsup, wine, or
store sauce.
Partridges, 2; mushrooms, 1/2 to 3/4 pint; butter, 1-1/2 oz.; little
mace and cayenne: roasted 30 to 40 minutes, or stewed 1 hour.
Obs.—Nothing can be finer than the game flavour imbibed by the
mushrooms with which the birds are filled, in this receipt.
BROILED PARTRIDGE.
(Breakfast Dish.)
“Split a young and well-kept partridge, and wipe it with a soft clean
cloth inside and out, but do not wash it; broil it delicately over a very
clear fire, sprinkling it with a little salt and cayenne; rub a bit of fresh
butter over it the moment it is taken from the fire, and send it quickly
to table with a sauce made of a good slice of butter browned with
flour, a little water, cayenne, salt, and mushroom-catsup, poured
over it.” We give this receipt exactly as we received it from a house
where we know it to have been greatly approved by various guests
who have partaken of it there.
BROILED PARTRIDGE.
(French Receipt.)
After having prepared the bird with great nicety, divided, and
flattened it, season it with salt, and pepper, or cayenne, dip it into
clarified butter, and then into very fine bread-crumbs, and take care
that every part shall be equally covered: if wanted of particularly
good appearance dip it a second time into the butter and crumbs.
Place it over a very clear fire, and broil it gently from twenty to thirty
minutes. Send it to table with brown mushroom sauce, or some
Espagnole.
THE FRENCH, OR RED-LEGGED PARTRIDGE.
This is dressed precisely like our common partridge, and is

excellent eating if it be well kept; otherwise it is tough and devoid of
flavour. It does not, we believe, abound commonly in England, its
hostility to the gray partridge, which it drives always from its
neighbourhood, rendering it an undesirable occupant of a preserve.
It was at one time, however, plentiful in Suffolk,[94] and in one or two
of the adjoining counties, but great efforts, we have understood,
have been made to exterminate it.
94. Brought there by the late Marquis of Hertford, to his Sudbourne estate.
TO ROAST THE LANDRAIL OR CORN-CRAKE.
This delicate and excellent bird is in its full season at the end of
August and early in September, when it abounds often in the
poulterers’ shops. Its plumage resembles that of the partridge, but it
is of smaller size and of much more slender shape. Strip off the
feathers, draw and prepare the bird as usual for the spit, truss it like
a snipe, and roast it quickly at a brisk but not a fierce fire from fifteen
to eighteen minutes. Dish it on fried bread-crumbs, or omit these and
serve it with gravy round it, and more in a tureen, and with well made
bread sauce. Three or even four of the birds will be required for a
dish. One makes a nice dinner for an invalid.
TO ROAST BLACK COCK AND GRAY HEN.
In season during the same time as the common grouse, and found like them on
the moors, but less abundantly.
These birds, so delicious when well kept and well roasted, are
tough and comparatively flavourless when too soon dressed. They
should hang therefore till they give unequivocal indication of being
ready for the spit. Pick and draw them with exceeding care, as the
skin is easily broken; truss them like pheasants, lay them at a
moderate distance from a clear brisk fire, baste them plentifully and
constantly with butter, and serve them on a thick toast which has
been laid under them in the dripping-pan for the last ten minutes of
their roasting, and which will have imbibed a high degree of savour:
some cooks squeeze a little lemon-juice over it before it is put into
the pan. Send rich brown gravy and bread sauce to table with the
birds. From three quarters of an hour to a full hour will roast them.
Though kept to the point which we have recommended, they will not
offend even the most fastidious eater after they are dressed, as,
unless they have been too long allowed to hang, the action of the fire
will remove all perceptible traces of their previous state. In the earlier
part of the season, when warm and close packing have rendered
either black game or grouse, in their transit from the North,
apparently altogether unfit for table, the chloride of soda, well-
diluted, may be used with advantage to restore them to a fitting state
for it; though the copious washings which must then be resorted to,
may diminish something of their fine flavour.
3/4 to 1 hour.

PDF Implementing Digital Forensic Readiness From Reactive To Proactive Process 2Nd Edition Jason Sachowski Ebook Full Chapter

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

PDF Implementing Digital Forensic Readiness From Reactive To Proactive Process 2Nd Edition Jason Sachowski Ebook Full Chapter

Uploaded by

Copyright:

Available Formats

Implementing Digital Forensic

Readiness: From Reactive to Proactive

Digital Forensics and Investigations: People, Process,

Veterinary Forensic Pathology 2 1st Edition Jason W.

Forensic Uses of Digital Imaging Second Edition Russ

NATO and the Western Balkans: From Neutral Spectator to

Digital Forensic Art Techniques A Professionals Guide

Cybersecurity Readiness First Edition Dave Chatterjee

The Law Enforcement and Forensic Examiner s

Feedstock Technology for Reactive Metal Injection

© 2019 by Taylor & Francis Group, LLC

No claim to original U.S. Government works

Printed on acid-free paper

International Standard Book Number-13: 978-1-1383-3895-1 (Hardback)

and the CRC Press Web site at

1 Understanding Digital Forensics 2

2 Investigative Process Methodology 18

3 Digital Evidence Management 24

4 Ethics and Conduct 53

International Association of Computer Investigative

5 Digital Forensics as a Business 62

6 Understanding Digital Forensic Readiness 80

7 Defining Business Risk Scenarios 87

8 Identify Potential Data Sources 96

9 Determine Collection Requirements 109

10 Establishing Legal Admissibility 121

11 Establish Secure Storage and Handling 131

Least Privilege Access 132

12 Enabling Targeted Monitoring 141

13 Mapping Investigative Workflows 157

Incident Handling and Response 159

14 Establish Continuing Education 177

15 Maintaining Evidence-Based Reporting 195

16 Ensuring Legal Review 201

17 Accomplishing Digital Forensic Readiness 213

19 Forensics Readiness with Mobile Devices 243

20 Forensics Readiness and the Internet of Things 268

Evidence Gathering and Processing 271

Addendum A: Tool and Equipment Validation Program 290

Appendix A: Investigative Process Models 362

Template 1: Test Case 400

Digital forensics has been a discipline of information security for decades.

Why This Book

Who Will Benefit from This Book

• Are employed, both directly or indirectly, in the digital forensics

Who Will NOT Benefit from This Book

How This Book Is Organized

Section 1: Enabling Digital Forensics outlines the fundamental princi-

Jason Sachowski is a seasoned professional in the fields of information

What is now commonly referred to as digital forensics is a profession

The Role of Technology in Crime

In relation to crime, technology can play multiple roles that in turn

1. Object of Crime applies when technology is affected by the crime

3. Tool of Crime applies when technology is used to conduct or plan

• Hardware as Contraband or Fruits of Crime (i.e., any item that is

In 2002, the USDOJ updated their categorization scheme as part of

History of Digital Crime and Forensics

Information technology has been involved in criminal activities for more

In 1968, in Olympia, Washington, an IBM 1401 Data Processing System

amending their criminal code to address computer crimes. Following their

Bone the joint, by the directions given for a shoulder of veal or

For a superior hash of venison, add to three quarters of a pint of

For a plain dinner, when no gravy is at hand, break down the