Linux in Law Enforcement
|
|
|
- Gertrude Miles
- 8 years ago
- Views:
Transcription
1 Linux in Law Enforcement It's all about CONTROL Barry J. Grundy CALUG MEETING JUNE 2008
2 !! Disclaimer!! This presentation is not sponsored by any organization of the US Government I am here representing only myself The opinions stated in this presentation are my own and do NOT represent any official position of the US Government or any Government agency
3 Linux in Law Enforcement Agenda Who is this guy? What is a computer crime? What is computer forensics? Why use Linux and Open Source? Technical Arguments Legal Arguments What Linux and Open Source tools are available? Okay...so how is it done under Linux?
4 What is Computer Crime When is a Crime a Computer Crime? When... A computer (computer services or intellectual property) is the TARGET of a crime. A computer is a principal INSTRUMENTALITY of a crime. Or... A computer is INCIDENTAL to a crime.
5 Computer Forensics?
6 What is Computer Forensics? Forensics (Webster s Abridged) The application of scientific knowledge and procedures to legal problems; especially : scientific analysis of evidence (as from a crime scene)
7 What is Computer Forensics? Computer Forensics has branched : Classic Computer Forensics Data Recovery Pull the plug Computer Intrusion analysis Lots of Correlation Volatile data (no plug pulling!) Electronic Discovery ( E-Discovery ) Civil Litigation (IP, etc.) Drives the industry
8 What is Computer Forensics? At its Core regardless of case: Acquisition collection of evidence. Drive imaging... Volatile data recovery, log recovery, etc. Acquisition is the heart of computer forensics. A plausible case derives from this step.
9 What is Computer Forensics? At its Core regardless of case: Analysis Multiple layers Physical through Application Looking for: Inculpatory Evidence Exculpatory Evidence Tampering Data recovery, temporal analysis, etc.
10 What is Computer Forensics? At its Core regardless of case: Reporting and Testimony Driven largely by jurisdiction. Can be automated by the forensic tools used. Level of detail and format depends on the audience or customer. This is DIFFERENT than Documentation.
11 Why Linux for Forensic Examinations? It's Free! (Which is why I started using it...)
12 Why Linux for Forensic Examinations? But really it's because of... Total Control
13 Why Linux for Forensic Examinations? Direct control of all attached hardware. Control of all device (and FS) permissions. Read/Write/Execute (mount options) Built in disk image and analysis capabilities Many ported and native forensic utilities available.
14 Why Linux for Forensic Examinations? Support for multiple file systems Ext2 / Ext3, etc. (Linux Native) Fat 16 (msdos) Fat 32 (vfat) NTFS (ntfs-3g) XFS UFS HFS Many more... (most are native to kernel)
15 Why Linux for Forensic Examinations? Maximum Flexibility. Vmware Wine/Cygwin/CoLinux (AndLinux) Legacy hardware support. Endless support base. USENET Web LUGS
16 Why Linux for Forensic Examinations? Provides an alternative platform for crossverification and validation Open source tools (legal argument) Different set of issues than Windows Notice the word different Testing environment for hardware and software.
17 Why Linux for Forensic Examinations? How about: Just Plain Powerful? Power of CLI! Speed (vs. GUI...really!) Log parsing (grep/sed/awk vs. Notepad...) Granular command control More intuitive scripting it's just BASH.
18 Superman? Linux will NOT solve all your forensic woes... Steep learning curve (for new users). Mainstream software availability. Linux assumes you know what you are doing. (Age old danger of root ). Starting to lose some control with Desktop orientation...see Fedora/Ubuntu.
19 Open Source Legal Argument Admissibility of Evidence: Previously based on Frye Test Peer review and Journal published Now based on Daubert Test Not every forensic discipline had access to a peer reviewed scientific journal Offered additional quality tests
20 Open Source Legal Argument Daubert Test addresses: Testing (false negatives/positives) Error Rate Publication Acceptance generally accepted relevant scientific community Digital evidence can also be seen as testimony under the Federal Rules of Evidence
21 Open Source Legal Argument Open source programs address these issues: Access to code improves testing in code review Error rates can be reported through open bug tracking or code diffs in releases. Bug tracking is not driven by revenue. Published abstraction techniques allow the analyst to decide on the veracity of findings NTFS file name analysis, for example. What is this tool doing?
22 Linux for Forensic Examinations How is it done?
23 Forensic Utilities Included in Linux Acquisition Tools: dd disk imaging, carving, splicing md5sum and sha1sum hashing tools Analysis Tools: fdisk and sfdisk disk geometry find and grep - search tools xxd hex editor file magic! Tons of other stuff...
24 Forensic Utilities available for Linux Acquisition Tools: dcfldd/dc3dd DoD version of dd with logging and hash window functions. ddrescue/dd_rescue error handling dd. ewfacquire libewf project to work with EWF images (EnCase). aimage Advanced Forensic Format (afflib). Air/Adepto/GRAB GUI frontends to dd/dcfldd md5deep recursive hashing tool. SMART not open source, but important for Linux...
25 Forensic Utilities available for Linux Analysis Tools: The SleuthKit (TSK) the big daddy of open source computer forensics. Provides a suite of CLI tools for all layers of analysis (short of application). Carving Tools: Scalpel / Foremost / Photorec More at : SMART not open source, but important for Linux...
26 Forensic Utilities available for Linux Analysis Tools: The SleuthKit (TSK) Disk: disk_stat, disk_sreset Media Mgmt: mmls, mmstat File System: fsstat, ffind, fls istat, ifind, ils, icat dstat, dls, dcat, dcalc jls, jcat Other tools: hfind, sorter, mactime
27 Forensic Linux Boot Disks Bootable CD's for Forensics: Helix: Based on Knoppix Forensic adjustments Forensic software, including TSK Has a real nice Windows side for live acquisitions Free, and a good starting point for forensic exploration.
28 Forensic Linux Boot Disks Bootable CD's for Forensics: SMART for Linux Slackware and Ubuntu versions Forensically optimized Forensic software, including TSK Evaluation version SMART Free CD, But SMART app is $$ Also see the FBCD:
29 Demo of Forensics? What next? Your Choice! Image recovery from NTFS (TSK) File sorter (TSK) Carving (Photorec or Foremost) Boot Disk Demo? SMART on Virtual Box Helix on Virtual Box or just Questions?
30 It's all about Control
Open Source Data Recovery
Open Source Data Recovery Options and Techniques CALUG MEETING October 2008 !! Disclaimer!! This presentation is not sponsored by any organization of the US Government I am here representing only myself
Introduction to The Sleuth Kit (TSK) By Chris Marko. Rev1 September, 2005. Introduction to The Sleuth Kit (TSK) 1
Introduction to The Sleuth Kit (TSK) By Chris Marko Rev1 September, 2005 Introduction to The Sleuth Kit (TSK) 1 This paper provides an introduction to The Sleuth Kit (referred to as TSK herein), from Brian
Forensic Investigator. Module XI Linux Forensics
Computer Hacking Forensic Investigator Module XI Linux Forensics Module Objective This module will familiarize you with the following: Use of Linux as a forensic tool. Recognizing partitions in Linux.
Hands on Post Mortem Forensics Analysis in SUSE Linux Enterprise Servers Technical Tutorial Session Length - 1 hour
Hands on Post Mortem Forensics Analysis in SUSE Linux Enterprise Servers Technical Tutorial Session Length - 1 hour Sandro Melo Teacher in Bandtec College - Brazil sandro.melo@bandtec.com.br About me Sandro
GNU/LINUX Forensic Case Study (ubuntu 10.04)
GNU/LINUX Forensic Case Study (ubuntu 10.04) Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License wim.bertels@khleuven.be FCCU Federal Computer Crime Unit of Belgium Assistance house
Where is computer forensics used?
What is computer forensics? The preservation, recovery, analysis and reporting of digital artifacts including information stored on computers, storage media (such as a hard disk or CD-ROM), an electronic
Disk and File System Analysis
CHAPTER Disk and File System Analysis 3 INFORMATION IN THIS CHAPTER Media Analysis Concepts The Sleuth Kit Partitioning and Disk Layouts Special Containers Hashing Carving Forensic Imaging MEDIA ANALYSIS
Digital Forensics Lecture 3. Hard Disk Drive (HDD) Media Forensics
Digital Forensics Lecture 3 Hard Disk Drive (HDD) Media Forensics Current, Relevant Topics defendants should not use disk-cleaning utilities to wipe portions of their hard drives before turning them over
Open Source and Incident Response
Open Source and Incident Response Joe Lofshult, CISSP, GCIH 1 Agenda Overview Open Source Tools FIRE Demonstration 2 Overview Incident Adverse event that threatens security in computing systems and networks.
Lab III: Unix File Recovery Data Unit Level
New Mexico Tech Digital Forensics Fall 2006 Lab III: Unix File Recovery Data Unit Level Objectives - Review of unallocated space and extracting with dls - Interpret the file system information from the
Unix/Linux Forensics 1
Unix/Linux Forensics 1 Simple Linux Commands date display the date ls list the files in the current directory more display files one screen at a time cat display the contents of a file wc displays lines,
Open Source Digital Forensics Tools
The Legal Argument 1 carrier@cerias.purdue.edu Abstract This paper addresses digital forensic analysis tools and their use in a legal setting. To enter scientific evidence into a United States court, a
Using Open Source Digital Forensics Software for Digital Archives Workshop
Using Open Source Digital Forensics Software for Digital Archives Workshop Mark A. Matienzo 04 Manuscripts and Archives, Yale University Library Society of American Archivists University of Michigan School
MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1
MSc Computer Security and Forensics Cohort: MCSF/09B/PT Examinations for 2009-2010 / Semester 1 MODULE: COMPUTER FORENSICS & CYBERCRIME MODULE CODE: SECU5101 Duration: 2 Hours Instructions to Candidates:
Design and Implementation of a Live-analysis Digital Forensic System
Design and Implementation of a Live-analysis Digital Forensic System Pei-Hua Yen Graduate Institute of Information and Computer Education, National Kaohsiung Normal University, Taiwan amber8520@gmail.com
Forensic Imaging and Artifacts analysis of Linux & Mac (EXT & HFS+)
Copyright: The development of this document is funded by Higher Education of Academy. Permission is granted to copy, distribute and /or modify this document under a license compliant with the Creative
Digital Forensics For Unix. The SANS Institute
Digital Forensics For Unix The SANS Institute John Green john@cybersecuritysciences.com Hal Pomeranz hal@deer-run.com 1 1 Forensics in a Nutshell Evidence seizure Investigation and analysis Reporting results
Computer Forensic Tools. Stefan Hager
Computer Forensic Tools Stefan Hager Overview Important policies for computer forensic tools Typical Workflow for analyzing evidence Categories of Tools Demo SS 2007 Advanced Computer Networks 2 Important
CCE Certification Competencies
CCE Certification Competencies May 10, 2012 Page 1 The Certified Computer Examiner (CCE) has evolved into one of the most desired certifications in the computer forensics industry. The certification is
Recover Data Like a Forensics Expert Using an Ubuntu Live CD
Recover Data Like a Forensics Expert Using an Ubuntu Live CD There are lots of utilities to recover deleted files, but what if you can t boot up your computer, or the whole drive has been formatted? We
A Day in the Life of a Cyber Tool Developer
A Day in the Life of a Cyber Tool Developer by Jonathan Tomczak jon@tzworks.net Jonathan Tomczak ( Front Man ) Software Engineer w/ over 7 years experience working in software and web development Dave
2! Bit-stream copy. Acquisition and Tools. Planning Your Investigation. Understanding Bit-Stream Copies. Bit-stream Copies (contd.
Acquisition and Tools COMP 2555: Principles of Computer Forensics Autumn 2014 http://www.cs.du.edu/2555 1 Planning Your Investigation! A basic investigation plan should include the following activities:!
Dr Michael Cohen. This talk does not represent my Employer. April 2005
RAID Reconstruction And the search for the Aardvark Dr Michael Cohen This talk does not represent my Employer April 2005 1 RAID 0: Striping What is RAID? Improves performance due to parallel disk access
Capturing a Forensic Image. By Justin C. Klein Keane <jukeane@sas.upenn.edu> 12 February, 2013
Capturing a Forensic Image By Justin C. Klein Keane 12 February, 2013 Before you Begin The first step in capturing a forensic image is making an initial determination as to the
Guide to Computer Forensics and Investigations, Second Edition
Guide to Computer Forensics and Investigations, Second Edition Chapter 12 Network Forensics Objectives Understand Internet fundamentals Understand network basics Acquire data on a Linux computer Guide
Comparing and Contrasting Windows and Linux Forensics. Zlatko Jovanovic. International Academy of Design and Technology
Comparing and Contrasting Windows and Linux Forensics Zlatko Jovanovic International Academy of Design and Technology Abstract Windows and Linux are the most common operating systems used on personal computers.
A Short Introduction to Digital and File System Forensics
Antonio Barili Lab Dept. of Industrial and Information Engineering University of Pavia (Italy) antonio.barili@unipv.it Every contact leaves a trace Culprit Scene Victim Edmond Locard (1877-1966) 2015 -
Computing forensics: a live analysis
April 18th, 2005 1 2 3 Objectives Evidence acquisition Recovery and examination of suspect digital evidence (think Warrick Brown on CSI) Hardware: servers, workstations, laptops, PDAs, mobiles, cameras
Lab V: File Recovery: Data Layer Revisited
New Mexico Tech Digital Forensics Fall 2006 Lab V: File Recovery: Data Layer Revisited Objectives - Perform searches based on file headers - Data Carving with Foremost - Zip password recovery Procedures
What is Digital Forensics?
DEVELOPING AN UNDERGRADUATE COURSE IN DIGITAL FORENSICS Warren Harrison PSU Center for Information Assurance Portland State University Portland, Oregon 97207 warren@cs.pdx.edu What is Digital Forensics?
Computer Forensics using Open Source Tools
Computer Forensics using Open Source Tools COMP 5350/6350 Digital Forensics Professor: Dr. Anthony Skjellum TA: Ananya Ravipati Presenter: Rodrigo Sardinas Overview Use case explanation Useful Linux Commands
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065 Introduction The Computer Forensics and Investigation course presents methods to properly conduct a computer forensics investigation
Barracuda Yosemite Server Backup
Version 10.3 Server 2012 Standard x86_64 R2 Server 2012 Datacenter x86_64 R2 Server 2012 Essentials x86_64 R2 Windows 8 Enterprise x86, x86_64 1 Windows 8 Pro x86, x86_64 1 Small Business Server x86_64
EC-Council Ethical Hacking and Countermeasures
EC-Council Ethical Hacking and Countermeasures Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
CDFE Certified Digital Forensics Examiner (CFED Replacement)
Course: CDFE Certified Digital Forensics Examiner (CFED Replacement) Description: Price: $3,450.00 Category: Popular Courses Duration: 5 days Schedule: Request Dates Outline: COURSE OVERVIEW Computer Forensics
Computer Forensics Today
L A W, I N V E S T I G A T I O N S, A N D E T H I C S Computer Forensics Today Kelly J. (KJ) Kuchta When people hear the word forensics, it often generates a mental image of the movie series with Jack
Digital Forensic Techniques
Digital Forensic Techniques Namrata Choudhury, Sr. Principal Information Security Analyst, Symantec Corporation Professional Techniques T23 CRISC CGEIT CISM CISA AGENDA Computer Forensics vs. Digital Forensics
Restoring a Suse Linux Enterprise Server 9 64 Bit on Dissimilar Hardware with CBMR for Linux 1.02
Cristie Bare Machine Recovery Restoring a Suse Linux Enterprise Server 9 64 Bit on Dissimilar Hardware with CBMR for Linux 1.02 This documentation shows how to restore or migrate a Linux system on dissimilar
NIST CFTT: Testing Disk Imaging Tools
NIST CFTT: Testing Disk Imaging Tools James R. Lyle, Ph.D. Computer Scientist National Institute of Standards and Technology 1. Introduction There is a critical need in the law enforcement community to
Forensic Acquisition and Analysis of VMware Virtual Hard Disks
Forensic Acquisition and Analysis of VMware Virtual Hard Disks Manish Hirwani, Yin Pan, Bill Stackpole and Daryl Johnson Networking, Security and Systems Administration Rochester Institute of Technology
Digital Forensics Tutorials Acquiring an Image with FTK Imager
Digital Forensics Tutorials Acquiring an Image with FTK Imager Explanation Section Digital Forensics Definition The use of scientifically derived and proven methods toward the preservation, collection,
TUXERA NTFS for Mac USER GUIDE 2/13. Index
2/13 Index 1. Introduction to Tuxera NTFS for Mac... 3 1.1 What is a file system driver?... 3 1.2 How does it work?... 3 2. Installation... 5 2.1 Installing Tuxera NTFS for Mac... 5 2.2 Uninstalling Tuxera
Information Technologies and Fraud
Information Technologies and Fraud Florin Gogoasa CISA, CFE, CGEIT, CRISC ACFE Romania - Founder and Board member Managing Partner Blue Lab Consulting Information Technologies for Fraud investigation A.
USB 2.0 Flash Drive User Manual
USB 2.0 Flash Drive User Manual 1 INDEX Table of Contents Page 1. IMPORTANT NOTICES...3 2. PRODUCT INTRODUCTION...4 3. PRODUCT FEATURES...5 4. DRIVER INSTALLATION GUIDE...6 4.1 WINDOWS 98 / 98 SE... 6
CSI Crime Scene Investigations
CSI Crime Scene Investigations Did Jack do it? Speaker Introductions Amber Schroader Paraben Corporation Oodles of forensic experience Tyler Cohen Federal Government (Still Cool Person) IPod Obsession
Software Requirements Specification. GParted. for. Requirements for Version 0.6.0-1. Prepared by Bill Karatzidis
Software Requirements Specification for GParted Requirements for Version 0.6.0-1 Prepared by Bill Karatzidis ISE: Introduction to Software Engineering (Aristotle University) 2010-06-19 Software Requirements
Mac Marshal: A Tool for Mac OS X Operating System and Application Forensics
Mac Marshal: A Tool for Mac OS X Operating System and Application Forensics Rob Joyce, Judson Powers, Frank Adelstein A Subsidiary of Architecture Technology Corporation Digital Forensic Research Workshop
information security and its Describe what drives the need for information security.
Computer Information Systems (Forensics Classes) Objectives for Course Challenges CIS 200 Intro to Info Security: Includes managerial and Describe information security and its critical role in business.
Technical Note TN_146. Creating Android Images for Application Development
TN_146 Creating Android Images for Application Development Issue Date: 2013-01-28 This document shows how to build and install the Android Operating System on the BeagleBoard xm Use of FTDI devices in
Federated Testing: Well-Tested Tools, Shared Test Materials & Shared Test. Reports; The Computer Forensics Tool Catalog Website: Connecting
Federated Testing: Well-Tested Tools, Shared Test Materials & Shared Test Reports; The Computer Forensics Tool Catalog Website: Connecting Forensic Examiners With the Tools They Need U.S. Cyber Crime Conference
CYBER FORENSICS (W/LAB) Course Syllabus
6111 E. Skelly Drive P. O. Box 477200 Tulsa, OK 74147-7200 CYBER FORENSICS (W/LAB) Course Syllabus Course Number: CSFS-0020 OHLAP Credit: Yes OCAS Code: 8134 Course Length: 130 Hours Career Cluster: Information
Recovering Data from Windows Systems by Using Linux
Recovering Data from Windows Systems by Using Linux Published by the Open Source Software Lab at Microsoft. November 2007. Special thanks to Chris Travers, Contributing Author to the Open Source Software
A Practitioner's Guide to Linux as a Computer Forensic Platform
A Practitioner's Guide to Linux as a Computer Forensic Platform bgrundy@linuxleo.com VER 3.78 December 2008 LEGALITIES...4 ACKNOWLEDGMENTS...4 FOREWORD...5 A WORD ABOUT THE GNU IN GNU/LINUX...6 WHY LEARN
Just EnCase. Presented By Larry Russell CalCPA State Technology Committee May 18, 2012
Just EnCase Presented By Larry Russell CalCPA State Technology Committee May 18, 2012 What is e-discovery Electronically Stored Information (ESI) Discover or Monitor for Fraudulent Activity Tools used
Digital Forensics Tutorials Acquiring an Image with Kali dcfldd
Digital Forensics Tutorials Acquiring an Image with Kali dcfldd Explanation Section Disk Imaging Definition Disk images are used to transfer a hard drive s contents for various reasons. A disk image can
Linux and Law Enforcement
Linux and Law Enforcement Challenges and Opportunities Dr. Joshua I. James Digital Forensic Investigation Research Laboratory SoonChunHyang University Joshua@cybercrimetech.com http://forensics.sch.ac.kr
CS197U: A Hands on Introduction to Unix
CS197U: A Hands on Introduction to Unix Lecture 4: My First Linux System J.D. DeVaughn-Brown University of Massachusetts Amherst Department of Computer Science jddevaughn@cs.umass.edu 1 Reminders After
Corporate IT Forensics in the New Decade. Hong Kong March 2010 Bruce Nikkel
Corporate IT Forensics in the New Decade Hong Kong March 2010 Bruce Nikkel Presentation Overview The growth and evolution of digital forensics Pre-Y2K computer forensics Post-Y2K digital forensics Factors
Digital Forensics & e-discovery Services
Digital Forensics & e-discovery Services U.S. Security Associates Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities
Digital Forensics & e-discovery Services
Digital Forensics & e-discovery Services Andrews International Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities
Acronis True Image 9.1 Pro/Light for Linux
Installation Guide Acronis True Image 9.1 Pro/Light for Linux Learn more at www.swsoft.com. Revised: November 2006 Published: November 2006 Table of Contents INTRODUCTION... 3 INSTALLATION... 4 SOFTWARE
Contents. vii. Preface. P ART I THE HONEYNET 1 Chapter 1 The Beginning 3. Chapter 2 Honeypots 17. xix
Honeynet2_bookTOC.fm Page vii Monday, May 3, 2004 12:00 PM Contents Preface Foreword xix xxvii P ART I THE HONEYNET 1 Chapter 1 The Beginning 3 The Honeynet Project 3 The Information Security Environment
PTK Forensics. Dario Forte, Founder and Ceo DFLabs. The Sleuth Kit and Open Source Digital Forensics Conference
PTK Forensics Dario Forte, Founder and Ceo DFLabs The Sleuth Kit and Open Source Digital Forensics Conference What PTK is about PTK forensics is a computer forensic framework based on command line tools
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE. Vahidin Đaltur, Kemal Hajdarević,
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE Vahidin Đaltur, Kemal Hajdarević, Internacional Burch University, Faculty of Information Technlogy 71000 Sarajevo, Bosnia
System deployment and bare metal recovery by Clonezilla
System deployment and bare metal recovery by Clonezilla Steven Shiau, Ceasar Sun, Jazz Wang, Thomas Tsai National Center for High-Performance Computing Taiwan Jan, 2010 Outline Introduction to Clonezilla
PARALLELS SERVER 4 BARE METAL README
PARALLELS SERVER 4 BARE METAL README This document provides the first-priority information on Parallels Server 4 Bare Metal and supplements the included documentation. TABLE OF CONTENTS 1 About Parallels
Incident Response and Computer Forensics
Incident Response and Computer Forensics James L. Antonakos WhiteHat Forensics Incident Response Topics Why does an organization need a CSIRT? Who s on the team? Initial Steps Detailed Project Plan Incident
CASE STUDY Open Source Digital Forensics
CASE STUDY Open Source Digital Forensics OVERVIEW Introduction Digital forensics is the application of science to the identification, collection, examination, and analysis of data while preserving the
Is the Open Way a Better Way? Digital Forensics using Open Source Tools
Is the Open Way a Better Way? Digital Forensics using Open Source Tools Dan Manson, Anna Carlin, Steve Ramos, Alain Gyger, Matthew Kaufman, Jeremy Treichelt California State Polytechnic University Computer
Dr. Lodovico Marziale Managing Partner 504ENSICS, LLC vico@504ensics.com
Dr. Lodovico Marziale Managing Partner 504ENSICS, LLC vico@504ensics.com Education Ph.D. in Computer Science, University of New Orleans, 2009. Dissertation Topic: Advanced Techniques for Improving the
Lukas Limacher Department of Computer Science, ETH. Computer Forensics. September 25, 2014
Lukas Limacher Department of Computer Science, ETH Zürich Computer Forensics September 25, 2014 Contents 9 Computer Forensics 1 91 Objectives 1 92 Introduction 2 921 Incident Response 2 922 Computer Forensics
Guide to Computer Forensics and Investigations, Second Edition
Guide to Computer Forensics and Investigations, Second Edition Chapter 4 Current Computer Forensics Tools Objectives Understand how to identify needs for computer forensics tools Evaluate the requirements
ITM 642: Digital Forensics Sanjay Goel School of Business University at Albany, State University of New York
INSTRUCTOR INFORMATION Name: Sanjay Goel Email: goel@albany.edu Phone: (518) 442-4925 Office Location: BA 310b, University at Albany Office Hours: TBD CLASS INFORMATION Time: N/A Location: Online Dates:
Linux Overview. The Senator Patrick Leahy Center for Digital Investigation. Champlain College. Written by: Josh Lowery
Linux Overview Written by: Josh Lowery The Senator Patrick Leahy Center for Digital Investigation Champlain College October 29, 2012 Disclaimer: This document contains information based on research that
Enterprise-Class Virtualization with Open Source Technologies
Enterprise-Class Virtualization with Open Source Technologies Alex Vasilevsky CTO & Founder Virtual Iron Software June 14, 2006 Virtualization Overview Traditional x86 Architecture Each server runs single
iphone Forensics with F/OSS A HOWTO for iphone Forensics with free and/or open source tools
iphone Forensics with F/OSS A HOWTO for iphone Forensics with free and/or open source tools Qualifications Background Author Researcher Forensics: Geek Computer scientist, prev CIO, cofounder of viaforensics
Linux System Administration on Red Hat
Linux System Administration on Red Hat Kenneth Ingham September 29, 2009 1 Course overview This class is for people who are familiar with Linux or Unix systems as a user (i.e., they know file manipulation,
FORENSIC ANALYSIS OF USB MEDIA EVIDENCE. Jesús Alexander García. Luis Alejandro Franco. Juan David Urrea. Carlos Alfonso Torres
FORENSIC ANALYSIS OF USB MEDIA EVIDENCE Jesús Alexander García Luis Alejandro Franco Juan David Urrea Carlos Alfonso Torres Manuel Fernando Gutiérrez UPB 2012 Content INTRODUCTION... 3 OBJECTIVE 4 EVIDENCE
Forensic Analysis of a Sony Play Station 3 Gaming Console
Forensic Analysis of a Sony Play Station 3 Gaming Console Scott Conrad conrad.scott@gmail.com Greg Dorn cg.dorn@gmail.com J. Philip Craiger philip@craiger.net ational Center for Forensic Science 12354
70-271. Supporting Users and Troubleshooting a Microsoft Windows XP Operating System Q&A. DEMO Version
Supporting Users and Troubleshooting a Microsoft Windows XP Operating System Q&A DEMO Version Copyright (c) 2007 Chinatag LLC. All rights reserved. Important Note Please Read Carefully For demonstration
EnCase Portable Demo P A G E 0
EnCase Portable Demo P A G E 0 EnCase Portable Easy to Use Collection Solution Brent Botta Director of ediscovery Solution Agenda P A G E 2 EnCase Portable Solution What is it? Business Issues to Utilize
Automating the Computer Forensic Triage Process With MantaRay
Automating the Computer Forensic Triage Process With MantaRay Senior Computer Forensic Analysts Doug Koster & Kevin Murphy Worlds best Summer Intern Chapin Bryce GMU RCFG Conference August 2013 1 MantaRay
PORTABLE OPERATING SYSTEMS AND INFORMAITON SECURITY RISKS
Portable Operating Systems and Information Security Risks 1 PORTABLE OPERATING SYSTEMS AND INFORMAITON SECURITY RISKS Portable Operating Systems and Information Security Risks Thomas S. Hyslip East Carolina
Incident Response and Forensics
Incident Response and Forensics Yiman Jiang, President and Principle Consultant Sumus Technology Ltd. James Crooks, Manager - Advisory Services PricewaterhouseCoopers LLP UBC 2007-04-12 Outline Computer
INCIDENT RESPONSE & COMPUTER FORENSICS, SECOND EDITION
" - * INCIDENT RESPONSE & COMPUTER FORENSICS, SECOND EDITION CHRIS PROSISE KEVIN MANDIA McGraw-Hill /Osborne New York Chicago San Francisco Lisbon London Madrid Mexico City Milan New Delhi San Juan Seoul
Installing OCFA on Ubuntu. Practical installation procedures, Installing The Open Computer Forensics Architecture on Ubuntu
Practical installation procedures, Installing The Open Computer Forensics Architecture on Ubuntu October 2009 KLPD, Driebergen Author: J. van der Wal Version 0.12 Page 1 from 15 Copyright 2008-2009, KLPD,
Forensics source: Edward Fjellskål, NorCERT, Nasjonal sikkerhetsmyndighet (NSM)
s Unix Definition of : Computer Coherent application of a methodical investigatory techniques to solve crime cases. Forensics source: Edward Fjellskål, NorCERT, Nasjonal sikkerhetsmyndighet (NSM) s Unix
Recovering Data from Windows Systems by Using Linux
Recovering Data from Windows Systems by Using Linux Published by the Open Source Software at Microsoft, May 27 Special thanks to Chris Travers, Contributing Author to the Open Source Software Lab Most
Ubuntu Professional Training Course Overview (E-learning, Ubuntu 10.04 LTS)
Ubuntu Professional Training Course Overview (E-learning, Ubuntu 10.04 LTS) 1 of 7 Ubuntu Professional Course Overview (E-learning, Ubuntu 10.04 LTS) About the Course and Objectives The Ubuntu Professional
ITU Session Four: Device Imaging And Analysis. Mounir Kamal Q-CERT
ITU Session Four: Device Imaging And Analysis Mounir Kamal Q-CERT 2 Applying Forensic Science to Computer Systems Like a Detective, the archaeologist searches for clues in order to discover and reconstruct
"Cheap Security Audits with Linux LiveCDs"
"Cheap Security Audits with Linux LiveCDs" Presented by Beth Lynn Eicher bethlynn@cs.cmu.edu For Notacon.Org 4/9/2006 Released under Creative Commons Attribution-NonCommercial-ShareAlike 2.5 écouter moi
SIRIS. Bare Metal Restore Guide
SIRIS Bare Metal Restore Guide Table of Contents Prerequisites 5 PXE Boot Configuration 6 Accessing Recovery Points 7 Setting BMR Preferences 9 gpxe USB Drive Configuration 10 Starting the BMR 11 Configuring
FALSE ALARM? Incident Management Case Study. Carlos Villalba carlos@tvrms.com
FALSE ALARM? Incident Management Case Study Carlos Villalba carlos@tvrms.com Initial Discovery The panic sets in: You think your company has been breached! So, what do you do? First steps First things
EnCase 7 - Basic + Intermediate Topics
EnCase 7 - Basic + Intermediate Topics Course Objectives This 4 day class is designed to familiarize the student with the many artifacts left behind on Windows based media and how to conduct a forensic
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING MODULE A INTRODUCTION TO COMPUTER FORENSICS AND NVESTIGATIONS A1.0 Explain concepts related to computer forensics. A1.1 This module is measured
COEN 152 / 252 Lab Exercise 1. Imaging, Hex Editors & File Types
COEN 152 / 252 Lab Exercise 1 Imaging, Hex Editors & File Types In this lab we will explore the concepts associated with creating a forensic image. Write-blocking will be accomplished utilizing a mounted
USB Bare Metal Restore: Getting Started
USB Bare Metal Restore: Getting Started Prerequisites Requirements for the target hardware: Must be able to boot from USB Must be on the same network as the Datto device Must be 64 bit hardware Any OSs
EnCase Endpoint Investigator Fundamentals 5/25/2016
EnCase Endpoint Investigator Fundamentals Guidance Software 1 About Us Tony Balzanto Tony Balzanto is an instructor in the Orlando, FL office of Guidance Software s Professional Development and Training
Guide to Computer Forensics and Investigations, Second Edition
Guide to Computer Forensics and Investigations, Second Edition Chapter 9 Data Acquisition Objectives Determine the best acquisition method Plan data-recovery contingencies Use MS-DOS acquisition tools
Platform as a Service and Container Clouds
John Rofrano Senior Technical Staff Member, Cloud Automation Services, IBM Research jjr12@nyu.edu or rofrano@us.ibm.com Platform as a Service and Container Clouds using IBM Bluemix and Docker for Cloud