Syngress Scene of the Cybercrime: Computer Forensics Handbook

1. Auflage 2002
ISBN: 978-0-08-048078-7
Verlag: Elsevier Science & Techn.
Format: PDF
Kopierschutz: 1 - PDF Watermark

E-Book, Englisch, 512 Seiten, Web PDF

Cybercrime and cyber-terrorism represent a serious challenge to society as a whole. - Hans Christian Kr?ger, Deputy Secretary General of the Council of Europe
Crime has been with us as long as laws have existed, and modern technology has given us a new type of criminal activity: cybercrime. Computer and network related crime is a problem that spans the globe, and unites those in two disparate fields: law enforcement and information technology.

This book will help both IT pros and law enforcement specialists understand both their own roles and those of the other, and show why that understanding and an organized, cooperative effort is necessary to win the fight against this new type of crime.

62% of US companies reported computer-related security breaches resulting in damages of $124 million dollars. This data is an indication of the massive need for Cybercrime training within the IT and law enforcement communities.
The only book that covers Cybercrime from forensic investigation through prosecution.
Cybercrime is one of the battlefields in the war against terror.

Autoren/Hrsg.

Syngress

Inhaltsverzeichnis

1;Cover;1
2;Contents;12
3;Foreword;26
4;Chapter 1 Facing the Cybercrime Problem Head On;33
4.1;Introduction;34
4.1.1;Quantifying the Crisis;35
4.2;Defining Cybercrime;36
4.2.1;Moving from the General to the Specific;37
4.2.2;Understanding the Importance of Jurisdictional Issues;38
4.2.3;Differentiating Crimes That Use the Net from Crimes That Depend on the Net;42
4.2.4;Collecting Statistical Data on Cybercrime;43
4.2.4.1;Understanding the Crime Reporting System;43
4.2.4.2;Categorizing Crimes for the National Reporting System;45
4.2.5;Toward a Working Definition of Cybercrime;47
4.2.5.1;U.S. Federal and State Statutes;47
4.2.5.2;International Law:The United Nations Definition of Cybercrime;49
4.3;Categorizing Cybercrime;50
4.3.1;Developing Categories of Cybercrimes;51
4.3.1.1;Violent or Potentially Violent Cybercrime Categories;51
4.3.1.2;Nonviolent Cybercrime Categories;55
4.3.2;Prioritizing Cybercrime Enforcement;65
4.4;Fighting Cybercrime;67
4.4.1;Determining Who Will Fight Cybercrime;67
4.4.2;Educating Cybercrime Fighters;69
4.4.2.1;Educating Legislators and Criminal Justice Professionals;70
4.4.2.2;Educating Information Technology Professionals;71
4.4.2.3;Educating and Engaging the Community ;73
4.4.3;Getting Creative in the Fight Against Cybercrime;73
4.4.3.1;Using Peer Pressure to Fight Cybercrime;74
4.4.3.2;Using Technology to Fight Cybercrime;75
4.4.3.3;Finding New Ways to Protect Against Cybercrime;76
4.5;Summary;77
4.6;Frequently Asked Questions;78
4.7;Resources ;79
5;Chapter 2 Reviewing the History of Cybercrime;81
5.1;Introduction;82
5.2;Exploring Criminality in the Days of Standalone Computers;83
5.2.1;Sharing More Than Time;84
5.2.2;The Evolution of a Word;84
5.3;Understanding Early Phreakers, Hackers, and Crackers;85
5.3.1;Hacking Ma Bell’s Phone Network;85
5.3.1.1;Phamous Phreakers;86
5.3.1.2;Phreaking on the Other Side of the Atlantic;86
5.3.1.3;A Box for Every Color Scheme;86
5.3.1.4;From Phreaker to Hacker;87
5.3.2;Living on the LAN: Early Computer Network Hackers;87
5.3.3;How BBSs Fostered Criminal Behavior;88
5.4;How Online Services Made Cybercrime Easy;89
5.5;Introducing the ARPANet:: the Wild West of Networking;90
5.5.1;Sputnik Inspires ARPA;91
5.5.2;ARPA Turns Its Talents to Computer Technology;91
5.5.3;Network Applications Come into Their Own;92
5.5.4;The Internetwork Continues to Expand;92
5.5.4.1;The ARPANet of the 1980s;92
5.5.4.2;The Internet of the 1990s;92
5.5.4.3;The Worm Turns—and Security Becomes a Concern;93
5.6;Watching Crime Rise with the Commercialization of the Internet;93
5.7;Bringing the Cybercrime Story Up to Date;94
5.7.1;Understanding How New Technologies Create New Vulnerabilities;94
5.7.1.1;Why Cybercriminals Love Broadband;95
5.7.1.2;Why Cybercriminals Love Wireless;99
5.7.1.3;Why Cybercriminals Love Mobile Computing;104
5.7.1.4; Why Cybercriminals Love Sophisticated Web and E-Mail Technologies ;107
5.7.1.5;Why Cybercriminals Love E-Commerce and Online Banking;112
5.7.1.6;Why Cybercriminals Love Instant Messaging;116
5.7.1.7;Why Cybercriminals Love New Operating Systems and Applications;119
5.7.1.8;Why Cybercriminals Love Standardization;119
5.7.2;Planning for the Future: How to Thwart Tomorrow’s Cybercriminal;120
5.8;Summary;121
5.9;Frequently Asked Questions;122
5.10;Resources ;123
6;Chapter 3 Understanding the People on the Scene;125
6.1;Introduction;126
6.2;Understanding Cybercriminals;128
6.2.1;Profiling Cybercriminals;130
6.2.1.1;Understanding How Profiling Works;131
6.2.1.2;Reexamining Myths and Misconceptions About Cybercriminals;134
6.2.1.3;Constructing a Profile of the Typical Cybercriminal;143
6.2.1.4;Recognizing Criminal Motivations;144
6.2.1.5;Recognizing the Limitations of Statistical Analysis;151
6.2.2;Categorizing Cybercriminals;151
6.2.2.1;Criminals Who Use the Net as a Tool of the Crime;152
6.2.2.2;Criminals Who Use the Net Incidentially to the Crime;159
6.2.2.3;Real-Life Noncriminals Who Commit Crimes Online;160
6.3;Understanding Cybervictims;161
6.3.1;Categorizing Victims of Cybercrime;162
6.3.1.1;Making the Victim Part of the Crime-Fighting Team;166
6.4;Understanding Cyberinvestigators;168
6.4.1;Recognizing the Characteristics of a Good Cyberinvestigator;168
6.4.1.1;Categorizing Cyberinvestigators by Skill Set;170
6.4.1.2;Recruiting and Training Cyberinvestigators;171
6.4.2;Facilitating Cooperation: CEOs on the Scene;172
6.5;Summary;174
6.6;Frequently Asked Questions;175
6.7;Resources ;177
7;Chapter 4 Understanding Computer Basics;179
7.1;Introduction;180
7.2;Understanding Computer Hardware;181
7.2.1;Looking Inside the Machine;182
7.2.1.1;Components of a Digital Computer;182
7.2.1.2;The Role of the Motherboard;183
7.2.1.3;The Roles of the Processor and Memory;185
7.2.1.4;The Role of Storage Media;189
7.2.1.5;Why This Matters to the Investigator;195
7.3;The Language of the Machine;196
7.3.1;Wandering Through a World of Numbers;197
7.3.1.1;Who’s on Which Base?;197
7.3.2;Understanding the Binary Numbering System;198
7.3.2.1;Converting Between Binary and Decimal;199
7.3.2.2;Converting Between Binary and Hexadecimal;199
7.3.2.3;Converting Text to Binary;200
7.3.3;Encoding Nontext Files;201
7.3.4;Why This Matters to the Investigator;201
7.4;Understanding Computer Operating Systems;203
7.4.1;Understanding the Role of the Operating System Software;204
7.4.2;Differentiating Between Multitasking and Multiprocessing Types;205
7.4.2.1;Multitasking;205
7.4.2.2;Multiprocessing;206
7.4.3;Differentiating Between Proprietary and Open Source Operating Systems;207
7.4.4;An Overview of Commonly Used Operating Systems;209
7.4.4.1;Understanding DOS;209
7.4.4.2;Windows 1.x Through 3.x;211
7.4.4.3;Windows 9x (95, 95b, 95c, 98, 98SE, and ME);213
7.4.4.4;Windows NT;215
7.4.4.5;Windows 2000;217
7.4.4.6;Windows XP;218
7.4.4.7;Linux/UNIX;220
7.4.4.8;Other Operating Systems;222
7.4.5;Understanding File Systems;225
7.4.5.1;FAT12;225
7.4.5.2;FAT16 ;226
7.4.6;VFAT;226
7.4.7;FAT32;226
7.4.8;NTFS;227
7.4.9;Other File Systems;228
7.5;Summary;229
7.6;Frequently Asked Questions;230
7.7;Resources ;231
8;Chapter 5 Understanding Networking Basics;233
8.1;Introduction;234
8.2;Understanding How Computers Communicate on a Network;235
8.2.1;Sending Bits and Bytes Across a Network;236
8.2.1.1;Digital and Analog Signaling Methods;237
8.2.1.2;How Multiplexing Works;239
8.2.1.3;Directional Factors;240
8.2.1.4;Timing Factors;241
8.2.1.5;Signal Interference;242
8.2.1.6;Packets, Segments, Datagrams, and Frames;243
8.2.1.7;Access Control Methods;244
8.2.1.8;Network Types and Topologies;245
8.2.1.9;Why This Matters to the Investigator;247
8.2.2;Understanding Networking Models and Standards;247
8.2.2.1;The OSI Networking Model;248
8.2.2.2;The DoD Networking Model;250
8.2.2.3;The Physical/Data Link Layer Standards;252
8.2.2.4;Why This Matters to the Investigator;252
8.2.3;Understanding Network Hardware;253
8.2.3.1;The Role of the NIC;253
8.2.3.2;The Role of the Network Media;253
8.2.3.3;The Roles of Network Connectivity Devices;255
8.2.3.4;Why This Matters to the Investigator;263
8.2.4;Understanding Network Software;263
8.2.4.1;Understanding Client/Server Computing;264
8.2.4.2;Server Software;267
8.2.4.3;Client Software;268
8.2.4.4;Network File Systems and File Sharing Protocols;269
8.2.4.5;A Matter of (Networking) Protocol;270
8.3;Understanding the TCP/IP Protocols Used on the Internet ;272
8.3.1;The Need for Standardized Protocols;272
8.3.2;A Brief History of TCP/IP;273
8.3.3;The Internet Protocol and IP Addressing;274
8.3.4;How Routing Works;281
8.3.5;The Transport Layer Protocols;286
8.3.6;The MAC Address;289
8.3.7;Name Resolution;289
8.3.8;TCP/IP Utilities;295
8.3.9;Network Monitoring Tools;301
8.3.10;Why This Matters to the Investigator;304
8.4;Summary;305
8.5;Frequently Asked Questions;306
8.6;Resources ;309
9;Chapter 6 Understanding Network Intrusions and Attacks;311
9.1;Introduction;312
9.2;Understanding Network Intrusions and Attacks;314
9.2.1;Intrusions vs. Attacks;315
9.2.2;Recognizing Direct vs. Distributed Attacks;316
9.2.3;Automated Attacks;318
9.2.4;Accidental “Attacks”;319
9.2.5;Preventing Intentional Internal Security Breaches;320
9.2.6;Preventing Unauthorized External Intrusions;321
9.2.6.1;Planning for Firewall Failures;322
9.2.6.2;External Intruders with Internal Access;322
9.2.7;Recognizing the “Fact of the Attack”;323
9.2.8;Identifying and Categorizing Attack Types;324
9.3;Recognizing Pre-intrusion/Attack Activities;324
9.3.1;Port Scans;326
9.3.2;Address Spoofing;329
9.3.2.1;IP Spoofing;330
9.3.2.2;ARP Spoofing;330
9.3.2.3;DNS Spoofing;331
9.3.3;Placement of Trojans;332
9.3.4;Placement of Tracking Devices and Software;332
9.3.5;Placement of Packet Capture and Protocol Analyzer Software;334
9.3.6;Prevention and Response;336
9.4;Understanding Password Cracking ;337
9.4.1;Brute Force;338
9.4.2;Exploitation of Stored Passwords;341
9.4.3;Interception of Passwords;343
9.4.4;Password Decryption Software;344
9.4.5;Social Engineering;345
9.4.6;Prevention and Response;346
9.4.6.1;General Password Protection Measures;346
9.4.6.2;Protecting the Network Against Social Engineers;347
9.5;Understanding Technical Exploits;347
9.5.1;Protocol Exploits;348
9.5.1.1;DoS Attacks That Exploit TCP/IP;348
9.5.1.2;Source Routing Attacks;355
9.5.1.3;Other Protocol Exploits;356
9.5.2;Application Exploits;356
9.5.2.1;Bug Exploits;356
9.5.2.2;Mail Bombs;357
9.5.2.3;Browser Exploits;357
9.5.2.4;Web Server Exploits;359
9.5.2.5;Buffer Overflows;360
9.5.3;Operating System Exploits;361
9.5.3.1;The WinNuke Out-of-Band Attack;361
9.5.3.2;Windows Registry Attacks;361
9.5.3.3;Other Windows Exploits;362
9.5.3.4;UNIX Exploits;363
9.5.3.5;Router Exploits;364
9.5.4;Prevention and Response;365
9.6;Attacking with Trojans,Viruses, and Worms;366
9.6.1;Trojans;368
9.6.2;Viruses;369
9.6.3;Worms;370
9.6.4;Prevention and Response;371
9.7;Hacking for Nontechies;372
9.7.1;The Script Kiddie Phenomenon;372
9.7.2;The “Point and Click” Hacker;373
9.7.3;Prevention and Response;374
9.8;Summary;375
9.9;Frequently Asked Questions;376
9.10;Resources ;378
10;Chapter 7 Understanding Cybercrime Prevention;381
10.1;Introduction;382
10.2;Understanding Network Security Concepts;383
10.2.1;Applying Security Planning Basics;384
10.2.1.1;Defining Security;384
10.2.1.2;The Importance of Multilayered Security;385
10.2.1.3;The Intrusion Triangle;385
10.2.1.4;Removing Intrusion Opportunities;386
10.2.2;Talking the Talk: Security Terminology;387
10.2.3;Importance of Physical Security;389
10.2.3.1;Protecting the Servers;391
10.2.3.2;Keeping Workstations Secure;391
10.2.3.3;Protecting Network Devices;392
10.3;Understanding Basic Cryptography Concepts;396
10.3.1;Understanding the Purposes of Cryptographic Security;396
10.3.1.1;Authenticating Identity;398
10.3.1.2;Providing Confidentiality of Data;404
10.3.1.3;Ensuring Data Integrity;404
10.3.2;Basic Cryptography Concepts;405
10.3.2.1;Scrambling Text with Codes and Ciphers;405
10.3.2.2;What Is Encryption?;408
10.3.2.3;Securing Data with Cryptographic Algorithms;410
10.3.2.4;How Encryption Is Used in Information Security;412
10.3.2.5;What Is Steganography?;416
10.3.2.6;Modern Decryption Methods;417
10.3.2.7;Cybercriminals’ Use of Encryption and Steganography;418
10.4;Making the Most of Hardware and Software Security;419
10.4.1;Implementing Hardware-Based Security;419
10.4.1.1;Hardware-Based Firewalls;419
10.4.1.2;Authentication Devices;420
10.4.2;Implementing Software-Based Security;423
10.4.2.1;Cryptographic Software;423
10.4.2.2;Digital Certificates;424
10.4.2.3;The Public Key Infrastructure;424
10.4.2.4;Software-Based Firewalls;425
10.5;Understanding Firewalls;426
10.5.1;How Firewalls Use Layered Filtering ;427
10.5.1.1;Packet Filtering;427
10.5.1.2;Circuit Filtering;428
10.5.1.3;Application Filtering;429
10.5.2;Integrated Intrusion Detection;430
10.6;Forming an Incident Response Team;430
10.7;Designing and Implementing Security Policies;433
10.7.1;Understanding Policy-Based Security;433
10.7.1.1;What Is a Security Policy?;434
10.7.1.2;Why This Matters to the Investigator;435
10.7.2;Evaluating Security Needs;436
10.7.2.1;Components of an Organizational Security Plan;436
10.7.2.2;Defining Areas of Responsibility;436
10.7.2.3;Analyzing Risk Factors;438
10.7.2.4;Assessing Threats and Threat Levels;439
10.7.2.5;Analyzing Organizational and Network Vulnerabilities;441
10.7.2.6;Analyzing Organizational Factors;444
10.7.2.7;Considering Legal Factors;445
10.7.2.8;Analyzing Cost Factors;445
10.7.2.9;Assessing Security Solutions;446
10.7.3;Complying with Security Standards;447
10.7.3.1;Government Security Ratings;447
10.7.3.2;Utilizing Model Policies;448
10.7.4;Defining Policy Areas;449
10.7.4.1;Password Policies;449
10.7.4.2;Other Common Policy Areas;452
10.7.5;Developing the Policy Document;453
10.7.5.1;Establishing Scope and Priorities;454
10.7.5.2;Policy Development Guidelines;454
10.7.5.3;Policy Document Organization;455
10.7.6;Educating Network Users on Security Issues;457
10.7.6.1;Policy Enforcement;457
10.7.6.2;Policy Dissemination;458
10.7.6.3;Ongoing Assessment and Policy Update;458
10.8;Summary;459
10.9;Frequently Asked Questions;460
10.10;Resources ;462
11;Chapter 8 Implementing System Security;463
11.1;Introduction;464
11.1.1;How Can Systems Be Secured?;465
11.1.2;The Security Mentality;465
11.1.3;Elements of System Security;467
11.2;Implementing Broadband Security Measures;468
11.2.1;Broadband Security Issues;471
11.2.2;Deploying Antivirus Software;473
11.2.3;Defining Strong User Passwords;476
11.2.4;Setting Access Permissions;476
11.2.5;Disabling File and Print Sharing;477
11.2.6;Using NAT;478
11.2.7;Deploying a Firewall;480
11.2.8;Disabling Unneeded Services;481
11.2.9;Configuring System Auditing;481
11.3;Implementing Browser and E-Mail Security;484
11.3.1;Types of Dangerous Code;486
11.3.1.1;JavaScript;486
11.3.1.2;ActiveX;487
11.3.1.3;Java;487
11.3.2;Making Browsers and E-Mail Clients More Secure;488
11.3.2.1;Restricting Programming Languages;488
11.3.2.2;Keep Security Patches Current;489
11.3.2.3;Cookie Awareness;489
11.3.3;Securing Web Browser Software;490
11.3.3.1;Securing Microsoft Internet Explorer;490
11.3.4;Securing Netscape Navigator;494
11.3.5;Securing Opera;496
11.4;Implementing Web Server Security;497
11.4.1;DMZ vs. Stronghold;498
11.4.2;Isolating the Web Server;499
11.4.3;Web Server Lockdown;500
11.4.3.1;Managing Access Control;500
11.4.3.2;Handling Directory and Data Structures;500
11.4.3.3;Scripting Vulnerabilities;501
11.4.3.4;Logging Activity;502
11.4.3.5;Backups ;502
11.4.4;Maintaining Integrity;502
11.4.5;Rogue Web Servers;503
11.5;Understanding Security and Microsoft Operating Systems;503
11.5.1;General Microsoft Security Issues;504
11.5.1.1;NetBIOS;504
11.5.1.2;Widespread Automated Functionality;505
11.5.1.3;IRDP Vulnerability;506
11.5.1.4;NIC Bindings;506
11.5.2;Securing Windows 9x Computers;507
11.5.2.1;Securing a Windows NT 4.0 Network;510
11.5.2.2;Securing a Windows 2000 Network;513
11.5.2.3;Windows .NET:The Future of Windows Security;515
11.6;Understanding Security and UNIX/Linux Operating Systems;515
11.7;Understanding Security and Macintosh Operating Systems;519
11.8;Understanding Mainframe Security;521
11.9;Understanding Wireless Security;522
11.10;Summary;525
11.11;Frequently Asked Questions;526
11.12;Resources ;527
12;Chapter 9 Implementing Cybercrime Detection Techniques;531
12.1;Introduction;532
12.2;Security Auditing and Log Files;534
12.2.1;Auditing for Windows Platforms;535
12.2.2;Auditing for UNIX and Linux Platforms;540
12.3;Firewall Logs, Reports, Alarms, and Alerts;542
12.4;Understanding E-Mail Headers;548
12.5;Tracing a Domain Name or IP Address;554
12.6;Commercial Intrusion Detection Systems;556
12.6.1;Characterizing Intrusion Detection Systems;557
12.6.2;Commercial IDS Players;562
12.7;IP Spoofing and Other Antidetection Tactics;564
12.8;Honeypots, Honeynets, and Other “Cyberstings”;565
12.9;Summary;568
12.10;Frequently Asked Questions;571
12.11;Resources ;574
13;Chapter 10 Collecting and Preserving Digital Evidence;577
13.1;Introduction;578
13.2;Understanding the Role of Evidence in a Criminal Case;580
13.2.1;Defining Evidence;581
13.2.2;Admissibility of Evidence;583
13.2.3;Forensic Examination Standards;584
13.3;Collecting Digital Evidence;584
13.3.1;The Role of First Responders;585
13.3.2;The Role of Investigators;586
13.3.3;The Role of Crime Scene Technicians;587
13.4;Preserving Digital Evidence;590
13.4.1;Preserving Volatile Data;591
13.4.2;Disk Imaging;592
13.4.2.1;A History of Disk Imaging;592
13.4.2.2;Imaging Software;593
13.4.2.3;Standalone Imaging Tools;595
13.4.2.4;Role of Imaging in Computer Forensics;595
13.4.3;“Snapshot”Tools and File Copying;595
13.4.4;Special Considerations;596
13.4.4.1;Environmental Factors;596
13.4.4.2;Retaining Time and Datestamps;597
13.4.4.3;Preserving Data on PDAs and Handheld Computers;597
13.5;Recovering Digital Evidence;598
13.5.1;Recovering “Deleted” and “Erased” Data;599
13.5.2;Decrypting Encrypted Data;600
13.5.3;Finding Hidden Data;600
13.5.3.1;Where Data Hides;601
13.5.3.2;Detecting Steganographic Data;601
13.5.3.3;Alternate Datastreams;602
13.5.3.4;Methods for Hiding Files;603
13.5.3.5;The Recycle Bin;604
13.5.4;Locating Forgotten Evidence;604
13.5.4.1;Web Caches and URL Histories;604
13.5.4.2;Temp Files;606
13.5.4.3;Swap and Page Files;607
13.5.5;Recovering Data from Backups ;609
13.5.6;Defeating Data Recovery Techniques;610
13.5.6.1;Overwriting the Disk;611
13.5.6.2;Degaussing or Demagnetizing;612
13.5.6.3;Physically Destroying the Disk;612
13.6;Documenting Evidence;613
13.6.1;Evidence Tagging and Marking;613
13.6.2;Evidence Logs;613
13.6.3;Documenting Evidence Analysis;614
13.6.4;Documenting the Chain of Custody;615
13.7;Computer Forensics Resources;615
13.7.1;Computer Forensics Training and Certification;616
13.7.1.1;Computer Forensics Equipment and Software;617
13.7.1.2;Computer Forensics Services;618
13.7.1.3;Computer Forensics Information;619
13.8;Understanding Legal Issues;619
13.8.1;Searching and Seizing Digital Evidence;620
13.8.1.1;U.S. Constitutional Issues;621
13.8.1.2;Search Warrant Requirements;623
13.8.1.3;Search Without Warrant;626
13.8.1.4;Seizure of Digital Evidence;629
13.8.1.5;Forfeiture Laws;630
13.8.2;Privacy Laws;630
13.8.3;The Effects of the U.S. Patriot Act;631
13.9;Summary;634
13.10;Frequently Asked Questions;635
13.11;Resources ;637
14;Chapter 11 Building the Cybercrime Case;639
14.1;Introduction;640
14.2;Major Factors Complicating Prosecution;641
14.2.1;Difficulty of Defining the Crime;641
14.2.1.1;Bodies of Law;642
14.2.1.2;Types of Law;648
14.2.1.3;Levels of Law;650
14.2.1.4;Basic Criminal Justice Theory;652
14.2.1.5;Elements of the Offense;656
14.2.1.6;Level and Burden of Proof ;657
14.2.2;Jurisdictional Issues;658
14.2.2.1;Defining Jurisdiction;658
14.2.2.2;Statutory Law Pertaining to Jurisdiction;661
14.2.2.3;Case Law Pertaining to Jurisdiction;662
14.2.2.4;International Complications;663
14.2.2.5;Practical Considerations;663
14.2.3;The Nature of the Evidence;664
14.2.4;Human Factors;665
14.2.4.1;Law Enforcement “Attitude”;665
14.2.4.2;The High-Tech Lifestyle;667
14.2.4.3;Natural-Born Adversaries?;667
14.3;Overcoming Obstacles to Effective Prosecution;668
14.4;The Investigative Process;669
14.4.1;Investigative Tools;671
14.4.1.1;Steps in an Investigation;678
14.4.1.2;Defining Areas of Responsibility;682
14.5;Testifying in a Cybercrime Case;682
14.5.1;The Trial Process;683
14.5.1.1;Testifying as an Evidentiary Witness;684
14.5.1.2;Testifying as an Expert Witness;684
14.5.1.3;Giving Direct Testimony;685
14.5.1.4;Cross-Examination Tactics;686
14.5.1.5;Using Notes and Visual Aids;686
14.6;Summary;688
14.7;Frequently Asked Questions;689
14.8;Resources ;690
15;Afterword;691
16;Appendix: Fighting Cybercrime on a Global Scale;695
17;Index;731
18;Related Titles;751