In this book, Tony Sammes and Brian Jenkinson show how information held in computer systems can be recovered and how it may be deliberately hidden or subverted for criminal purposes. "Forensic Computing: A Practitioner's Guide" is illustrated by plenty of case studies and worked examples, and will help practitioners and students gain a clear understanding of: how to recover information from computer systems in such a way as to ensure that its integrity cannot be challenged and that it will be accepted as admissible evidence in court the principles involved in password protection and data encryption the evaluation procedures used in circumventing these safeguards the particular legal issues associated with computer-generated evidence and how to ensure admissibility of such evidence.

Inhalt

1 Forensic Computing.- 2 Understanding Information.- 3 IT Systems Concepts.- 4 PC Hardware and Inside the Box.- 5 Disk Geometry.- 6 The Treatment of PCs.- 7 The Treatment of Electronic Organizers.- 8 Looking Ahead (Just a Little Bit).- Appendices.- 1 Common Character Codes.- 2 Some Common File Format Signatures.- 3 A typical Set of POST Codes.- 4 Typical BIOS Beep Codes and Error Messages.- 5 Disk Partition Types.- 6 Extended Partitions.- 7 Registers and Order Code for the Intel 8086.- Answers to Exercises.