Course Title: Computer Forensic Specialist: Data and Image Files

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Course Title: Computer Forensic Specialist: Data and Image Files"

Transcription

1 Course Title: Computer Forensic Specialist: Data and Image Files Page 1 of 9

2 Course Description The Computer Forensic Series by EC-Council provides the knowledge and skills to identify, track, and prosecute the cyber-criminal. The series is comprised of five books covering a broad base of topics in Computer Hacking Forensic Investigation, designed to expose the reader to the process of detecting attacks and collecting evidence in a forensically sound manner with the intent to report crime and prevent future attacks. Learners are introduced to advanced techniques in computer investigation and analysis with interest in generating potential legal evidence. This and the other four books provide preparation to identify evidence in computer related crime and abuse cases as well as track the intrusive hacker's path through a client system. The series and accompanying labs help prepare the security student or professional to profile an intruder's footprint and gather all necessary information and evidence to support prosecution in a court of law. Investigating data and image files provides a basic understanding of steganography, data acquisition and duplication, encase, how to recover the deleted files and partitions and image file forensics. Certification Info Computer Forensic Specialist: Data and Image Files Who Should Attend This course will significantly benefit police and other law enforcement personnel, defense and military personnel, e-business security professionals, systems administrators, legal professionals, banking, insurance and other professionals, government agencies and IT managers. Course Duration 2 days (9:00AM 5:00PM) CPE/ECE Qualification 16 ECE Credits awarded for attendance (1 for each classroom hour) Suggested Retail: $799 USD Page 2 of 9

3 Required Courseware: Visit and click on Training Workshops for ordering details. What s included? Physical Courseware 1 year Access To EC-Council Student LMS for Practical Labs (if applicable), testing, and Certificate Course + Supplement Cost: See the Training Workshops section at for current pricing information. Related Certificates: Computer Forensic Specialist: Procedures & Response Computer Forensic Specialist: Storage Device & Operating Systems Computer Forensic Specialist: Network Intrusion & Cybercrime Computer Forensic Specialist: Wireless Networks and Devices Page 3 of 9

4 Course Briefing 1. Steganography Steganography, the art of hidden writing, has been in use for centuries. It involves embedding a hidden message in some transport or carrier medium, and has been used by mathematicians, military personnel, and scientists. They all engage themselves in changing the common language and transferring it through secret and hidden communication. The objective of this chapter is to make you familiar with the concept of steganography. This chapter covers the various methods in which steganography can be applied either legally or illegally. It discusses the early history and evolution of steganography and highlights the various steganography tools that are used and the salient features of these tools as well. 2. Data Acquisition and Duplication Data acquisition is an important step in the investigation process. The data collected from the victim s system is presented as the evidence. So, the data should be kept with the investigator and produced in the court while the trial is going on. Sometimes instead of data acquisition, duplication of the data is the best way to collect the data. Duplicated data can also be presented at the court. This chapter deals with data acquisition and data duplication process which are the important aspects of the forensic investigation. It also highlights the popular tools required during the data acquisition and data duplication process. 3. Forensic Investigations Using EnCase Encase is widely known and used tool in the forensics. It helps to collect and verify the evidences for the investigation process. This chapter covers the evidence files, verifying file integrity, configuring encase, searching, and bookmarks. This chapter describes the complete process of forensic investigation using EnCase. 4. Recovering Deleted Files and Deleted Partitions During the investigation of the computer system, an investigator may come across a situation where the evidences of the crime are deleted from the system. In this case, an investigator should know how to recover the deleted files, which can be used as evidence. Deleted files and deleted partitions can be a good source of evidence which are useful to provide an important clue in the investigation. This chapter covers the various methods in which a forensic investigator can recover the deleted files. It deals primarily with understanding the basic concept of recovering the deleted files. The chapter also highlights the various data recovery tools and the salient features of these tools. Page 4 of 9

5 5. Image File Forensics Image files are the key component in the investigation process. Image files can be presented as evidence in the court. It is important to recover the image files from the attacked computer and preserve it. Image files are delicate and can be corrupted if it is not handled properly. This chapter covers the various methods in which a forensic investigator can go about recovering the image files. This chapter mainly deals with understanding the basic concept of recovering the image files. This chapter also highlights the various image recovery, steganalysis, and viewing tools that are used in this process. Page 5 of 9

6 Course Outline Chapter 1: Steganography Introduction to Steganography Stegosystem Model Application of Steganography Classification of Steganography Digital File Types Steganographic File System Cryptography Watermarking Issues in Information Hiding Detecting Steganography Tools Chapter 2: Data Acquisition and Duplication Introduction to Data Acquisition and Duplication Determining the Best Acquisition Methods o Disk-to-Image File o Disk-to-Disk Copy o Sparse Data Copy Data Recovery Contingencies The Need For Data Duplication Data Acquisition Software Tools Windows Standard Tools Linux Standard Tools o DriveSpy o FTK Imager o Mount Image Pro o Drive SnapShot o SnapBack DatArrest o SafeBack Data Acquisition Hardware Tools o Image MASSter Solo-3 o LinkMASSter-2 o RoadMASSter-2 Page 6 of 9

7 Data Duplication Software Tools o R-Drive Image o DriveLook o DiskExplorer o Save-N-Sync o DFSMSdss o SCSIPAK Data Duplication Hardware Tools o ImageMASSter 6007SAS o Disk Jockey IT o QuickCopy Chapter 3: Forensic Investigations Using EnCase Introduction to Forensic Investigation Using EnCase Evidence Files o Verifying Evidence Files o Evidence File Format Verifying File Integrity Hashing Acquiring an Image Configuring EnCase o View Menu o Device Tab o Status Bar o Searching o Keywords o Starting the Search o Search Hits Tab o Bookmarks o Creating Bookmark Folders o Adding Bookmarks o Bookmarking a Selected Area Recovering Deleted Files/Folders in a FAT Partition Viewing Recovered Files Recovering Files/Folders in an NTFS Partition Master Boot Record (MBR) Page 7 of 9

8 NTFS Starting Point Viewing Disk Geometry Recovering Deleted Partitions Hash Values o Creating Hash Sets o MD5 Hash o Creating Hashes o Viewers o Creating Hashes Signature Analysis Viewing the Results Copying Files and Folders Recovery Reporting EnCase Boot Disks Chapter 4: Recovering Deleted Files and Deleted Partitions Introduction to Recovering Deleted Files and Deleted Partitions Deleting Files What Happens When a File Is Deleted in Windows? The Recycle Bin in Windows Damaged Recycled Folder How to Undelete a File Data Recovery in Linux o Tools to Recover Deleted Files File Recovery Tools for Windows Tools for Use with UNIX-based Systems o Tools Based on File Type o Tools Based on Media Type Recovering Deleted Partitions Deletion of a Partition What Happens When a Partition is Deleted? Recovery of Deleted Partitions Tools to Recover Deleted and Damaged Partitions Chapter 5: Image File Forensics Page 8 of 9

9 Introduction to Graphics File Forensics Introduction to Graphics Files Understanding Vector Images Understanding Raster Images Metafile Graphics Understanding Image File Formats BMP (Bitmap) File Data Compression in Image Files Understanding File Compression Lossless Compression Algorithms Lossy Compression Locating and Recovering Image Files Steganography in Image Files Steganalysis Identifying Copyright Issues with Graphics Page 9 of 9

The Solution: EC-Council Press

The Solution: EC-Council Press EC-Council Press The Experts: EC-Council EC-Council s mission is to address the need for well educated and certified information security and e-business practitioners. EC-Council is a global, member based

More information

Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065

Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065 Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065 Introduction The Computer Forensics and Investigation course presents methods to properly conduct a computer forensics investigation

More information

ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING

ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING MODULE A INTRODUCTION TO COMPUTER FORENSICS AND NVESTIGATIONS A1.0 Explain concepts related to computer forensics. A1.1 This module is measured

More information

EC-Council Ethical Hacking and Countermeasures

EC-Council Ethical Hacking and Countermeasures EC-Council Ethical Hacking and Countermeasures Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.

More information

Guide to Computer Forensics and Investigations, Second Edition

Guide to Computer Forensics and Investigations, Second Edition Guide to Computer Forensics and Investigations, Second Edition Chapter 9 Data Acquisition Objectives Determine the best acquisition method Plan data-recovery contingencies Use MS-DOS acquisition tools

More information

CHFI v8(computer Hacking Forensics Investigator)

CHFI v8(computer Hacking Forensics Investigator) CHFI v8(computer Hacking Forensics Investigator) Course Description & Overview Overview CHFIv8 Course Description EC-Council releases the brand new Version 8 of the Computer Hacking Forensics Investigator

More information

2! Bit-stream copy. Acquisition and Tools. Planning Your Investigation. Understanding Bit-Stream Copies. Bit-stream Copies (contd.

2! Bit-stream copy. Acquisition and Tools. Planning Your Investigation. Understanding Bit-Stream Copies. Bit-stream Copies (contd. Acquisition and Tools COMP 2555: Principles of Computer Forensics Autumn 2014 http://www.cs.du.edu/2555 1 Planning Your Investigation! A basic investigation plan should include the following activities:!

More information

C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR

C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR Page: 1 TM C HFI Computer C HFI Computer Hacking Forensic INVESTIGATOR Hacking Forensic INVESTIGATOR TM v8 v8 Page: 2 Be the leader. Deserve a place in the CHFI certified elite class. Earn cutting edge

More information

EnCase 7 - Basic + Intermediate Topics

EnCase 7 - Basic + Intermediate Topics EnCase 7 - Basic + Intermediate Topics Course Objectives This 4 day class is designed to familiarize the student with the many artifacts left behind on Windows based media and how to conduct a forensic

More information

Digital Forensics. Module 4 CS 996

Digital Forensics. Module 4 CS 996 Digital Forensics Module 4 CS 996 Hard Drive Forensics Acquisition Bit for bit copy Write protect the evidence media EnCase for DOS Safeback (NTI: www.forensics-intl.com) Analysis EnCase FTK (www.accessdata.com)

More information

MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1

MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1 MSc Computer Security and Forensics Cohort: MCSF/09B/PT Examinations for 2009-2010 / Semester 1 MODULE: COMPUTER FORENSICS & CYBERCRIME MODULE CODE: SECU5101 Duration: 2 Hours Instructions to Candidates:

More information

Digital Forensics. Tom Pigg Executive Director Tennessee CSEC

Digital Forensics. Tom Pigg Executive Director Tennessee CSEC Digital Forensics Tom Pigg Executive Director Tennessee CSEC Definitions Digital forensics Involves obtaining and analyzing digital information as evidence in civil, criminal, or administrative cases Analyze

More information

Technical Procedure for Evidence Search

Technical Procedure for Evidence Search Technical Procedure for Evidence Search 1.0 Purpose - The purpose of this procedure is to provide a systematic means of searching digital evidence in order to find data sought by the search authorization.

More information

Computer Forensics Principles and Practices

Computer Forensics Principles and Practices Computer Forensics Principles and Practices by Volonino, Anzaldua, and Godwin Chapter 7: Investigating Windows, Linux, and Graphics Files Objectives Conduct efficient and effective investigations of Windows

More information

Course Title Penetration Testing: Procedures & Methodologies

Course Title Penetration Testing: Procedures & Methodologies Course Title Penetration Testing: Procedures & Methodologies Page 1 of 9 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base of topics

More information

Course Title: Penetration Testing: Network & Perimeter Testing

Course Title: Penetration Testing: Network & Perimeter Testing Course Title: Penetration Testing: Network & Perimeter Testing Page 1 of 7 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base of topics

More information

Forensics on the Windows Platform, Part Two

Forensics on the Windows Platform, Part Two 1 of 5 9/27/2006 3:52 PM Forensics on the Windows Platform, Part Two Jamie Morris 2003-02-11 Introduction This is the second of a two-part series of articles discussing the use of computer forensics in

More information

C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR

C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR 1 TM C HFI Computer C HFI Computer Hacking Forensic INVESTIGATOR Hacking Forensic INVESTIGATOR TM v8 v8 2 Be the leader. Deserve a place in the CHFI certified elite class. Earn cutting edge skills in computer

More information

Scene of the Cybercrime Second Edition. Michael Cross

Scene of the Cybercrime Second Edition. Michael Cross Scene of the Cybercrime Second Edition Michael Cross Chapter 1 Facing the Cybercrime Problem Head-On 1 Introduction 2 Defining Cybercrime 2 Understanding the Importance of Jurisdictional Issues 3 Quantifying

More information

Course Title: Disaster Recovery, 1st Edition

Course Title: Disaster Recovery, 1st Edition Course Title: Disaster Recovery, 1st Edition Page 1 of 8 Course Description: The DISASTER RECOVERY/VIRTUALIZATION SECURITY SERIES is comprised of two books that are designed to fortify disaster recovery

More information

Computer Intrusion Forensics Literature Review

Computer Intrusion Forensics Literature Review Computer Intrusion Forensics Literature Review Nathan Balon CIS 544 October 20, 2003 Title Computer Forensics: Incident Response Essentials by Warren G. Kruse II and Jay G. Heiser Reviewed by Nathan Balon

More information

Course Title: Penetration Testing: Network Threat Testing, 1st Edition

Course Title: Penetration Testing: Network Threat Testing, 1st Edition Course Title: Penetration Testing: Network Threat Testing, 1st Edition Page 1 of 6 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base

More information

Computer Hacking Forensic Investigator v8

Computer Hacking Forensic Investigator v8 CÔNG TY CỔ PHẦN TRƯỜNG CNTT TÂN ĐỨC TAN DUC INFORMATION TECHNOLOGY SCHOOL JSC LEARN MORE WITH LESS! Computer Hacking Forensic Investigator v8 Course Description: EC-Council releases the most advanced Computer

More information

Course Title: Penetration Testing: Communication Media Testing, 1st Edition

Course Title: Penetration Testing: Communication Media Testing, 1st Edition Course Title: Penetration Testing: Communication Media Testing, 1st Edition Page 1 of 6 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad

More information

Computer Forensics. Securing and Analysing Digital Information

Computer Forensics. Securing and Analysing Digital Information Computer Forensics Securing and Analysing Digital Information Aims What is a computer? Where is the evidence? Why is digital forensics important? Seizing evidence Encryption Hidden files and folders Live

More information

Computer Forensic Specialist. Course Title: Computer Forensic Specialist: Storage Device & Operating Systems

Computer Forensic Specialist. Course Title: Computer Forensic Specialist: Storage Device & Operating Systems Course Title: Computer Forensic Specialist: Storage Device & Operating Systems Page 1 of 14 Course Description The Computer Forensic Series by EC-Council provides the knowledge and skills to identify,

More information

Digital Forensics: The aftermath of hacking attacks. AHK Committee Meeting April 19 th, 2015 Eng. Jamal Abdulhaq Logos Networking FZ LLC

Digital Forensics: The aftermath of hacking attacks. AHK Committee Meeting April 19 th, 2015 Eng. Jamal Abdulhaq Logos Networking FZ LLC Digital Forensics: The aftermath of hacking attacks AHK Committee Meeting April 19 th, 2015 Eng. Jamal Abdulhaq Logos Networking FZ LLC Topics Digital Forensics: Brief introduction Case Studies Case I:

More information

Course Title: Virtualization Security, 1st Edition

Course Title: Virtualization Security, 1st Edition Course Title: Virtualization Security, 1st Edition Page 1 of 7 Virtualization Security Copyright by EC-Council Press Course Description: The DISASTER RECOVERY/VIRTUALIZATION SECURITY SERIES is comprised

More information

COWLEY COLLEGE & Area Vocational Technical School

COWLEY COLLEGE & Area Vocational Technical School COWLEY COLLEGE & Area Vocational Technical School COURSE PROCEDURE FOR Student Level: This course is open to students on the college level in either the freshman or sophomore year. Prerequisites: Basic

More information

information security and its Describe what drives the need for information security.

information security and its Describe what drives the need for information security. Computer Information Systems (Forensics Classes) Objectives for Course Challenges CIS 200 Intro to Info Security: Includes managerial and Describe information security and its critical role in business.

More information

COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL)

COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL) COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL) COURSE DESCRIPTION: Computer Forensics is focused on teaching

More information

Design and Implementation of a Live-analysis Digital Forensic System

Design and Implementation of a Live-analysis Digital Forensic System Design and Implementation of a Live-analysis Digital Forensic System Pei-Hua Yen Graduate Institute of Information and Computer Education, National Kaohsiung Normal University, Taiwan amber8520@gmail.com

More information

EnCase Portable. Extend Your Forensic Reach with Powerful Triage & Data Collection

EnCase Portable. Extend Your Forensic Reach with Powerful Triage & Data Collection GUIDANCE SOFTWARE EnCase Portable EnCase Portable Extend Your Forensic Reach with Powerful Triage & Data Collection GUIDANCE SOFTWARE EnCase Portable EnCase Portable Triage and Collect with EnCase Portable

More information

Chapter 4. Operating Systems and File Management

Chapter 4. Operating Systems and File Management Chapter 4 Operating Systems and File Management Chapter Contents Section A: Operating System Basics Section B: Today s Operating Systems Section C: File Basics Section D: File Management Section E: Backup

More information

Course Title: Penetration Testing: Security Analysis

Course Title: Penetration Testing: Security Analysis Course Title: Penetration Testing: Security Analysis Page 1 of 9 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base of topics in advanced

More information

Computer Forensics as an Integral Component of the Information Security Enterprise

Computer Forensics as an Integral Component of the Information Security Enterprise Computer Forensics as an Integral Component of the Information Security Enterprise By John Patzakis 10/28/03 I. EXECUTIVE SUMMARY In addition to fending off network intrusions and denial of service attacks,

More information

introducing COMPUTER ANTI FORENSIC TECHNIQUES

introducing COMPUTER ANTI FORENSIC TECHNIQUES introducing COMPUTER ANTI FORENSIC TECHNIQUES COMPUTER FORENSIC DATA RECOVERY TECHNIQUES AND SOLUTIONS WORKSHOP Executive Summary Computer Forensics, a term that precisely identifies the discipline that

More information

To Catch a Thief: Computer Forensics in the Classroom

To Catch a Thief: Computer Forensics in the Classroom To Catch a Thief: Computer Forensics in the Classroom Anna Carlin acarlin@csupomona.edu Steven S. Curl scurl@csupomona.edu Daniel Manson dmanson@csupomona.edu Computer Information Systems Department California

More information

Certified Digital Forensics Examiner

Certified Digital Forensics Examiner Cyber Security Training & Consulting Certified Digital COURSE OVERVIEW 5 Days 40 CPE Credits $3,000 Digital is the investigation and recovery of data contained in digital devices. This data is often the

More information

CERTIFIED DIGITAL FORENSICS EXAMINER

CERTIFIED DIGITAL FORENSICS EXAMINER CERTIFIED DIGITAL FORENSICS EXAMINER KEY DATA Course Title: C)DFE Duration: 5 days CPE Credits: 40 Class Format Options: Instructor-led classroom Live Online Training Computer Based Training Who Should

More information

Introduction to Computer Forensics ITP 499 (3 Units)

Introduction to Computer Forensics ITP 499 (3 Units) Introduction to Computer Forensics ITP 499 (3 Units) Description In 2007, the FBI reported that over 200 major companies reported a loss of over 60 million dollars due to computer crime. Computers are

More information

CDFE Certified Digital Forensics Examiner (CFED Replacement)

CDFE Certified Digital Forensics Examiner (CFED Replacement) Course: CDFE Certified Digital Forensics Examiner (CFED Replacement) Description: Price: $3,450.00 Category: Popular Courses Duration: 5 days Schedule: Request Dates Outline: COURSE OVERVIEW Computer Forensics

More information

Comparing and Contrasting Windows and Linux Forensics. Zlatko Jovanovic. International Academy of Design and Technology

Comparing and Contrasting Windows and Linux Forensics. Zlatko Jovanovic. International Academy of Design and Technology Comparing and Contrasting Windows and Linux Forensics Zlatko Jovanovic International Academy of Design and Technology Abstract Windows and Linux are the most common operating systems used on personal computers.

More information

Computer Forensic Capabilities

Computer Forensic Capabilities Computer Forensic Capabilities Agenda What is computer forensics? Where to find computer evidence Forensic imaging Forensic analysis What is Computer Forensics? The preservation, identification, extraction,

More information

Certified Cyber Security Analyst VS-1160

Certified Cyber Security Analyst VS-1160 VS-1160 Certified Cyber Security Analyst Certification Code VS-1160 Vskills certification for Cyber Security Analyst assesses the candidate as per the company s need for cyber security and forensics. The

More information

DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE. Vahidin Đaltur, Kemal Hajdarević,

DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE. Vahidin Đaltur, Kemal Hajdarević, DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE Vahidin Đaltur, Kemal Hajdarević, Internacional Burch University, Faculty of Information Technlogy 71000 Sarajevo, Bosnia

More information

Certified Digital Forensics Examiner

Certified Digital Forensics Examiner Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student

More information

Incident Response and Forensics

Incident Response and Forensics Incident Response and Forensics Yiman Jiang, President and Principle Consultant Sumus Technology Ltd. James Crooks, Manager - Advisory Services PricewaterhouseCoopers LLP UBC 2007-04-12 Outline Computer

More information

Certified Digital Forensics Examiner

Certified Digital Forensics Examiner Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student

More information

Reduce File Size. Compatibility. Contents

Reduce File Size. Compatibility. Contents Reduce File Size Revu provides a mechanism for reducing the size of some PDFs to make them more suitable for email or a Document Management System. This tool works by compressing bitmap images and removing

More information

PGP Desktop Email Quick Start Guide version 9.6

PGP Desktop Email Quick Start Guide version 9.6 What is PGP Desktop Email? PGP Desktop Email is part of the PGP Desktop family of products. You can use PGP Desktop Email to: Automatically and transparently encrypt, sign, decrypt, and verify email messages

More information

Incident Response and Computer Forensics

Incident Response and Computer Forensics Incident Response and Computer Forensics James L. Antonakos WhiteHat Forensics Incident Response Topics Why does an organization need a CSIRT? Who s on the team? Initial Steps Detailed Project Plan Incident

More information

NIST CFTT: Testing Disk Imaging Tools

NIST CFTT: Testing Disk Imaging Tools NIST CFTT: Testing Disk Imaging Tools James R. Lyle, Ph.D. Computer Scientist National Institute of Standards and Technology 1. Introduction There is a critical need in the law enforcement community to

More information

Understanding Backup and Recovery Methods

Understanding Backup and Recovery Methods Lesson 8 Understanding Backup and Recovery Methods Learning Objectives Students will learn to: Understand Local, Online, and Automated Backup Methods Understand Backup Options Understand System Restore

More information

Digital Forensics Tutorials Acquiring an Image with FTK Imager

Digital Forensics Tutorials Acquiring an Image with FTK Imager Digital Forensics Tutorials Acquiring an Image with FTK Imager Explanation Section Digital Forensics Definition The use of scientifically derived and proven methods toward the preservation, collection,

More information

The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices

The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices Introduction As organizations rely more heavily on technology-based methods of communication, many corporations

More information

Determining VHD s in Windows 7 Dustin Hurlbut

Determining VHD s in Windows 7 Dustin Hurlbut Introduction Windows 7 has the ability to create and mount virtual machines based upon launching a single file. The Virtual Hard Disk (VHD) format permits creation of virtual drives that can be used for

More information

Steganography Detection for Digital Forensics

Steganography Detection for Digital Forensics Sage LaTorra Digital Forensics Steganography Detection for Digital Forensics Steganography is the pursuit of cryptography that doesn't appear to be cryptography. In essence, steganography is hiding a message

More information

Computer and Network Forensics INF 528 (3 Units)

Computer and Network Forensics INF 528 (3 Units) Computer and Network Forensics INF 528 (3 Units) Fall 2014 Description According to the Internet Crimes Complaint Center Annual Report, in 2011, there were over 300,000 incidents reported to the organization,

More information

Chapter Contents. Operating System Activities. Operating System Basics. Operating System Activities. Operating System Activities 25/03/2014

Chapter Contents. Operating System Activities. Operating System Basics. Operating System Activities. Operating System Activities 25/03/2014 Chapter Contents Operating Systems and File Management Section A: Operating System Basics Section B: Today s Operating Systems Section C: File Basics Section D: File Management Section E: Backup Security

More information

Forensics source: Edward Fjellskål, NorCERT, Nasjonal sikkerhetsmyndighet (NSM)

Forensics source: Edward Fjellskål, NorCERT, Nasjonal sikkerhetsmyndighet (NSM) s Unix Definition of : Computer Coherent application of a methodical investigatory techniques to solve crime cases. Forensics source: Edward Fjellskål, NorCERT, Nasjonal sikkerhetsmyndighet (NSM) s Unix

More information

16.4.3 Optional Lab: Data Backup and Recovery in Windows Vista

16.4.3 Optional Lab: Data Backup and Recovery in Windows Vista 16.4.3 Optional Lab: Data Backup and Recovery in Windows Vista Introduction Print and complete this lab. In this lab, you will back up data. You will also perform a recovery of the data. Recommended Equipment

More information

Forensically Determining the Presence and Use of Virtual Machines in Windows 7

Forensically Determining the Presence and Use of Virtual Machines in Windows 7 Forensically Determining the Presence and Use of Virtual Machines in Windows 7 Introduction Dustin Hurlbut Windows 7 has the ability to create and mount virtual machines based upon launching a single file.

More information

What is Digital Forensics?

What is Digital Forensics? DEVELOPING AN UNDERGRADUATE COURSE IN DIGITAL FORENSICS Warren Harrison PSU Center for Information Assurance Portland State University Portland, Oregon 97207 warren@cs.pdx.edu What is Digital Forensics?

More information

CYBER FORENSICS (W/LAB) Course Syllabus

CYBER FORENSICS (W/LAB) Course Syllabus 6111 E. Skelly Drive P. O. Box 477200 Tulsa, OK 74147-7200 CYBER FORENSICS (W/LAB) Course Syllabus Course Number: CSFS-0020 OHLAP Credit: Yes OCAS Code: 8134 Course Length: 130 Hours Career Cluster: Information

More information

Active @ UNDELETE Users Guide

Active @ UNDELETE Users Guide Active @ UNDELETE Users Guide Contents 2 Contents Legal Statement...5 Active@ UNDELETE Overview... 6 Getting Started with Active@ UNDELETE... 7 Active@ UNDELETE Views And Windows... 7 Recovery Explorer

More information

AN INVESTIGATION INTO COMPUTER FORENSIC TOOLS

AN INVESTIGATION INTO COMPUTER FORENSIC TOOLS AN INVESTIGATION INTO COMPUTER FORENSIC TOOLS K.K. Arthur 1 H.S. Venter 2 Information and Computer Security Architectures (ICSA) Research Group University of Pretoria Pretoria Department of Computer Science

More information

Chapter 11 Security+ Guide to Network Security Fundamentals, Third Edition Basic Cryptography

Chapter 11 Security+ Guide to Network Security Fundamentals, Third Edition Basic Cryptography Chapter 11 Security+ Guide to Network Security Fundamentals, Third Edition Basic Cryptography What Is Steganography? Steganography Process of hiding the existence of the data within another file Example:

More information

Digital Forensic. A newsletter for IT Professionals. I. Background of Digital Forensic. Definition of Digital Forensic

Digital Forensic. A newsletter for IT Professionals. I. Background of Digital Forensic. Definition of Digital Forensic I Digital Forensic A newsletter for IT Professionals Education Sector Updates Issue 10 I. Background of Digital Forensic Definition of Digital Forensic Digital forensic involves the collection and analysis

More information

CTC 328: Computer Forensics

CTC 328: Computer Forensics FALL 2010 CSUDH COMPUTER SCIENCE DEPARTMENT CTC 328: Computer Forensics Instructor: Adam Kaplan, Ph.D. E-Mail: akaplan@csudh.edu Office: NSM E-117 WWW (Blackboard Site): http://toro.csudh.edu Class Meetings:

More information

Digital evidence obfuscation: recovery techniques

Digital evidence obfuscation: recovery techniques To appear in Proceedings of the Society for Optical Engineering Conference. Orlando, FL. Digital evidence obfuscation: recovery techniques J. Philip Craiger* a, Jeff Swauger b, Chris Marberry b a National

More information

ITM 642: Digital Forensics Sanjay Goel School of Business University at Albany, State University of New York

ITM 642: Digital Forensics Sanjay Goel School of Business University at Albany, State University of New York INSTRUCTOR INFORMATION Name: Sanjay Goel Email: goel@albany.edu Phone: (518) 442-4925 Office Location: BA 310b, University at Albany Office Hours: TBD CLASS INFORMATION Time: N/A Location: Online Dates:

More information

Digital Forensics. Dr. Vic Fay-Wolfe Department of Computer Science University of Rhode Island

Digital Forensics. Dr. Vic Fay-Wolfe Department of Computer Science University of Rhode Island Digital Forensics Dr. Vic Fay-Wolfe Department of Computer Science University of Rhode Island Topics What is Digital Forensics? Cases Digital Forensics Practice Algorithms and Computer Sci Digital Forensics

More information

PGP Whole Disk Encryption Quick Start Guide Version 9.8

PGP Whole Disk Encryption Quick Start Guide Version 9.8 PGP Whole Disk Encryption Quick Start Guide Version 9.8 What is PGP Whole Disk Encryption? The PGP Whole Disk Encryption (WDE) product is a software tool that provides multiple ways to protect your data

More information

Symantec File Share Encryption Quick Start Guide Version 10.3

Symantec File Share Encryption Quick Start Guide Version 10.3 Symantec File Share Encryption Quick Start Guide Version 10.3 What is Symantec File Share Encryption? Symantec File Share Encryption is a software tool that provides multiple ways to protect and share

More information

RE: School of Computer Forensic Investigation, Class 7, Eastern Michigan University

RE: School of Computer Forensic Investigation, Class 7, Eastern Michigan University December 12, 2006 RE: School of Computer Forensic Investigation, Class 7, Eastern Michigan University Dear Applicant Agency: The Center for Regional and National Security are pleased to announce the seventh

More information

INCIDENT RESPONSE & COMPUTER FORENSICS, SECOND EDITION

INCIDENT RESPONSE & COMPUTER FORENSICS, SECOND EDITION " - * INCIDENT RESPONSE & COMPUTER FORENSICS, SECOND EDITION CHRIS PROSISE KEVIN MANDIA McGraw-Hill /Osborne New York Chicago San Francisco Lisbon London Madrid Mexico City Milan New Delhi San Juan Seoul

More information

Open Source Digital Forensics Tools

Open Source Digital Forensics Tools The Legal Argument 1 carrier@cerias.purdue.edu Abstract This paper addresses digital forensic analysis tools and their use in a legal setting. To enter scientific evidence into a United States court, a

More information

ShadowStor, Inc. Leading the Way to Safer Computing 2003, All Rights Reserved. ShadowStor, ShadowUser, ShadowServer and ShadowMode are trademarks of

ShadowStor, Inc. Leading the Way to Safer Computing 2003, All Rights Reserved. ShadowStor, ShadowUser, ShadowServer and ShadowMode are trademarks of SHADOWSTOR COMPETITIVE ADVANTAGE PAPER are trademarks of ShadowStor, Inc. ShadowStor Introduction Providing Security, Data Protection and Disaster Prevention Solutions ShadowStor solutions provide a new

More information

Can Computer Investigations Survive Windows XP?

Can Computer Investigations Survive Windows XP? Can Computer Investigations Survive? An Examination of Microsoft and its Effect on Computer Forensics December 2001 by Kimberly Stone and Richard Keightley 2001 Guidance Software All Rights Reserved Executive

More information

PGP Whole Disk Encryption Quick Start Guide version 9.6

PGP Whole Disk Encryption Quick Start Guide version 9.6 PGP Whole Disk Encryption Quick Start Guide version 9. What is PGP Whole Disk Encryption? The PGP Whole Disk Encryption (WDE) product is a software tool that provides multiple ways to protect your data

More information

Developing Computer Forensics Solutions for Terabyte Investigations

Developing Computer Forensics Solutions for Terabyte Investigations Developing Computer Forensics Solutions for Terabyte Investigations Eric Thompson Corporation Orem, Utah USA www.accessdata.com Overview Computer Forensic Definition, Objectives and Policies History of

More information

Legal Notices. AccessData Corp.

Legal Notices. AccessData Corp. Legal Notices AccessData Corp. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability

More information

Where is computer forensics used?

Where is computer forensics used? What is computer forensics? The preservation, recovery, analysis and reporting of digital artifacts including information stored on computers, storage media (such as a hard disk or CD-ROM), an electronic

More information

Computer Forensics: Permanent Erasing

Computer Forensics: Permanent Erasing Computer Forensics: Permanent Erasing Prepared By : Yousef T. Aburabie and Mohamd Alomari Supervised By: Dr. Lo ai Tawalbeh, New York Institute of Technology (NYIT)-Jordan s campus-2006 Introduction "Delete"

More information

Using Linux VMware and SMART to Create a Virtual Computer to Recreate a Suspect's Computer. By:

Using Linux VMware and SMART to Create a Virtual Computer to Recreate a Suspect's Computer. By: Using Linux VMware and SMART to Create a Virtual Computer to Recreate a Suspect's Computer By: Senior Special Agent Ernest Baca United States Customs Service Office of Investigations Resident Agent in

More information

A+ Guide to Software: Managing, Maintaining, and Troubleshooting, 5e. Chapter 3 Installing Windows

A+ Guide to Software: Managing, Maintaining, and Troubleshooting, 5e. Chapter 3 Installing Windows : Managing, Maintaining, and Troubleshooting, 5e Chapter 3 Installing Windows Objectives How to plan a Windows installation How to install Windows Vista How to install Windows XP How to install Windows

More information

Digital Forensic Techniques

Digital Forensic Techniques Digital Forensic Techniques Namrata Choudhury, Sr. Principal Information Security Analyst, Symantec Corporation Professional Techniques T23 CRISC CGEIT CISM CISA AGENDA Computer Forensics vs. Digital Forensics

More information

Acronis True Image 2015 REVIEWERS GUIDE

Acronis True Image 2015 REVIEWERS GUIDE Acronis True Image 2015 REVIEWERS GUIDE Table of Contents INTRODUCTION... 3 What is Acronis True Image 2015?... 3 System Requirements... 4 INSTALLATION... 5 Downloading and Installing Acronis True Image

More information

FORENSIC ANALYSIS OF USB MEDIA EVIDENCE. Jesús Alexander García. Luis Alejandro Franco. Juan David Urrea. Carlos Alfonso Torres

FORENSIC ANALYSIS OF USB MEDIA EVIDENCE. Jesús Alexander García. Luis Alejandro Franco. Juan David Urrea. Carlos Alfonso Torres FORENSIC ANALYSIS OF USB MEDIA EVIDENCE Jesús Alexander García Luis Alejandro Franco Juan David Urrea Carlos Alfonso Torres Manuel Fernando Gutiérrez UPB 2012 Content INTRODUCTION... 3 OBJECTIVE 4 EVIDENCE

More information

COURSE OUTLINE TEMPLATE (Computer Forensics CFR 712S)

COURSE OUTLINE TEMPLATE (Computer Forensics CFR 712S) Faculty Name Mr. Isaac Nhamu Name of Department COMPUTER SCIENCE COURSE OUTLINE TEMPLATE (Computer Forensics CFR 712S) STATEMENT ABOUT ACADEMIC HONESTY AND INTEGRITY All staff and students of the Namibia

More information

10.3.1.5 Lab - Data Backup and Recovery in Windows Vista

10.3.1.5 Lab - Data Backup and Recovery in Windows Vista 5.0 10.3.1.5 Lab - Data Backup and Recovery in Windows Vista Introduction Print and complete this lab. In this lab, you will back up data. You will also perform a recovery of the data. Recommended Equipment

More information

Universität Mannheim Praktische Informatik I

Universität Mannheim Praktische Informatik I Universität Mannheim Praktische Informatik I 21.03.2007 Examining and imaging data on running systems using LiveWire" Steven W. Wood Master of Science (Florida Institute of Technology) ALSTE Technologies

More information

Computer Forensics introduction part A

Computer Forensics introduction part A Computer Forensics introduction part A Dr. Magdalena Szeżyńska, CISA Institute of Electronic Systems WUT m.szezynska@elka.pw.edu.pl Summer 2016 Digital Forensic Investigation Concepts A digital investigation

More information

DoD Cyber Crime Center

DoD Cyber Crime Center DoD Cyber Crime Center (DC3) Digital Forensics Challenge 2013 Team Northrop Grumman April 30, 2014 Jesse Mayer Northrop Grumman Cyber Security Operations Center DC3 Digital Forensics Challenge Annual Competition

More information

Digital Forensics Tutorials Acquiring an Image with Kali dcfldd

Digital Forensics Tutorials Acquiring an Image with Kali dcfldd Digital Forensics Tutorials Acquiring an Image with Kali dcfldd Explanation Section Disk Imaging Definition Disk images are used to transfer a hard drive s contents for various reasons. A disk image can

More information

Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation

Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation Computer Forensics and Digital Investigation Computer Security EDA263, lecture 14 Ulf Larson Lecture outline! Introduction to Computer Forensics! Digital investigation! Conducting a Digital Crime Scene

More information

Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers

Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers Brian Carrier Research Scientist @stake Abstract This paper uses the theory of abstraction layers to describe the purpose

More information

Active @ UNDELETE Users Guide

Active @ UNDELETE Users Guide Active @ UNDELETE Users Guide Contents 2 Contents Legal Statement...5 Active@ UNDELETE Overview... 6 Getting Started with Active@ UNDELETE... 7 Active@ UNDELETE Views And Windows... 7 Recovery Explorer

More information

Discovery of Electronically Stored Information ECBA conference Tallinn October 2012

Discovery of Electronically Stored Information ECBA conference Tallinn October 2012 Discovery of Electronically Stored Information ECBA conference Tallinn October 2012 Jan Balatka, Deloitte Czech Republic, Analytic & Forensic Technology unit Agenda Introduction ediscovery investigation

More information