Computer Evidence

Book excerpt: This volume shows law enforcement, system administrators, information technology security professionals, legal professionals, and computer forensics students how to identify, collect, and maintain digital artifacts to preserve their reliability as evidence. It focuses on the first two phases of computer forensics--collection and preservation--and uses evidence dynamics as its main approach. This edition has been updated to take into account changes in federal rules of evidence and case law, as well as changes in the industry and technology. The CD-ROM contains sample batch files, forms, and demo and freeware software applications discussed in the book. Brown (network security and computer forensics, U. of California at San Diego) retired from the US Navy in the area of information warfare and network security operations.