BOOK REVIEW Building a Digital Forensic Laboratory ...

1 Journal of Digital Forensic Practice, 3:62 63, 2010 Copyright Taylor & Francis Group, LLCISSN: 1556-7281 print / 1556-7346 online DOI: 62 UDFPBOOK REVIEWB uilding a Digital Forensic Laboratory :Establishing and Managing a Successful A. Jones and C. Valli2008, Burlington, MA: Elsevier. xxvii + 285 pp. ISBN 13: 978-1-85617-510-4. $ ReviewBook ReviewLike so many things in our just-in-time world, thisbook was sent to me just as one of my colleagues waslooking for a text for a course he was developing incomputer forensics Laboratory operations and manage-ment.

2 The two lead authors and contributing authorP. Swinburne bring decades of experience in militaryand law enforcement environments in Australia andthe UK to these topics. The book provides valuableinsights that are applicable to Digital forensics labmanagers in both the public and private many aspects of Digital forensics, there are sev-eral public sector guidelines from around the worldfor Building computer forensics labs. That said, thelargest growth in Digital forensics staffing and activityis in the private sector, as information security inci-dent response teams, representatives for the defense incriminal investigations, and e-discovery specialists incivil litigation employ a larger number of computerforensics book is composed of 24 chapters divided intofour sections covering a broad spectrum of I is titled.

3 Creating a Digital Forensics Labora-tory and comprises the first 9 chapters of the chapters cover a range of topics that set down theframework for determining why one is Building such acapability in the first place; knowing why you need tobuild a lab will help immensely in how you design thefacility, assemble the resources, and recruit the first chapter offers a broad overview of the his-tory and processes of Digital forensics, setting the stageat 50,000 ft (or, in deference to the authors, 15,240 m)of what computer forensics is all about.

4 The secondchapter delves into the types of Digital forensics inves-tigations, including aspects of criminal and civil litiga-tion, e-discovery, and data recovery. These twochapters are essential because they provide the base-line for everything else that next two chapters offer a checklist of issues toconsider when establishing a lab and scoping out therequirements. These chapters discuss topics from therole of the lab within the organization/agency, staff-ing, and quality assurance to managing evidence, pur-chasing equipment, and prioritizing the cases.

5 Thesechapters provide the framework for the rest of remaining chapters in this section drill deeperinto some of the specific topics introduced chapters briefly describe the creation of a busi-ness plan for the lab, determining the location for thelab (including issues related to physical site securityand environmental factors), and guidelines for select-ing staff and defining roles within the entire chapter is devoted to training and edu-cation of lab personnel. Though this chapter containsexcellent information, it focuses more on the develop-ment of academic programs and training courses thanit does on guidance about the role of continuing edu-cation, training, and certification of staff.

6 The chapteris augmented somewhat by an appendix that lists themajor industry certification organizations, but there islittle discussion about the relative merits of final chapter in this section addresses laws,regulations, and standards. Though interesting to allprofessionals audiences, the chapter has a slant; the reader from the United States might bedisappointed that there is no analysis about howDownloaded By: [Kessler, Gary C.] At: 16:02 21 March 201063 Book Reviewaccreditation from the American Society of Crime LabDirectors (ASCLD) might apply positively or nega-tively to a Digital forensics lab facility and, certainly,other countries are similarly unrepresented.

7 (ASCLDand similar accreditation could, in some ways, police departments more than other countriesmerely because we have thousands of law enforcementagencies at the local, state, and federal levels.)Section II offers five chapters addressing DigitalForensics and Crime Investigation Management. This section is all about the first steps of the digitalforensics process, namely, identification, preservation,and acquisition of evidence. The first chapter in thissection offers some policy and procedure consider-ations for the response team in preparation to beingcalled to a scene, such as ways in which to deal withstand-alone versus networked devices, desktop systemsversus servers, mobile and wireless devices, etc.

8 Thenext chapter discusses management issues related tothe collection of evidence from a scene, includingidentification, documentation, and legal issues. This isfollowed by a chapter dealing with the managementand storage of the physical evidence media and exami-nation media, including steps to protect and preservethe integrity of the original (or best) is followed by a very important chapter onquality assurance, covering topics ranging from acqui-sition methods, lab processes, and evidence presenta-tion to hardware, software, and documentation.

9 Thesection closes with a chapter summarizing some majorhigh-technology crime cases from around the worldthat provide case studies highlighting the issuesdescribed in this III is titled, Overview of the Digital Foren-sics Investigations Profession and Unit. This part ofthe book comprises seven chapters and, as the nameimplies, addresses topics related to the management ofthe facility and people after a computer lab has beenset up. The section starts with a chapter describing therole of the lab director in managing finances, person-nel, cases, and the facility itself.

10 This is followed by achapter that discusses how to run the lab like a smallbusiness, including the development of strategic andtactical goals and the role of annual plans. The nextthree chapters address other side issues related to labmanagement; namely, obtaining, vetting, and classify-ing information; the use of metrics to measure labactivity; and the role that outsourcing might play withrespect to lab personnel and specialized IV is titled, Future Digital Forensics Inves-tigation Challenges and comprises the final threechapters of the book.