Computer Evidence: Collection and Preservation teaches law enforcement and computer forensics investigators how to identify, collect, and maintain digital artifacts to maintain their reliability to be accepted as evidence. Broken down into five parts, Computer Forensics & Evidence Dynamics, Information Systems, Data Storage Systems & Media, Artifact Collection, and Archiving & Maintaining Evidence, the book places specific focus on how researchers and their tools to interact with digital evidence. KEY FEATURES * Provides practical guidance fi eld for the collection and preservation of evidence that will help keep the reception of evidence * Covers key areas such as rules of evidence, evidence dynamics, network topology, collecting volatile data, imaging methodologies, and forensic laboratories and workstations * Teach all criminal investigators something they need to know to ensure the integrity of digital evidence they * Includes CD-ROM with some demos and freeware software applications and document templates, worksheets, and reference * Includes CD-ROM with some demos and freeware software applications and document templates, sheet work, and references On CD! * DRIVE HEALTH: Contains a demo version of the IDE disk monitoring application * CRYPTCAT: Contains freeware application to create a secure TCP / IP data channel * MARESWARE: Provides utility demos from Mares and Company LLC, which is useful for large-batch scripting forensic operations * LANSURVEYOR: Contains the demo version of software for network mapping through various methods of automatic discovery * Forensic PRODISCOVER EDITION: Includes versions of this demo-disk imaging and analysis * Sysinternals suite: three Contains freeware utilities application (PSList, PSInfo, and PSLoggedon) is useful in batch data files volatitle collection * winhex: Provides raw demo version of winhex file and disk editor SHAPE *: Includes digital copies of sample forms are provided in the * book NUMBERS: Includes all fi gures from the book with a chapter SYSTEM REQUIREMENTS: Pentium-class CPU or better; Windows 98SE / NT / 2000 / XP/2003, Web browser, 128MB memory, 128MB available disk space, CD-ROM or DVD-ROM drive, VGA monitor or higher resolution monitor, keyboard and mouse , or other pointing device.