Deleted File Recovery Tool Testing Results
|
|
|
- Willa Clark
- 8 years ago
- Views:
Transcription
1 Deleted File Recovery Tool Testing Results Jim Lyle NIST 1 AAFS Washington
2 CFTT Develop specifications for testing forensic tools Disk Imaging Write Blocking Drive erase for reuse Metadata based deleted file recovery Other specs in development Submit test reports to NIJ for publication ~90 AAFS Washington 2
3 Deleted File Recovery Deleted file recovery (DFR) Metadata based (from directory, i node, MFT, etc.) now Signature based (aka file carving) next Tested six popular tools Test reports are being drafted for publication later this year AAFS Washington 3
4 Talk Goals The presentation will impact the forensic community by: increase awareness in the community of ability of tool testing to reveal anomalies in tool behavior help the forensic practitioner recognize tool limitations AAFS Washington 4
5 Remainder of Talk Metadata relationships Test suite Identifying Supported file systems Consider if there is fragmentation, but intact Overwriting Chaos Summary AAFS Washington 5
6 Metadata relationships with data Active Metadata Data Residual Metadata Active Metadata Data Residual Metadata Data Active Metadata Data Residual Metadata Residual Metadata Data Residual Metadata AAFS Washington 6
7 17 BaseTest Cases DFR 01. DFR 02. DFR 03. DFR 04. names. DFR 05. DFR 06. DFR 07. DFR 08. DFR 09. Recover one non fragmented file. Recover file with two fragments. Recover file with multiple frags. Recover files with non ASCII Recover several fragmented files. Recover one large file. Recover one overwritten file. Recover several overwritten files. Recover 1000 files no overwrite. DFR 10. DFR 11. DFR 12. DFR 13. DFR 14. DFR 15. DFR 16. DFR 17. Recover 1000 files, overwritten. Recover one directory. Recover multiple directories. Recover random activity. Recover other file system object. List one of each object. List a large number of files. List deep file paths. At least 4 images per case: 1. FAT: FAT12, FAT16 & FAT32 2. ExFAT 3. NTFS 4. EXT: ext2, ext3 & ext4 Some one off images: NTFS compressed NTFS file in MFT HFS+ file listing Recycle bin/trash can AAFS Washington 7
8 Supported File Systems Determine supported file systems by trying a simple case Delete a single file, see if the six tools recovers anything FS ext2 ext3 ext4 FAT NTFS ExFAT HFS+ AAFS Washington 8
9 FAT Fragmentation Case FAT 03 Recover a file in 4 fragments Layout: A, C, D & E are active files; B is deleted A B1 C B2 D B3 E B4 Results: Three tools recovered entire file One tool stopped after first cluster One tool included part of an active file One tool recovered two fragments and two clusters from active files Tool Recovered File 1 B1 B2 B3 B4 2 B1 3 B1 C(1) 4 B1 B2 B3 B4 5 B1 B2 B3 B4 6 B1 C B2 D AAFS Washington 9
10 Fragmentation Other File Systems NTFS Well behaved Ext2 recovered where supported One tool had trouble with ext2 FS FAT 1 1A 2AM ExFAT NTFS ext2 2 not supported not recovered recovered Other partial recovery AAFS Washington 10
11 Summary for non overwriting Cases # recovered / # deleted FS FAT 807/ / / / / /819 ExFAT 270/ / / /273 NTFS 273/ / / / / /273 ext 264/ / / / / /273 Best results on NTFS, all files recovered by all tools Some tools miss a few files from ext2 All tools miss a few files from ExFAT AAFS Washington 11
12 Anomalies for non overwriting Cases by data source # multi src / # other src / # Active file FS FAT 9/0/0 6/0/0 27/3/18 9/0/0 12/0/3 24/0/18 ExFAT 0/0/1 10/0/10 8/0/8 0/0/0 NTFS 0/0/1 0/0/0 23/0/23 0/0/0 0/1/0 0/0/0 ext2 0/0/0 0/0/0 0/0/0 0/0/0 0/0/0 0/0/0 Except for one file recovered by tool #5, and 3 recovered by tool #3, all recovered content came for current or previous files Tool #3 recovered 296 of 273 deleted NTFS files AAFS Washington 12
13 Overwrite Cases: Data & Metadata Available Metadata and File Block Summary Metadata Exists Metadata Overwritten Case Deleted Intact Partial None Intact Partial None FAT ExFAT NTFS EXT
14 Summary for Overwriting Cases # intact files with metadata / # deleted FS FAT (1118/2894) ExFAT (376/965) NTFS (371/965) Ext (408/956) Best results on FAT & NTFS One tool showed poor results for ext2 Results for ExFAT vary AAFS Washington 14
15 Anomalies for overwriting Cases by data source # multi src / # other src / # Active file FS FAT 304/4/41 183/3/41 309/66/ /3/0 269/3/40 297/81/197 ExFAT 18/14/16 95/7/94 89/10/88 18/18/16 NTFS 24/2/24 21/24/0 29/0/29 21/14/6 24/2/24 24/0/24 ext2 107/52/9 25/26/0 431/17/426 16/8/17 29/56/162 29/17/24 Lots of recovered files include data from more than one source NTFS seems best behaved AAFS Washington 15
16 Summary The residual metadata varies with the file system. For example, file names may be completely or partially lost, pointers to file blocks may be overwritten. Only the first block of a deleted file is identified for FAT file systems. Some tools guess the location of the remainder of the deleted file; this strategy often leads to recovered files that are mixed from several original files. The tools sometimes include blocks from active files in a recovered file. The tools rarely include blocks that have never been allocated to the current file system, i.e., it is not likely that a block from a recovered file was not a part of some file. Some tools attempt to identify overwritten files. The tools often identify (incorrectly) intact files as overwritten. Support for ExFAT, ext3 and ext4 is sometimes lacking. AAFS Washington 16
17 Project Sponsors (aka Steering Committee) National Institute of Justice (Major funding) Homeland Security (Major funding) FBI (Additional funding) Department of Defense, DCCI (Equipment and support) State & Local agencies (Technical input) Other federal agencies (Technical input) NIST/OLES (Program management) AAFS Washington 17
18 Disclaimer Certain trade names and company products are mentioned in the text or identified. In no case does such identification imply recommendation or endorsement by the National Institute of Standards and Technology, nor does it imply that the products are necessarily the best available for the purpose. AAFS Washington 18
19 Contact Information Jim Lyle Sue Ballou, Office of Law Enforcement Standards Steering Committee representative for State/Local Law Enforcement AAFS -- Washington 19
The Contribution of Tool Testing to the Challenge of Responding to an IT Adversary
The Contribution of Tool Testing to the Challenge of Responding to an IT Adversary Jim Lyle National Institute of Standards and Technology 23 October 2006 10/18/2006 1 DISCLAIMER Certain trade names and
Federated Testing: Well-Tested Tools, Shared Test Materials & Shared Test. Reports; The Computer Forensics Tool Catalog Website: Connecting
Federated Testing: Well-Tested Tools, Shared Test Materials & Shared Test Reports; The Computer Forensics Tool Catalog Website: Connecting Forensic Examiners With the Tools They Need U.S. Cyber Crime Conference
NIST CFTT: Testing Disk Imaging Tools
NIST CFTT: Testing Disk Imaging Tools James R. Lyle, Ph.D. Computer Scientist National Institute of Standards and Technology 1. Introduction There is a critical need in the law enforcement community to
Recover My Files v5.2.1. Test Results for Video File Carving Tool
Recover My Files v5.2.1 Test Results for Video File Carving Tool October 22, 2014 This report w as prepared for the Department of Homeland Security Science and Technology Directorate Cyber Security Division
Mobile Device Forensics. Rick Ayers
Mobile Device Forensics Rick Ayers Disclaimer Certain commercial entities, equipment, or materials may be identified in this presentation in order to describe an experimental procedure or concept adequately.
Can Computer Investigations Survive Windows XP?
Can Computer Investigations Survive? An Examination of Microsoft and its Effect on Computer Forensics December 2001 by Kimberly Stone and Richard Keightley 2001 Guidance Software All Rights Reserved Executive
Help System. Table of Contents
Help System Table of Contents 1 INTRODUCTION...1 2 GETTING STARTED!... 2 2.1 Installation...2 2.2 Wizard...3 2.3 Browse Method:...7 2.4 Search Method:...7 2.5 Surface Scan Method:... 8 3 RECOVERING DELETED
Digital Forensics at the National Institute of Standards and Technology
NISTIR 7490 Digital Forensics at the National Institute of Standards and Technology James R. Lyle Douglas R. White Richard P. Ayers NISTIR 7490 Digital Forensics at the National Institute of Standards
File System Forensics FAT and NTFS. Copyright Priscilla Oppenheimer 1
File System Forensics FAT and NTFS 1 FAT File Systems 2 File Allocation Table (FAT) File Systems Simple and common Primary file system for DOS and Windows 9x Can be used with Windows NT, 2000, and XP New
Practice Exercise March 7, 2016
DIGITAL FORENSICS Practice Exercise March 7, 2016 Prepared by Leidos CyberPatriot Forensics Challenge 1 Forensics Instruction Guide Introduction The goal of this event is to learn to identify key factors
New Technologies File System (NTFS) Priscilla Oppenheimer. Copyright 2008 Priscilla Oppenheimer
New Technologies File System (NTFS) Priscilla Oppenheimer NTFS Default file system for Windows NT, 2000, XP, and Windows Server 2003 No published spec from Microsoft that describes the on-disk layout Good
File System Management
Lecture 7: Storage Management File System Management Contents Non volatile memory Tape, HDD, SSD Files & File System Interface Directories & their Organization File System Implementation Disk Space Allocation
File Recovery: Find Files You Thought Were Lost F 2/1. Clever Tricks to Recover Deleted Files Even if They ve Been Emptied from the Recycle Bin!
File Recovery: Find Files You Thought Were Lost F 2/1 Clever Tricks to Recover Deleted Files Even if They ve Been Emptied from the Recycle Bin! With the information in this article you can: Save yourself
Computer Forensics: Permanent Erasing
Computer Forensics: Permanent Erasing Prepared By : Yousef T. Aburabie and Mohamd Alomari Supervised By: Dr. Lo ai Tawalbeh, New York Institute of Technology (NYIT)-Jordan s campus-2006 Introduction "Delete"
BACKUP & RESTORE (FILE SYSTEM)
Table of Contents Table of Contents... 1 Perform a Backup (File System)... 1 What Gets Backed Up... 2 What Does Not Get Backed Up... 3 Perform a Restore... 4 Perform a Backup (File System) The following
Using the HFSD journal for deleted file recovery
available at www.sciencedirect.com journal homepage: www.elsevier.com/locate/diin Using the HFSD journal for deleted file recovery Aaron Burghardt*, Adam J. Feldman Booz Allen Hamilton, Herndon, VA 20171,
EnCase 7 - Basic + Intermediate Topics
EnCase 7 - Basic + Intermediate Topics Course Objectives This 4 day class is designed to familiarize the student with the many artifacts left behind on Windows based media and how to conduct a forensic
Welcome to new students seminar!! Security is a people problem. forensic proof.com proneer.tistory.com. @pr0neer JK Kim
Welcome to new students seminar!! Data Recovery Security is a people problem proneer.tistory.com proneer@gmail.com @pr0neer JK Kim Outline Data & Recording Method Definition & Classification Recovering
NTFS Undelete User Manual
NTFS Undelete User Manual What is NTFS Undelete? NTFS Undelete is a small utility that scans your hard drive for all files that can be undeleted and attempts to recover them for you. Sounds like magic?
Chapter Contents. Operating System Activities. Operating System Basics. Operating System Activities. Operating System Activities 25/03/2014
Chapter Contents Operating Systems and File Management Section A: Operating System Basics Section B: Today s Operating Systems Section C: File Basics Section D: File Management Section E: Backup Security
Recover data from a defective Fujitsu desktop drive
Data Compass - Case Study Recover data from a defective Fujitsu desktop drive Symptom: Data on the Fujitsu desktop drive is not accessible directly by the client. The initial diagnosis implies that the
Active @ UNDELETE Users Guide
Active @ UNDELETE Users Guide Contents 2 Contents Legal Statement...5 Active@ UNDELETE Overview... 6 Getting Started with Active@ UNDELETE... 7 Active@ UNDELETE Views And Windows... 7 Recovery Explorer
Forensic Decryption of FAT BitLocker Volumes
Forensic Decryption of FAT BitLocker Volumes P. Shabana Subair, C. Balan (&), S. Dija, and K.L. Thomas Centre for Development of Advanced Computing, PO Box 6520, Vellayambalam, Thiruvananthapuram 695033,
DATA RECOVERY FUNCTION TESTING FOR DIGITAL FORENSIC TOOLS
Chapter 21 DATA RECOVERY FUNCTION TESTING FOR DIGITAL FORENSIC TOOLS Yinghua Guo and Jill Slay Abstract Many digital forensic tools used by investigators were not originally designed for forensic applications.
HAVE YOUR COMPUTER FORENSICS TOOLS BEEN TESTED?
Contact: James Lyle Computer Forensics Tool Testing Program Office of Law Enforcement Standards National Institute of Standards and Technology HAVE YOUR COMPUTER FORENSICS TOOLS BEEN TESTED? NIJ, DHS,
RecoverIt Frequently Asked Questions
RecoverIt Frequently Asked Questions Windows Recovery FAQs When can I use Windows Recovery application? This application is used to recover the deleted files from internal or external storage devices with
Open Source Data Recovery
Open Source Data Recovery Options and Techniques CALUG MEETING October 2008 !! Disclaimer!! This presentation is not sponsored by any organization of the US Government I am here representing only myself
Form #57, Revision #4 Date 7/15/2015 Data Destruction and Sanitation Program. Mobile (ON-SITE) Data Destruction/Shredding Services
Data Destruction and Sanitation Program Mobile (ON-SITE) Data Destruction/Shredding Services 1 Diversified Recycling utilizes state of the art equipment for their data destruction and eradication services.
Chapter 12 File Management
Operating Systems: Internals and Design Principles, 6/E William Stallings Chapter 12 File Management Dave Bremer Otago Polytechnic, N.Z. 2008, Prentice Hall Roadmap Overview File organisation and Access
Chapter 12 File Management. Roadmap
Operating Systems: Internals and Design Principles, 6/E William Stallings Chapter 12 File Management Dave Bremer Otago Polytechnic, N.Z. 2008, Prentice Hall Overview Roadmap File organisation and Access
Lecture 18: Reliable Storage
CS 422/522 Design & Implementation of Operating Systems Lecture 18: Reliable Storage Zhong Shao Dept. of Computer Science Yale University Acknowledgement: some slides are taken from previous versions of
Incident Response and Computer Forensics
Incident Response and Computer Forensics James L. Antonakos WhiteHat Forensics Incident Response Topics Why does an organization need a CSIRT? Who s on the team? Initial Steps Detailed Project Plan Incident
QUICK RECOVERY FOR RAID
Quick Recovery for RAID Features File Systems Supported Who suffers most Recovery Modes De-Stripper File Recovery Frequently Asked Questions QUICK RECOVERY FOR RAID Quick Recovery for RAID 0, RAID 5. Quick
4 II. Installation. 6 III. Interface specification. 9 1. Partition selection view. 9 1.1. Partition selection panel. 9 1.2.
Contents 2 I. Introduction 4 II. Installation 6 9 1. Partition selection view 9 1.1. Partition selection panel 9 1.2. Information panel 11 1.2.1. Current configuration 11 1.2.2. Storage information 12
Data recovery Data management Electronic Evidence
Data recovery Data management Electronic Evidence 2 RAID, SAN and Virtual systems RAID, SAN and Virtual systems Data Loss Scenarios: RAID Recovery drive failure Deleted VM recovery Reinstall of ESX on
Just EnCase. Presented By Larry Russell CalCPA State Technology Committee May 18, 2012
Just EnCase Presented By Larry Russell CalCPA State Technology Committee May 18, 2012 What is e-discovery Electronically Stored Information (ESI) Discover or Monitor for Fraudulent Activity Tools used
RECOVERING FROM SHAMOON
Executive Summary Fidelis Threat Advisory #1007 RECOVERING FROM SHAMOON November 1, 2012 Document Status: FINAL Last Revised: 2012-11-01 The Shamoon malware has received considerable coverage in the past
COMPUTER FORENSICS. DAVORY: : DATA RECOVERY
COMPUTER FORENSICS. DAVORY: : DATA RECOVERY Supervised By: Dr. Lo ai Tawalbeh New York Institute of Technology (NYIT)-Amman-2006 TOPICS Definition Recovery from what?? Davory SOFTWARE. Restore Software.
Recover My Files v5. Chapter Contents. Published: 18 March 2013 at 12:52:56. Frequently Asked questions... 5. Data Recovery Fundamentals...
Recover My Files v5 Chapter Contents Published: 18 March 2013 at 12:52:56 Frequently Asked questions... 5 Data Recovery Fundamentals... 9 Hardware Recovery... 10 Software Recovery... 11 Chapter 1 Introducing
Active @ UNDELETE Users Guide
Active @ UNDELETE Users Guide Contents 2 Contents Legal Statement...5 Active@ UNDELETE Overview... 6 Getting Started with Active@ UNDELETE... 7 Active@ UNDELETE Views And Windows... 7 Recovery Explorer
Crash Proof - Data Loss Prevention
Crash Proof - Data Loss Prevention Software Crash Proof - Data Loss Prevention Crash Proof is data loss prevention software which once installed revives 100% data in the event of a data loss situation.
CHAPTER 17: File Management
CHAPTER 17: File Management The Architecture of Computer Hardware, Systems Software & Networking: An Information Technology Approach 4th Edition, Irv Englander John Wiley and Sons 2010 PowerPoint slides
Chapter 4. Operating Systems and File Management
Chapter 4 Operating Systems and File Management Chapter Contents Section A: Operating System Basics Section B: Today s Operating Systems Section C: File Basics Section D: File Management Section E: Backup
David Cowen Matthew Seyer G-C Partners, LLC
David Cowen Matthew Seyer G-C Partners, LLC Records File System Metadata Changes Optionally Can Retain More Depending on File System Options Allows File System to Return to a Clean State Allows an examiner
File Systems for Flash Memories. Marcela Zuluaga Sebastian Isaza Dante Rodriguez
File Systems for Flash Memories Marcela Zuluaga Sebastian Isaza Dante Rodriguez Outline Introduction to Flash Memories Introduction to File Systems File Systems for Flash Memories YAFFS (Yet Another Flash
Discovery of Electronically Stored Information ECBA conference Tallinn October 2012
Discovery of Electronically Stored Information ECBA conference Tallinn October 2012 Jan Balatka, Deloitte Czech Republic, Analytic & Forensic Technology unit Agenda Introduction ediscovery investigation
ipod Forensics Update
Abstract ipod Forensics Update Matthew Kiley Tim Shinbara Marcus Rogers Purdue University Cyber Forensics Laboratory Department of Computer and Information Technology Purdue University From student to
Q. If I purchase a product activation key on-line, how long will it take to be sent to me?
Page 1 of 6 Frequently Asked Questions (FAQ) Q. If I purchase a product activation key on-line, how long will it take to be sent to me? A. When you purchase on-line your product activation key is provided
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065 Introduction The Computer Forensics and Investigation course presents methods to properly conduct a computer forensics investigation
Bringing Science to Digital Forensics with Standardized Forensic Corpora.
Bringing Science to Digital Forensics with Standardized Forensic Corpora. Digital Evaluation and Exploitation (DEEP) Group http://domex.nps.edu/ February 2010 1 NPS is the Navyʼs Research University. Location:
Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers
Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers Brian Carrier Research Scientist @stake Abstract This paper uses the theory of abstraction layers to describe the purpose
Empirical Analysis of Solid State Disk Data Retention when used with Contemporary Operating Systems
DIGITAL FORENSIC RESEARCH CONFERENCE Empirical Analysis of Solid State Disk Data Retention when used with Contemporary Operating Systems By Christopher King and Timothy Vidas Presented At The Digital Forensic
Alternate Data Streams in Forensic Investigations of File Systems Backups
Alternate Data Streams in Forensic Investigations of File Systems Backups Derek Bem and Ewa Z. Huebner School of Computing and Mathematics University of Western Sydney d.bem@cit.uws.edu.au and e.huebner@cit.uws.edu.au
Comparing and Contrasting Windows and Linux Forensics. Zlatko Jovanovic. International Academy of Design and Technology
Comparing and Contrasting Windows and Linux Forensics Zlatko Jovanovic International Academy of Design and Technology Abstract Windows and Linux are the most common operating systems used on personal computers.
A Forensic Comparison of NTFS and FAT32 File Systems
MARSHALL UNIVERSITY FORENSIC SCIENCE CENTER & FBI, HEART OF AMERICA REGIONAL COMPUTER FORENSICS LABORATORY A Forensic Comparison of NTFS and FAT32 File Systems Summer 2012 Kelsey Laine Rusbarsky #901-60-8173
COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL)
COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL) COURSE DESCRIPTION: Computer Forensics is focused on teaching
www.cadatarecovery.net
CA DATA RECOVERY, INC. 980 9 th street, 16 th floor Sacramento California 95814 (916) 825-2220 ph. (916) 405-4411 fax REQUEST FOR SERVICE Non-Server, Individual drive DATE CUSTOMER NAME COMPANY NAME PHONE
FAQ for USB Flash Drive
FAQ for USB Flash Drive 1. What is a USB Flash Drive? A USB Flash Drive consists of a flash memory data storage device integrated with a USB interface. USB Flash Drives are typically removable and rewritable.
Windows OS File Systems
Windows OS File Systems MS-DOS and Windows 95/98/NT/2000/XP allow use of FAT-16 or FAT-32. Windows NT/2000/XP uses NTFS (NT File System) File Allocation Table (FAT) Not used so much, but look at as a contrast
File Systems Management and Examples
File Systems Management and Examples Today! Efficiency, performance, recovery! Examples Next! Distributed systems Disk space management! Once decided to store a file as sequence of blocks What s the size
Digital Forensics Lecture 3. Hard Disk Drive (HDD) Media Forensics
Digital Forensics Lecture 3 Hard Disk Drive (HDD) Media Forensics Current, Relevant Topics defendants should not use disk-cleaning utilities to wipe portions of their hard drives before turning them over
Data Storage on Mobile Devices Introduction to Computer Security Final Project
Data Storage on Mobile Devices Introduction to Computer Security Final Project Katina Russell Tufts University, Fall 2014 Abstract While people come up with ideas about a mobile application to create,
EXT3 File Recovery. Hal Pomeranz Deer Run Associates
EXT3 File Recovery via Indirect Blocks Hal Pomeranz Deer Run Associates Agenda EXT File System Review Recovering Deleted Data Issues with Traditional File Carving Tools How Indirect Blocks Can Be Leveraged
Kroll Ontrack Data Recovery. Oracle Data Loss: When the best of plans fail
Kroll Ontrack Data Recovery Oracle Data Loss: When the best of plans fail Breaking the Zettabyte barrier Over 1,000,000,000,000,000,000,000 bytes of data exists currently Learning Objectives 1. Identify
Recover Data for Windows Software
Recover Data for Windows Software Recover Data for Windows Recover Data for FAT & NTFS software recovers the lost, damaged, or formatted partitions of the OS. It retrieves the deleted or corrupted files
Operating Systems CSE 410, Spring 2004. File Management. Stephen Wagner Michigan State University
Operating Systems CSE 410, Spring 2004 File Management Stephen Wagner Michigan State University File Management File management system has traditionally been considered part of the operating system. Applications
Guide to Securing Microsoft Windows 2000 Encrypting File System
Report Number: C4-006R-01 Guide to Securing Microsoft Windows 2000 Encrypting File System Systems and Network Attack Center (SNAC) Authors: Graham Bucholz Harley Parkes Updated: January 2001 Version 1.0
Windows 7: Current Events in the World of Windows Forensics
Windows 7: Current Events in the World of Windows Forensics Troy Larson Senior Forensic Program Manager Network Security, Microsoft Corp. Where Are We Now? Vista & Windows 2008 BitLocker. Format-Wipes
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING MODULE A INTRODUCTION TO COMPUTER FORENSICS AND NVESTIGATIONS A1.0 Explain concepts related to computer forensics. A1.1 This module is measured
Forensics on the Windows Platform, Part Two
1 of 5 9/27/2006 3:52 PM Forensics on the Windows Platform, Part Two Jamie Morris 2003-02-11 Introduction This is the second of a two-part series of articles discussing the use of computer forensics in
Forensic Software Testing Support Tools Test Summary Report
NISTIR 7103-B Forensic Software Testing Support Tools Test Summary Report Serban Gavrila VDG, Inc. Elizabeth Fong Information Technology Laboratory National Institute of Standards and Technology Gaithersburg,
Ephp System - Data Recovery Services
Dear Customer, Thank you for choosing easyservice Data Solutions. We are one of the leading providers of Data Recovery and Data safety solutions in New Jersey USA. We have had the privilege to serve thousands
UMBC POLICY ON ELECTRONIC MEDIA DISPOSAL UMBC# X-1.00.05
UMBC POLICY ON ELECTRONIC MEDIA DISPOSAL UMBC# X-1.00.05 I. POLICY STATEMENT Increasing amounts of electronic data are being transmitted and stored on computer systems and electronic media by virtually
Towards facilitating reliable recovery of JPEG pictures? P. De Smet
Towards facilitating reliable recovery of JPEG pictures? P. De Smet (edited for public release) patrick.desmet@just.fgov.be http://nicc.fgov.be/datarecovery/ Introduction & disclaimer Aim of this talk:
Forensic Imaging and Artifacts analysis of Linux & Mac (EXT & HFS+)
Copyright: The development of this document is funded by Higher Education of Academy. Permission is granted to copy, distribute and /or modify this document under a license compliant with the Creative
Course Title: Computer Forensic Specialist: Data and Image Files
Course Title: Computer Forensic Specialist: Data and Image Files Page 1 of 9 Course Description The Computer Forensic Series by EC-Council provides the knowledge and skills to identify, track, and prosecute
PGP Desktop Email Quick Start Guide version 9.6
What is PGP Desktop Email? PGP Desktop Email is part of the PGP Desktop family of products. You can use PGP Desktop Email to: Automatically and transparently encrypt, sign, decrypt, and verify email messages
Test Results for Mobile Device Acquisition Tool: Lantern v2.3
FEB. 203 U.S. Department of Justice Office of Justice Programs National Institute of Justice Special RepoRt Test Results for Mobile Device Acquisition Tool: Lantern v2.3 nij.gov Office of Justice Programs
Ans.: You can find your activation key for a Recover My Files by logging on to your account.
Faqs > Recover Q1. I lost my activation key Ans.: You can find your activation key for a Recover My Files by logging on to your account. Q2. I purchased on-line, when will my activation key be sent to
HP FutureSmart Firmware Device Hard Disk Security
HP FutureSmart Firmware Device Hard Disk Security Summary: This document discusses hard disk security for HP FutureSmart Firmware printing devices. Contents: Overview... 2 Secure Erase Commands... 2 1.
Retrieving Internet chat history with the same ease as a squirrel cracks nuts
Retrieving Internet chat history with the same ease as a squirrel Yuri Gubanov CEO, Belkasoft http://belkasoft.com SANS Forensic Summit September 21, 2011 London, Great Britain What is Instant Messenger!
Main Points. File layout Directory layout
File Systems Main Points File layout Directory layout File System Design Constraints For small files: Small blocks for storage efficiency Files used together should be stored together For large files:
2013 Boston Ediscovery Summit. Computer Forensics for the Legal Issue-Spotter
2013 Boston Ediscovery Summit Computer Forensics for the Legal Issue-Spotter 2006-2013 James Berriman CEO, Evidox Corporation A Preliminary Comment Issue spotting applies to the practice of ediscovery
RECOVERING DIGITAL EVIDENCE FROM LINUX SYSTEMS
Chapter 19 RECOVERING DIGITAL EVIDENCE FROM LINUX SYSTEMS Philip Craiger Abstract As Linux-kernel-based operating systems proliferate there will be an inevitable increase in Linux systems that law enforcement
BlackLight v2016.1. Test Results for Mobile Device Acquisition Tool
BlackLight v2016.1 Test Results for Mobile Device Acquisition Tool May 25, 2016 This report was prepared for the Department of Homeland Security Science and Technology Directorate Cyber Security Division
Digital Forensic Tool for Decision Making in Computer Security Domain
Digital Forensic Tool for Decision Making in Computer Security Domain S. K. Khode 1,V. N. Pahune 2 and M. R. Sayankar 3 1, 2, 3 Computer Engineering Department of Bapurao Deshmukh College of Engineering,
Metadata, Electronic File Management and File Destruction
Metadata, Electronic File Management and File Destruction By David Outerbridge, Torys LLP A. Metadata What is Metadata? Metadata is usually defined as data about data. It is a level of extra information
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE. Vahidin Đaltur, Kemal Hajdarević,
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE Vahidin Đaltur, Kemal Hajdarević, Internacional Burch University, Faculty of Information Technlogy 71000 Sarajevo, Bosnia
Canon imagerunner Hard Disk Drive Data Security Options. Data Encryption and Overwrite
Canon imagerunner Hard Disk Drive Data Security Options Data Encryption and Overwrite Canon imagerunner Hard Disk Drive Data Security Kits Powerful protection for your most important information. Canon
Windows NT File System. Outline. Hardware Basics. Ausgewählte Betriebssysteme Institut Betriebssysteme Fakultät Informatik
Windows Ausgewählte Betriebssysteme Institut Betriebssysteme Fakultät Informatik Outline NTFS File System Formats File System Driver Architecture Advanced Features NTFS Driver On-Disk Structure (MFT,...)
Open Source Digital Forensics Tools
The Legal Argument 1 carrier@cerias.purdue.edu Abstract This paper addresses digital forensic analysis tools and their use in a legal setting. To enter scientific evidence into a United States court, a
Tableau TD3 Forensic Imager 1.3.0. Test Results for Digital Data Acquisition Tool
Tableau TD3 Forensic Imager 1.3.0 Test Results for Digital Data Acquisition Tool July 23, 2014 This report was prepared for the Department of Homeland Security Science and Technology Directorate Cyber
EMC Replication Manager and Kroll Ontrack PowerControls for Granular Recovery of SharePoint Items
EMC Replication Manager and Kroll Ontrack PowerControls for Granular Recovery of SharePoint Items Applied Technology Abstract This white paper discusses how Kroll Ontrack PowerControls integrates with
Windows NT. Chapter 11 Case Study 2: Windows 2000. Windows 2000 (2) Windows 2000 (1) Different versions of Windows 2000
Chapter 11 Case Study 2: Windows 2000 11.1 History of windows 2000 11.2 Programming windows 2000 11.3 System structure 11.4 Processes and threads in windows 2000 11.5 Memory management 11.6 Input/output
Chapter 13 File and Database Systems
Chapter 13 File and Database Systems Outline 13.1 Introduction 13.2 Data Hierarchy 13.3 Files 13.4 File Systems 13.4.1 Directories 13.4. Metadata 13.4. Mounting 13.5 File Organization 13.6 File Allocation
Chapter 13 File and Database Systems
Chapter 13 File and Database Systems Outline 13.1 Introduction 13.2 Data Hierarchy 13.3 Files 13.4 File Systems 13.4.1 Directories 13.4. Metadata 13.4. Mounting 13.5 File Organization 13.6 File Allocation
The Meaning. Linkfiles In Forensic Examinations
The Meaning of Linkfiles In Forensic Examinations A look at the practical value to forensic examinations of dates and times, and object identifiers in Windows shortcut files. Harry Parsonage September
Outline. Windows NT File System. Hardware Basics. Win2K File System Formats. NTFS Cluster Sizes NTFS
Windows Ausgewählte Betriebssysteme Institut Betriebssysteme Fakultät Informatik 2 Hardware Basics Win2K File System Formats Sector: addressable block on storage medium usually 512 bytes (x86 disks) Cluster:
Optimizing and Protecting Hard Drives Chapter # 9
Optimizing and Protecting Hard Drives Chapter # 9 Amy Hissom Key Terms antivirus (AV) software Utility programs that prevent infection or scan a system to detect and remove viruses. McAfee Associates VirusScan