conversations.from: human
conversations.value: Provide a description for a book titled Computer Forensics For Dummies about with the genre: Computers & Technology, Networking & Cloud Computing.
conversations.from: assistant
conversations.value: When the crime scene is a computer or handheld device, you canuncover a digital evidence trail!
conversations.from: human
conversations.value: Provide the first four paragraphs for this book.
conversations.from: assistant
conversations.value: Computer Forensics For Dummies
  Understanding the technical side of computer forensic investigation is a commendable and daunting accomplishment, but you still have to learn the law. Legal requirements always come first. Don't touch that device unless you understand the law and its lingo so that you can investigate ethically and without putting yourself in harm's way.
  Investigations are a team sport, so to speak. Even the legendary fighter of injustices, the Lone Ranger, got help from his partner, Tonto. In many cases, being the computer forensic professional means that you're the technical expert but not necessarily the lead investigator in charge. You may be and should be working with a legal expert who guides the team through the intricacies of legal traps.
  Using the team approach in civil and criminal cases increases the odds that procedures and reports withstand the scrutiny of the court and cross- examination by opposing counsel. If the opposing counsel is well prepared, it can be a tough audience and a capable opponent.
  Prosecutor: This attorney ensures that the team complies with all applicable laws and legal procedures before and during a search or seizure. Because the prosecutor appears before a court to litigate the case, he has a vested interest in making sure that the investigative team leaves no legal loophole that the defense team can walk through. Chapter 5 is dedicated to minding and finding loopholes (although loopholes are beneficial if you're the one finding and using them to your advantage).
conversations.from: human
conversations.value: Provide five more paragraphs.
conversations.from: assistant
conversations.value: The procedure to insert a header into an existing file is simple in concept, but doesn't always work in the real world because of file damage or an application's tolerance of data that it may not recognize. The file header for a particular file format is always at the beginning of a file. If you know the file format you're dealing with, you can simply copy an existing file header and paste it into the damaged or deleted file. Some file formats are more forgiving than others, such as graphical files that display even partial information, whereas other formats, such as databases, often refuse to open if the file is even slightly damaged. Figure 10-8 shows the beginning of a file using a hex editor in the top pane and showing a damaged file on the bottom pane. The header is simply copied from the top pane and pasted into the file in the bottom pane.
  An area where technically oriented suspects might hide data is in the areas not seen by the operating system. The operating system either classifies the areas as damaged or simply cannot access them because of file system limitations.
  Because a file system can deem a storage area as bad or damaged, you can use a hex editor to modify the settings of the file system where this is controlled to mark those areas as bad and then copy information into them. This process isn't impossible, but it takes a little skill because you have to know how to modify the file system configuration files.
  Another location where files may be hidden is in the area of a storage device an operating system does not recognize. Many storage devices have small areas of overhead measuring 1 gigabyte or smaller that are completely inaccessible by the operating system. This space is usually located at the physical end of the storage device and is accessible only by a hex editor.
  Figure 10-9 shows a hex editor viewing the physical end of a storage device that the operating system doesn't recognize. A suspect only has to copy the information he wants to hide and use the hex editor to paste it into this area of the storage device to make the data invisible to anyone other than an experienced computer user.
conversations.from: human
conversations.value: Swap the first and the last sentence.
conversations.from: assistant
conversations.value: A suspect only has to copy the information he wants to hide and use the hex editor to paste it into this area of the storage device to make the data invisible to anyone other than an experienced computer user. The file header for a particular file format is always at the beginning of a file. If you know the file format you're dealing with, you can simply copy an existing file header and paste it into the damaged or deleted file. Some file formats are more forgiving than others, such as graphical files that display even partial information, whereas other formats, such as databases, often refuse to open if the file is even slightly damaged. Figure 10-8 shows the beginning of a file using a hex editor in the top pane and showing a damaged file on the bottom pane. The header is simply copied from the top pane and pasted into the file in the bottom pane.
  An area where technically oriented suspects might hide data is in the areas not seen by the operating system. The operating system either classifies the areas as damaged or simply cannot access them because of file system limitations.
  Because a file system can deem a storage area as bad or damaged, you can use a hex editor to modify the settings of the file system where this is controlled to mark those areas as bad and then copy information into them. This process isn't impossible, but it takes a little skill because you have to know how to modify the file system configuration files.
  Another location where files may be hidden is in the area of a storage device an operating system does not recognize. Many storage devices have small areas of overhead measuring 1 gigabyte or smaller that are completely inaccessible by the operating system. This space is usually located at the physical end of the storage device and is accessible only by a hex editor.
  Figure 10-9 shows a hex editor viewing the physical end of a storage device that the operating system doesn't recognize.The procedure to insert a header into an existing file is simple in concept, but doesn't always work in the real world because of file damage or an application's tolerance of data that it may not recognize.
conversations.from: human
conversations.value: Provide the last four paragraphs.
conversations.from: assistant
conversations.value: Rule 34: E-records and communications are subject to subpoena and discovery for use in legal proceedings.
  Rule 702: The Federal Rule of Evidence governs the admissibility of expert testimony. The witness must be qualified as an expert in order to be allowed to provide testimony.
  SHA (secure hash algorithm): An algorithm for computing a condensed representation of a message or data file. The condensed representation is of fixed length and is known as a message digest (MD) or fingerprint. It's similar to a human fingerprint in that it uniquely identifies the forensics image (evidence file). Either SHA or MD5 is used to verify the evidence file. If the hash values of the forensic image and the original match, there's no way the that data could have been modified through the normal course of your investigation. See also MD5 hash.
  SMTP (Simple Mail Transfer Protocol): The language used in an e-mail system to send messages to an e-mail server. SMTP pushes (delivers) the messages to e-mail servers.
conversations.from: human
conversations.value: Reverse the sentences.
conversations.from: assistant
conversations.value: SMTP pushes (delivers) the messages to e-mail servers..
  SMTP (Simple Mail Transfer Protocol): The language used in an e-mail system to send messages to an e-mail server. See also MD5 hash. If the hash values of the forensic image and the original match, there's no way the that data could have been modified through the normal course of your investigation. Either SHA or MD5 is used to verify the evidence file. It's similar to a human fingerprint in that it uniquely identifies the forensics image (evidence file). The condensed representation is of fixed length and is known as a message digest (MD) or fingerprint.
  SHA (secure hash algorithm): An algorithm for computing a condensed representation of a message or data file. The witness must be qualified as an expert in order to be allowed to provide testimony.
  Rule 702: The Federal Rule of Evidence governs the admissibility of expert testimony.Rule 34: E-records and communications are subject to subpoena and discovery for use in legal proceedings