Guide to Computer Forensics and Investigations

Amelia Phillips is a tenured faculty member at Highline College in Seattle, Washington. After serving as an engineer at the Jet Propulsion Laboratory, she worked with e-commerce websites and began training in computer forensics to prevent credit card numbers from being stolen from sensitive e-commerce databases. Dr. Phillips designed certificate and AAS programs for community colleges in e-commerce, network security, computer forensics and data recovery. She designed the Bachelor of Applied Science in Cybersecurity and Forensics, which was approved in 2014. A Fulbright Scholar, Dr. Phillips taught at Polytechnic of Namibia in 2005 and 2006 and continues her work with developing nations, traveling there frequently. She earned BS degrees in astronautical engineering and archaeology and an MBA in technology management from the Massachusetts Institute of Technology, and an interdisciplinary Ph.D. in computer security from the University of Alaska, Fairbanks. Bill Nelson has worked for two global Fortune 100 companies in information technologies for over 32 years, including 18-plus years in corporate digital forensics and information security. In addition, he has taught digital forensics classes at the City University of Seattle and the University of Washington's Professional and Continuing Education Department for 10 years. He also has experience in Automated Fingerprint Identification System software engineering and reserve police work. A former president and vice president for Computer Technology Investigators Northwest, he routinely lectures at several colleges and universities in the Pacific Northwest. Christopher K. Steuart is a practicing attorney maintaining a general litigation practice, with experience in information systems security for a Fortune 50 company and the U.S. Army. He is also an honorary life member and the former general counsel for Computer Technology Investigators Northwest. He has presented computer forensics seminars in regional and national forums, including the American Society for Industrial Security, Agora, Northwest Computer Technology Crime Analysis Seminar and CTIN. Bill Nelson has worked for two global Fortune 100 companies in information technologies for over 32 years, including 18-plus years in corporate digital forensics and information security. In addition, he has taught digital forensics classes at the City University of Seattle and the University of Washington's Professional and Continuing Education Department for 10 years. He also has experience in Automated Fingerprint Identification System software engineering and reserve police work. A former president and vice president for Computer Technology Investigators Northwest, he routinely lectures at several colleges and universities in the Pacific Northwest. Christopher K. Steuart is a practicing attorney maintaining a general litigation practice, with experience in information systems security for a Fortune 50 company and the U.S. Army. He is also an honorary life member and the former general counsel for Computer Technology Investigators Northwest. He has presented computer forensics seminars in regional and national forums, including the American Society for Industrial Security, Agora, Northwest Computer Technology Crime Analysis Seminar and CTIN.

Module 1 Understanding the Digital Forensics Profession and Investigations
Module 2 Report Writing and Testimony for Digital Investigations
Module 3 The Investigator’s Laboratory and Digital Forensics Tools
Module 4 Data Acquisition
Module 5 Processing Crime and Incident Scenes
Module 6 Working with Microsoft File Systems and the Windows Registry
Module 7 Linux and Macintosh File Systems
Module 8 Media Files and Digital Forensics
Module 9 Virtual Machine Forensics and Live Acquisitions Forensics
Module 10 Network Forensics
Module 11 Cloud Forensics and the Internet of Anything
Module 12 Mobile Device Forensics
Module 13 Email and Social Media Investigations
Module 14 e-Discovery
Module 15 Ethics and Professional Responsibilities
Appendix A Certification Testing References
Appendix B Digital Forensics References
Appendix C Digital Forensics Lab Considerations
Appendix D Legacy File Systems
Appendix E NICE Framework and CAE Knowledge Units
Appendix F Shell Command Examples
Glossary