Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Books Media Government The Courts Book Reviews News

Computer Forensics 244

Posted by timothy from the this-is-not-csi dept.
Craig Maloney writes "Many Slashdot readers know how to secure a network, and many know how to determine if a security breach has taken place. Fewer readers, though, would know how to handle a security breach if corporate assets were involved. How would you cooperate with law enforcement when a crime has been committed on a computer?" For more questions, and the rest of Maloney's review of Warren G. Kruse II and Jay G. Heiser's Computer Forensics, read on below.
Computer Forensics
author Warren G. Kruse II and Jay G. Heiser
pages 392
publisher Addison Wesley
rating 8/10
reviewer Craig Maloney
ISBN 0201707195
summary A good reference for what to do when computer crime happens

How do you get the evidence off of a computer, ensuring that it's capable of withstanding a defense lawyer's scrutiny? Maybe you would just unplug the machine and put it in storage awaiting a detective's arrival, but is that what we should do? What if the evidence is on a production server that can't be simply unplugged and put into storage? What if that evidence is slowly being erased as files are created and deleted on that server? How do you help build the case against a computer criminal? Hopefully you'll never have to worry about computer crime in your home or workplace but if you do have to worry, Computer Forensics will be an asset to your part of the investigation.

Who is this book for?

Computer crime isn't simple -- it can range from damage done by simple script kiddies to corporate espionage by disgruntled employees, as well as sophisticated, multi-homed attacks by skilled crackers. Computer Forensics tries hard to cover a lot of these areas. The book includes a chapter dealing with laptop hardware, as well as ones on data hiding and encryption, and further chapters on putting evidence together and dealing with law enforcement. While these topics may be of interest to the Slashdot crowd, Computer Forensics focuses more on broad topics of interest to computer detectives faced with getting up to speed quickly with computer crimes and computer evidence gathering.

Several chapters are downright boring for anyone who has a modicum of computer experience. Finding out where e-mail is stored on Windows and Linux machines, or understanding what a root-kit is and what it does will be pedestrian for many readers. Nestled away between the necessary-but-pedestrian topics, though, are some very useful tools. The authors use netcat with tar to copy files between machines without disturbing the modification times (something I would never have thought to use). Novice users will find a wealth of tools and examples in these chapters. The tools used in the book tend toward open source and free tools, and rely heavily on Linux as the Swiss Army knife for handling file systems and files without disturbing them. Any reader should be able to put together a decent set of tools from this book.

Making it all work

Putting together a good forensic kit is all fine and good, but making sure your evidence holds up to the scrutiny of some high-powered, high-priced defense lawyer is much more important. The last chapter of Computer Forensics gives a brief introduction to the criminal justice system. The authors touch on notifying law enforcement agencies, search warrants, probable cause, interviews, subpoenas, dollar loss guidelines, and testifying as an expert witness, among other legal topics. The appendices of the book have checklists, flowcharts, and an incident report form to aid investigation and evidence gathering. These are invaluable resources for the system administrator of any public machine who needs to deal with law enforcement.

Conclusion

Thinking about dealing with courts and law enforcement may not be at the forefront of any administrator's job, but it is a reality any administrator needs to think of and be aware of. Computer Forensics will at least make administrators more aware of what their legal options are, and of the form in which gathered forensic data needs to be presented as evidence. Computer detectives will find a good, if not rudimentary example of what to look for when investigating a computer crime scene. This may not be the most comprehensive book on the subject of computer crime, but it will point you in the right direction to help investigate it should it ever happen to you.

You can purchase Computer Forensics from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
This discussion has been archived. No new comments can be posted.

Computer Forensics More

Computer Forensics

Comments Filter:

  • SecurityFocus (Score:5, Informative)

    by ProfaneBaby ( 821276 ) on Monday December 06, 2004 @06:15PM (#11011418)
    The security focus mailing list dedicated to forensics is also good lurking, for those interested...

    http://archives.neohapsis.com/archives/sf/forensic s/ [neohapsis.com]

    • A 'thank you' from the SF forensics moderator... (Score:4, Informative)

      by sczimme ( 603413 ) on Monday December 06, 2004 @07:57PM (#11012325)

      The security focus mailing list dedicated to forensics is also good lurking

      I am the moderator of the SecurityFocus.com forensics list, and agree that it is a great resource. (Al Huger is listed in the info page as the moderator; he is actually the list owner.) The list is dedicated to discussion of technical forensics topics.

      The SF forensics list archives are here [securityfocus.com]. A general listing of SF mailing list archives is here [securityfocus.com]. Those interested in subscribing to the forensics list (or other lists @SecurityFocus) can do so from the archive page.

      Cheers!

      Scott C. Zimmerman, CISSP
    • Ironic, that site is run by Kevin Poulsen, a (black hat) hacker.

  • Enterprise file forensics (Score:3, Informative)

    by Anonymous Coward on Monday December 06, 2004 @06:16PM (#11011420)
    We use Dynacomm i:scan [dciseries.com] in our enterprise and it basically does all the forensic work for us. Kinda spooky the things it can report and notify on.

  • Outside the U.S. (Score:5, Interesting)

    by Bingo Foo ( 179380 ) on Monday December 06, 2004 @06:16PM (#11011422)
    In other countries, this book is titled, How to Avoid a Forensic Data Trail on Computers You Compromise.

    • Many books on security are a double edged sword. For example a tutorial on creating protection mechanisms in your programs against disassembly at the same time tells you how to break those protections. A book on how to detect and remove virii gives you insight on how to make them. I could go on... I think the point is that the "bad guys" will leard this information anyways, so we might as well give the "good guys" the same information, especially since the "good guys" don't spend all of their time tryin

  • Time sync all your computers (Score:5, Informative)

    by uid100 ( 540265 ) on Monday December 06, 2004 @06:16PM (#11011426)
    OS level Forensics are much easier if all your computers are set to the same time.

    There is no (good) exuse for not at least NTP'ing all your servers.

    • Re:Time sync all your computers (Score:4, Insightful)

      by Nonesuch ( 90847 ) on Monday December 06, 2004 @06:27PM (#11011542) Homepage Journal
      There is no (good) exuse for not at least NTP'ing all your servers.
      There used to be a good excuse -- recurring root holes in all common NTP implementations.

      With OpenNTPD [openntpd.org], this is no longer a valid excuse.

    • That's totally true.. in fact have every maching on your network NTP'ing. I've worked on a few compromised servers. Of course the first step is to NOT GET COMPROMISED. Use tripwire, honeypots, and protect yourself.

      One thing people forget about is getting the STATE of the server before you off-line it. I'd suggest getting packet dumps, network routes and connections.

      REMEMBER:
      1. Load up a live CD with some KNOWN GOOD utilities, set the path to $CD_PATH:$PATH so it searches off the cd first or specify th

  • Crime On Computer ... (Score:4, Funny)

    by foobsr ( 693224 ) on Monday December 06, 2004 @06:17PM (#11011442) Homepage Journal
    when a crime has been committed on a computer?

    Must be old mainframes then.

    CC.

  • Forensic Security (Score:5, Interesting)

    by djrok212 ( 801670 ) on Monday December 06, 2004 @06:18PM (#11011446)
    Many financial firms including the one where I work, have instituted internal forensic security policies to help limit corporate liability. In our case, we have caught and successfully prosecuted employees for pornography on corporate assets (including child pornography in one case.)

    There are designated employees on the forensic team in each department who are responisble for witnessing the process and documenting the chain of custody for data and items.

    We've invested in specific equipment, including network sniffers (other then those used by the network group), hard drive replicators, log books, and materials for collection and storage of evidence.

    Everything has a chain of custody and is then turned over to the proper authorities.

    As far as the law is concerned since the employee does not have a right or expectation of privacy when working on a corporate asset, everything we take is completely legal. As long as we mantain an effective chain of custody it will likely hold up on court.

    Just my two cents. Your mileage may vary.
    • Just a question, what do you mean by, "prosecuted employees", do you mean in court or just fired their ass? Well, the crime in the case of child pornography is pretty obvious, but what exactly are the legal reprecussions for looking at juicyhoes.com for example? Were you ever actually challenged in court? How much is the burden of proof.
      Thanks,
      An interested college student(interested in the field of forensics, not work pr0n)
      • You can be charged or sued for sexual harassment for view pornographic sites at work.

        • Re:Forensic Security (Score:2, Insightful)

          by GigsVT ( 208848 )
          Sued by who?

          It'd be a hard case to prove it created a "hostile work environment" if no one knew you had porn until an admin found it.

          All this crap is just another case of moral busy-bodies hiding behind the guise of legal liability.
          • or else stealing company time with leaisure activities, just like surfing /. while on the clock...

            Both take company time and resources (bandwidth) while the employee is supposed to be doing something else.

            jason
        • Sued (civil), yes; charged (criminal) I don't think so in the US. Any lawyers care to comment? If there are such laws, is it a misdemeanor or a felony (which would be very scary - considering the implications).
      • do you mean in court or just fired their ass?

        The two times I've had to provide evidence to HR of people using company assets to view porn, both employees were fired.

        but what exactly are the legal reprecussions for looking at juicyhoes.com for example?

        In the above instances (at two different companies) viewing adult content at work was against a written policy. Employees were required to acknowledge the policy when hired

        Were you ever actually challenged in court?

        We weren't. Both people basic

  • Cutting Loses (Score:5, Insightful)

    by fembots ( 753724 ) on Monday December 06, 2004 @06:18PM (#11011449) Homepage
    What if the evidence is on a production server that can't be simply unplugged and put into storage?

    In my company, once a machine is compromised, it's offline and ghost image taken, no questions asked, even it's a live ecommerce site. You would rather putting up a "Unscheduled Outage" notice than inflicting more damages to the server/data.

    It's like a 777 pilot asking if he should make an emergency landing due to a fire alarm, because there are 350 passengers onboard and we don't want to spoil their holiday.

    Actually I think pilots do that, that's why we get to read blackbox transcript like

    GPWS: "Whoop, whoop. Pull up. Whoop whoop. Pull up."
    CA: "Don't worry we can make it."
    GPWS: "Whoop, whoop. Pull -."

    • Re:Cutting Loses (Score:2, Insightful)

      by GigsVT ( 208848 )
      On the other hand, pulling it down immediately is bad forensic practice. You may very well be destroying evidence contained in RAM.

      Ideally you would take it off the network, but keep it running. Ideals rarely get practiced when it comes to security though.
    • Ideally, something like EnCase Enterprise would already be installed on the machine. The Enterprise edition of EnCase allows for network security analysis and creates a rather nice report and image of what is going on.

      The problem with this (thus making it ideal is):
      1) most corporations do not have programs like EnCase Enterprise installed prior to the attack
      2) EnCase is prohibitively expensive.

      You can make an image of the server in the case that it is warranted, but that requires you to have an equal or

  • Been there, done that. (Score:5, Interesting)

    by rylin ( 688457 ) on Monday December 06, 2004 @06:18PM (#11011450)
    Recently, I was contacted by the local PD in regards to a huge number of stolen CCs being used from our IP-range (Internet Café).
    After getting a list of specific timestamps (along with IP-addresses), I was able to figure out who the culprit was.
    That said, the man-hours I put into the whole thing seem to have been for nothing.
    The PD won't do jack shit - too little resources, they say - which is why I find it funny that they can't even send a unit to pick up the frauders when they're actually on-site (yet they can be seen parading the streets, looking for minors consuming alcohol).

    Just because law enforcement want your help doesn't mean they'll do anything - even if you virtually hand them the crooks on a silver platter.
    Then again, things might be different elsewhere.
    • In that case, (honest question) wouldn't it make more sense to contact the fraud dept. of CC and let them take care of steps to prosecution? Or are they equally unresponsive?

    • Re:Been there, done that. (Score:4, Insightful)

      by HarveyBirdman ( 627248 ) on Monday December 06, 2004 @06:31PM (#11011580) Journal
      Well, someone jacks my CC number, I'm on the hook for a max of $50.

      A drunken minor behind the wheel of mom's Ford Excursion costs me far, far more than that should I encounter the illbred little monster on the road.

      Hey, just presenting a contrarian view. Was it at least an interesting learning experience?

    • The only time I've ever had a box rooted was a few years ago in DC (I was careless with WU-ftpd; lesson learned). I was able to trace back through this particular attacker's sloppiness, and gathered a lot of useful info. When I called the Washington DC bureau of the FBI to report the incident and share what I had learned, I was told, "um, our computer guy's not here right now. Can you call back tomorrow?"

      I was aghast, needless to say.

      $0.02,
      ptd

  • outdated? (Score:5, Insightful)

    by Boolio ( 665658 ) on Monday December 06, 2004 @06:18PM (#11011454)
    The publication date on the book linked is 2001. That makes this book three to four years old. While some of the information may be the same, there are quite a number of new tools and techniques out there. So some of this may be pretty outdated. I have yet to find a great book on system forensics. The best so far is the book "Know Your Enemy" buy contributors to the HoneyNey Project.

  • This is dangerous stuff to mess around with... (Score:5, Insightful)

    by Pacifix ( 465793 ) <zorp@@@zorpy...com> on Monday December 06, 2004 @06:20PM (#11011472)
    ... like security, forensics is best left to those who really know what they're doing. The results of a forensics investigation can very often end up being part of a civil or criminal case and amature mistakes can get the case thrown out. Contaminating the data by not properly imaging it, not knowing where to find hidden data, or misinterpreting what is found are all very easy to do. Be very sure you have all your bases covered before selling yourself as a forensic investigator.
    • thats true. I tooke a computer forensics class at my school about a year and a half ago, it was a great class and this book was one of the ones we used. One of the main points our professor drove home was properly maintiaing a chain of evidence. This is something that would be second nature to a criminal justice major but is pretty foreign to someone in computer science. As far as being a forensic investigator, i would look for a GIAC Certified Forensic Analyst certifcation. I know that alot of people

  • An actual example of corporate breaches. (Score:5, Interesting)

    by pjbass ( 144318 ) on Monday December 06, 2004 @06:20PM (#11011473) Homepage
    I work at a large semiconductor company (not to name names, but a really big, US, SC-based one) that had a recently fired employee wreak havoc on one of the factories' databases as a result of his termination. Basically he used his not-yet-cancelled remote access, and deleted a critical DB. Now this isn't hacking in the sense of rooting a remote exploit, but it's malicious intent nonetheless on computer systems. It was obvious what happened (the factory stopped running), and very quickly we were able to track down the last few commands logged, where they came from, etc., etc. How it was handled was actually an FBI case. We turned it over to the security department at our company, and they worked with the FBI; we were asked questions by the men in black, and this person was eventually arrested and put away in a dark, dank hole.

    Not sure if this is the norm, but I'd figure when corporations and expensive IP is involved, government-sanctioned agencies will be in the forefront of people investigating, IMHO.

    • not to name names (Score:3, Informative)

      by bani ( 467531 )
      "intel"

      the ex-employee is David Dugan.

      the case you're talking about is this one:
      http://www.theregister.co.uk/2004/11/11/inte l_gun_ man/
      • the case you're talking about is this one:
        http://www.theregister.co.uk/2004/11/11/int e l_gun_ man/

        The case you referenced was about a guy who wanted to go postal on the plant where he used to work. It didn't say anything about him dropping DBs, and implied he was a line worker until being fired for some unknown reason. Hardly someone with root level access to a production DB.

        Besides, there's a world of difference between dropping a DB and sprayin' and prayin' with your trusty Kalishnikov brand happy joy
      • No, this is not the case. It never made press; this person was in Oregon. He never made death threats, or tried to blow up a plant. He was much closer to the operations than this person. Nice try though.

        And yes, this is the company...

  • It's not easy (Score:2, Interesting)

    by penguinoid ( 724646 )
    The problem with computer crimes is that they are not easy to track. On a regular PC, a cracker could break in and remove any evidence (on that PC) that the computer was ever hacked. You might catch him if you happen to be looking while he is busy, but after he is finished, there is not much you can do.

    There are, however, some hardware solutions, namely, to keep track of everything that happens (this is expensive!). Software could also do that, so long at it cannot be hacked. Overall, I think the best

  • The computer is the victim. (Score:5, Funny)

    by eln ( 21727 ) on Monday December 06, 2004 @06:22PM (#11011491)
    Whenever you do work like this on computers, it's important to know that the computer is ultimately the victim here. Don't be too rough with it in trying to get information. It's important to get information back, but it's also very important to maintain the computer's well-being. Always ask before taking a look at the computer's hard drives. If the computer refuses, back off and try again another day. After being so traumatized, many computers will not feel comfortable letting you in right away. In some cases, gender may be an issue, so always use female-to-female or male-to-male data cables when attempting to access the computer's internal ports, as recently attacked computers may have more hostility toward opposite-gender pairings in interrogations.

    Please, always make the computer your first priority, and be mindful that you do not damage it further in your rush to make an arrest.

  • Step 1 (Score:4, Insightful)

    by Kallahar ( 227430 ) <kallahar@quickwired.com> on Monday December 06, 2004 @06:26PM (#11011526) Homepage
    Step 1: Turn off the machine.
    Step 2: Make a bit for bit copy of the drive (there are special devices that will ensure that NONE of the bits are changed).
    Step 3: You can now run whatever forensics tools you want *on the copy*. The original has to be kept unchanged for it to be worth anything in court.

    Make sure to never boot up the drive in question, a good criminal will have the drive auto-erase if it doesn't get a password in a certain amount of time, etc.
    • That'll catch a good number of attackers, but if I were doing serious blackhat stuff and had rooted a production *nix server, I'd keep all my nasty stuff in RAM at all times to avoid having anything caught on hard drive. (Yes, that also includes specifically preventing swapping to disc.) Combined with some good tactics against insertable media, it's possible to make it very hard to leave traces on a system.
    • Make sure that you have appropriate equipment on-hand so that you can -document- that you have taken appropriate steps. Make sure that you have appropriate gear to record and playback every operation that you take, and the system's responses. Test it out. Do scan-lines destroy your video image ?

      Yes - an adversary can challenge everything you do in court - but, this is the only effective way to assert that you have not damaged or tainted the evidence. You can prove that you've maintained the chain-of-cu
    • My impression from the replies is that what you should do depends on the situation.

      Against a theoretical very sophisticated non-bot attacker you'd just do nothing with the machine and instead watch the network traffic for clues.

      So think first, about ways to stealthily collect more information, then follow the parents advice to make a bit-by-bit copy of the harddrive after turning off the machine.

  • Transfering for forensics (Score:4, Informative)

    by Kalak ( 260968 ) on Monday December 06, 2004 @06:29PM (#11011554) Homepage Journal
    Rsync [samba.org] will do this simply and efficiently, plus it can resume transfers and also tunnel through ssh.

    Also you can pipe dd through gzip/bzip2 and netcat to give you a loopback mountable, unmodifiable image that you can look at in case you want to grab the whole drive before putting it in the evidence locker.
  • and if i you can find them. Call the A-team [80snostalgia.com].

  • Valve (Score:5, Interesting)

    by FiReaNGeL ( 312636 ) <`moc.liamtoh' `ta' `l3gnaerif'> on Monday December 06, 2004 @06:32PM (#11011591) Homepage

    In the case of HL2 code theft, Valve got lucky; they just had to wait for the hacker's ego to blow out of proportion due to the massive coverage. He emailed them. Several times. He went to a meeting for an 'interview' for a 'job'. Thank god, most hackers(as in illicit network infiltration) / criminals eventually make mistakes. In this particular case, it was pure dumbness, however. Imagine the scene :

    "Honey, you know the company that I (big F word, past tense) over, well, they're offering me a JOB!" "Great! When are we moving?"
    Heh.
    past /. coverage [slashdot.org]

  • How would you cooperate with law enforcement? (Score:5, Funny)

    by RealAlaskan ( 576404 ) on Monday December 06, 2004 @06:33PM (#11011594) Homepage Journal
    How would you cooperate with law enforcement when a crime has been committed on a computer?

    Wouldn't that depend on your role in the crime, and your lawyer's advice?

    • Odd this was modded Funny. You'd better consider consulting a lawyer when involved with a criminal investigation. I hope the book has a chapter on when to simply use your company's law representation and when it makes sense to contact independent council. You better believe your company is using thier legal resources (and maybe considering their case against you!)
      • Yes, I wasn't totally joking (posting from my other ID). If it's important enough to call the cops, it's important enough to get your lawyer involved. If it's your business, he can help you get the cops to take action (maybe) and help deal with the insurance company's lawyers. Most of all, he can reduce the chances of you doing something stupid.

        If you're an employee, you can bet that the corp's lawyers are going to be involved, and they are going to be safeguarding the corp's interests, at your expense

  • WWYD? STFD, STFU, and DWYT. (Score:5, Insightful)

    by Tackhead ( 54550 ) on Monday December 06, 2004 @06:38PM (#11011642)
    > How would you cooperate with law enforcement when a crime has been committed on a computer?

    I would do whatever the nice people with the guns told me to. Nothing more, and nothing less.

    The guys with the guns are not my friends, but they're pretty nice to people who help them. The most helpful thing you can do for these people is to sit the fuck down, shut the fuck up, and to do what you're told.

    Unless you're being paid to perform an investigation, getting good forensic data off that drive is not your responsibility. That's the responsibility of the friends of the guys with the guns. (Are you a friend? Easy to check! Is your paycheck signed by a big guy with a really big gun? If not, you are not one of their friends!)

    Going further, getting data off the drive isn't your responsibility -- but not fucking up the chain of custody is your responsibility. If you fuck up the chain of custody, the guys with the guns will be very, very, very angry with you. (You do not want this to happen.)

    So:
    1) Do not make the people with guns angry.
    2) Do not "help" the people with guns (even if you want to), because anything you do to "help" them runs the risk of making them angry.
    3) STFD. STFU. DWYT.

    Y'know how we geeks have hundreds of words to express the concept of "nontechnical person who is too clueless to be allowed anywhere near a computer"?

    I'll bet cops have hundreds of words that translate to "civilian who is too clueless to be allowed anywhere near an ongoing investigation".

    • I wish I still had mod points!
      -nB

    • 2 things (Score:3, Insightful)

      by circletimessquare ( 444983 )
      1. your whole philosophy of "just do what you are told" is the best philosophy for making sure the guys with the guns stay on top for as long as possible... in other words, you're attitude is part of the problem: "i'm just a slave, i don't think"

      2. for a treatise which draws a line between yourself and the guys with the guns, you come across as pretty passive aggressive
    • The most helpful thing you can do for these people is to sit the fuck down, shut the fuck up, and to do what you're told.

      This is true, but not useful. It is the most helpful thing you can do for "these people", however, the most helpful thing you can do for yourself is to wait for the advice of your lawyer and do nothing and say nothing until then.
      If they are asking you for help, then you are a syadmin of some sort. As such (pay attention now) YOU ARE HIGH ON THE LIST OF POSSIBLE SUSPECTS. Don't make thi

  • Very popular toolkit (Score:2, Interesting)

    by jgercken ( 314042 )
    The Sluth Kit [sleuthkit.org].

  • this is an old ass book.. (Score:2, Interesting)

    by Anonymous Coward

    why the review now?

  • Department of Justice Forensic Guide (Score:3, Informative)

    by greyfeld ( 521548 ) on Monday December 06, 2004 @06:48PM (#11011723) Journal
    Here's a link to the Department of Justice's Forensic Guide for Law Enforcement if you are interested.

    http://www.ncjrs.org/pdffiles1/nij/199408.pdf

  • Step One: (Score:3, Insightful)

    by nurb432 ( 527695 ) on Monday December 06, 2004 @06:50PM (#11011746) Homepage Journal
    If you have had a breach, and its going to involve *anything* legal:

    TALK TO YOUR ATTORNEY.. first.. not 2nd .. not 3rd.. do it even before you even call the cops....( well after you plug the hole... )
    • No. Get someone trained in forensics to capture the data before you tamper with the crime scene by patching the hole.

      Depending on what you are working with, patching the hole or even unplugging the computer might destroy the crime scene.
      • If that is the cost of not losing more confidential data, then so be it..

        Id not hesitate for an instant.

        Where i work the cost of the breach is MUCH higher then the potential loss of evidence or traceback. ( in my case, the admin can be *jailed* for lack of action, due to federal regulations )

  • Wait for a Subpoena (Score:3, Insightful)

    by jchawk ( 127686 ) on Monday December 06, 2004 @07:05PM (#11011869) Homepage Journal
    Before you start handing out information it is always best to wait for a subpoena. Make sure it's signed by a judge and not a clerk. There is a reason for due process and law enforcement understands this even though they don't always want to follow it!
    • How would you cooperate with law enforcement when a crime has been committed on a computer?


    That's the wrong question. How would I cooperate isn't a concern because I wouldn't.

    If your cooperation leads to evidence that you didn't do everything that you could have possibly done to prevent the security breach, that could expose you to financial liability. I'm not going to be the one to gathers the evidence to be used against me.

    LK

  • FWIW2 (Score:2, Interesting)

    by selil ( 774924 )
    I really enjoyed the book myself when I read it this summer. As a compilation detailing computer law it was pretty good. Most of the tools I found to be aging or at a very low level. If you add in "Cybercrime" by Ralph D. Clifford an excellent book on computer law it opens a much broader picture. "Software Forensics" by Robert M. Slade is my current read and gets an interesting rating for now. "Computer Forensics" unfortunately is only part of the picture. With so much of the net existing in RAM and the tr
  • A recent research paper from University of Michigan, Backtracking Intrusions [umich.edu], presents a tool for identifying and visualizing the cause of suspicious behaviors (e.g., "where did the file /tmp/rootkit come from?"). A very nice paper and a significant contribution to intrusion forensics.

Slashdot Top Deals

I tell them to turn to the study of mathematics, for it is only there that they might escape the lusts of the flesh. -- Thomas Mann, "The Magic Mountain"

Close