Journal of Digital Forensics, Security and Law

21-50

Authors: Robert Vose Simpson

Vermont state prosecutors have asked the Vermont Supreme Court to end a state trial judge’s practice of attaching conditions to computer warrants. The Vermont judge’s conditions are drawn from five conditions established in the 2009 decision of the 9th Circuit Court of Appeals in the Comprehensive Drug Testing, Inc. case (CDT II). This is the first time the validity of the “CDT conditions” will be decided by a state court of final jurisdiction in the United States. The CDT II majority reacted to what it termed “an obvious case of deliberate overreaching by the government in an effort to seize data as to which it lacked probable cause.” Determined “to guard against such unlawful conduct in the future ”,Chief Judge Alex Kozinski, author of the majority opinion, set out five conditions, or “guidance, ” that magistrate judges were to require law enforcement officers to agree to, before the judge signed a computer warrant. The 9th Circuit withdrew these conditions from the majority opinion in September 2010 (CDT III). But, it reaffirmed its conclusion that government agents had violated the Fourth Amendment to the United States Constitution in the CDT case. And, it repeated its concern that the “pressing need of law enforcement for broad authorization to examine electronic records … creates a serious risk that every warrant for electronic information will become, in effect, a general warrant, rendering the Fourth Amendment irrelevant.”

73-98

Authors: Manghui Tu

Forensic readiness can support future forensics investigation or auditing on external/internal attacks, internal sabotage and espionage, and business frauds. To establish forensics readiness, it is essential for an organization to identify what evidences are relevant and where they can be found, to determine whether they are logged in a forensic sound way and whether all the needed evidences are available to reconstruct the events successfully. Our goal of this research is to ensure evidence availability. First, both external and internal attacks are molded as augmented attack trees/graphs based on the system vulnerabilities. Second, modeled attacks are conducted against a honeynet simulating an online business information system, and each honeypot's hard drive is forensic sound imaged for each individual attack. Third, an evidence tree/graph will be built after forensics examination on the disk images for each attack. The evidence trees/graphs are expected to be used for automatic crime scene reconstruction and automatic attack/fraud detection in the future.

117-124

Authors: John C. Ebert

Anson, S., Bunting, S., Johnson, R., & Pearson, S. (2012). Mastering Windows Network Forensics and Investigation, 2nd ed. Indianapolis: John Wiley & Sons. 674 pages, ISBN: 978-1-118-16382-5, $59.99 USA/$71.99 CAN. Reviewed by John C. Ebert, Metropolitan State University (eberjo@metrostate.edu) The book is available as a paperback and e-book. The e-book versions allow you to preview several chapters at any of a number of online vendors. The e-book prices vary from the same as the soft cover version ($59.99) to about $38.99. Some of the vendor's e-books retain the color illustrations found in the print version, but others produce them in grey scale, so you might want to look out for that. The book is divided into four parts (17 chapters) plus two appendices. I am compelled to give the book illustrations a highly unfavorable assessment regarding their readability qualities. Their content is otherwise fine and meaningful. Time and again the illustrations are so miniscule that even those of us with the best of vision will be seriously challenged. I hold out the recommendation to review your e-book options over the hardcopy edition. At least in an e-book you have the hope of doing a page-zoom. Review your e-book providers carefully; some I reviewed had "fuzzy graphics." Notwithstanding the problem illustrations, I still recommend this book for its in-the-trenches information and the desktop reference it will become.