TABLE OF CONTENTS CHAPTER TITLE PAGE

Transcription

1 vii TABLE OF CONTENTS CHAPTER TITLE PAGE DECLARATION DEDICATION ACKNOWLEDGEMENTS ABSTRACT ABSTRAK TABLE OF CONTENTS LIST OF TABLES LIST OF FIGURES LIST OF ABBREVIATIONS ii iii iv v vi vii x xi xiv 1 PROJECT INTRODUCTION Introduction Background of The Problem Problem Statement Project Objectives Project Aim Project Scope Summary 4 2 LITERATURE REVIEW Introduction Computer Forensic Computer Forensic 7

2 viii Digital Evidence Investigation Tools Legal Aspects Chain of Custody Admissibility of Evidence Evidential Value of Evidence The Xbox 360 Forensic Techniques Procedure Summary 13 3 RESEARCH METHODOLOGY Introduction Forensic Tools Forensic Laboratory Summary 22 4 FORENSIC TECHNIQUES AND EXPERIMENTS Introduction The Xbox 360 Surrounding Environment and Physical Modification The Xbox 360 Surrounding Environment The Xbox 360 Physical Modification The Xbox 360 Data Storage Imaging The Xbox 360 Data Storage Dismantle The Xbox 360 Data Storage Connected to PC Through SATA Port The Xbox 360 Data Storage Imaging and Accessing Imaging the Xbox 360 Data Storage Accessing Image of the Xbox Summary 50

3 ix 5 THE XBOX 360 FORENSIC'S GUIDELINES Introduction Purpose General Guidelines Audit Trails Technical Preparation Performing the Forensics Process Data Collection Examination and Analysis Reporting Investigation Tools Forensic Laboratory Forensic Tools The Xbox 360 Surrounding Environment The Xbox 360 Physical Modification The Xbox 360 Data Storage Dismantle Procedures The Xbox 360 Data Storage Connected to PC Through SATA Port The Xbox 360 Data Storage Imaging and Accessing Data Storage Imaging Data Storage Accessing 66 6 DISCUSSION AND CONCLUSION Introduction Overview and Conclusion Differences of The Research Contribution Future Work 70 REFERENCES 72

4 vii TABLE OF CONTENTS CHAPTER TITLE PAGE DECLARATION DEDICATION ACKNOWLEDGEMENTS ABSTRACT ABSTRAK TABLE OF CONTENTS LIST OF TABLES LIST OF FIGURES LIST OF ABBREVIATIONS ii iii iv v vi vii x xi xiv 1 PROJECT INTRODUCTION Introduction Background of The Problem Problem Statement Project Objectives Project Aim Project Scope Summary 4 2 LITERATURE REVIEW Introduction Computer Forensic Computer Forensic 7

5 viii Digital Evidence Investigation Tools Legal Aspects Chain of Custody Admissibility of Evidence Evidential Value of Evidence The Xbox 360 Forensic Techniques Procedure Summary 13 3 RESEARCH METHODOLOGY Introduction Forensic Tools Forensic Laboratory Summary 22 4 FORENSIC TECHNIQUES AND EXPERIMENTS Introduction The Xbox 360 Surrounding Environment and Physical Modification The Xbox 360 Surrounding Environment The Xbox 360 Physical Modification The Xbox 360 Data Storage Imaging The Xbox 360 Data Storage Dismantle The Xbox 360 Data Storage Connected to PC Through SATA Port The Xbox 360 Data Storage Imaging and Accessing Imaging the Xbox 360 Data Storage Accessing Image of the Xbox Summary 50

6 ix 5 THE XBOX 360 FORENSIC'S GUIDELINES Introduction Purpose General Guidelines Audit Trails Technical Preparation Performing the Forensics Process Data Collection Examination and Analysis Reporting Investigation Tools Forensic Laboratory Forensic Tools The Xbox 360 Surrounding Environment The Xbox 360 Physical Modification The Xbox 360 Data Storage Dismantle Procedures The Xbox 360 Data Storage Connected to PC Through SATA Port The Xbox 360 Data Storage Imaging and Accessing Data Storage Imaging Data Storage Accessing 66 6 DISCUSSION AND CONCLUSION Introduction Overview and Conclusion Differences of The Research Contribution Future Work 70 REFERENCES 72

7 x LIST OF TABLES TABLE NO. TITLE PAGE 2.1 Comparison between the Xbox 360 and the Xbox hardware features Various gaming console forensic techniques procedure The Xbox forensic tools Comparison between various imaging tools Guideline's compliance 51

8 xi LIST OF FIGURES FIGURE NO. TITLE PAGE 2.1 The Xbox 360 (left) and the Xbox (right) Research methodology flowchart Disk storage dismantle flowchart Disk imaging experiment flowchart The Xbox 360 as a server The Xbox 360 attached together with USB-to-Box, keyboard and mouse The old warranty seal for Microsoft Xbox The latest warranty seal for Microsoft Xbox The 7 tabs of Microsoft Xbox 360 side cover The 23 pieces screw of Microsoft Xbox 360 bottom side 28

9 xii 4.7 The Xbox 360 laptop The Xbox 360 hard-disk casing, a flathead screw driver, a T-6 and a T-10 TORX screw driver Four inner T-10 TORX crews (marked in red) Metallic cover and the Xbox 360 hard-disk Slide out the hard-disk The Xbox 360 SATA 2.5" hard-disk and adapter The Xbox 360 spring for hard-disk casing The Serial ATA (SATA) The Xbox 360 hard-disk connection to PC FTK Imager application Source evidence type selection Source drive selection Button for creating disk image Source evidence type selection for disk imaging 40

10 xiii 4.21 Source drive selection for disk imaging Add image destination Selection for destination image type Evidence item information Selection for image destination Start button to create image Creating image in progress Image successfully created Verifying results for drive image The Xplorer360 interface Open the Xbox 360 hard-disk The Xbox 360 hard-disk's partition The Xbox 360 hard-disk's cache folder 49

11 xiv LIST OF ABBREVIATIONS ABBREVIATIONS DESCRIPTION BIOS - Basic Input/Output System CD - Compact Disc COFEE - Computer Online Forensic Evidence Extractor CPU - Central Processing Unit DVD - Digital Versatile Disc FAT - File Allocation Table FTK - Forensic Toolkit GASSP - Generally Accepted System Security Principles GB - Gigabyte HDD - High Definition Display HD DVD - High-Definition/Density DVD HTML - HyperText Markup Language IDE - Integrated Drive Electronics I/O - Input/Output ISO - International Organization for Standardization LCD - Liquid Crystal Display MB - Megabyte MD5 - Message-Digest algorithm 5 MHz - Mega Hertz NIST - National Institute of Standards and Technology NTFS - NT File System OS - Operating System PATA - Parallel (ATA) Advanced Technology Attachment PC - Personal Computer

12 xv RAM - Random Access Memory SATA - Serial (ATA) Advanced Technology Attachment SCSI - Small Computer System Interface SD - Secure Digital SHA1 - Secure Hash Algorithm 1 SIM - Subscriber Identity Module SOP - Standard Operating Procedure USB - Universal Serial Bus