How To Do Digital Forensics
|
|
|
- Laurel Simpson
- 3 years ago
- Views:
Transcription
1 Enterprise Risk Management Miami, FL Digital Forensics Risk Management and Information Systems Security Consulting Services January 2011
2 UMiami alumnus Bachelors: Information Systems and Marketing MS Computer Science / MBA Information Systems Telecommunications Certification Total Qualitt Certification Systems and Network Consultant Various Infrastructure and Security Manager Sony Latin America, Inc. IS Security Consultant Enterprise Risk Management CISSP, CISA, PCI QSA 2 Member of: IIA, ISSA, ISACA, Infragard, SFTA
3 - What is digital forensics? - Digital forensics taxonomy - Methodology -System description -Evidence collection -Analysis -Reporting - Demonstration Agenda 3
4 What is Forensic Science? Science - Organized study of natural phenomena Science - Application of the scientific method Forensis Latin meaning public, forum, discussion Forensic belonging to, suitable for use in courts or public for a Forensic Science any science used for the purpose of law 4
5 The Three Elements Science Evidence Law 5
6 Digital Forensics definition Forensics is most often understood to refer to the process or processes by which digital evidence is identified, preserved, analyzed and presented. 6
7 Computer Forensics Taxonomy Victim Network Subject Network Forensics Media Forensics 7
8 Methodology The overall forensic investigation methodology has the following 4 phases: System Description Evidence Collection Analysis Reporting 8
9 System Description Determine what the workstation or server is utilized for. Affect the way the investigation is executed. Unplug the machine or not? Shutdown, power off or not? Determine type of file system in use 9
10 Evidence Collection Evidence is defined as everything that can be collected from the system under investigation. IMPORTANT -> Avoid data loss Preserve the evidence Volatile Memory, Network status and connections, Processes running, Swap files. Chain of custody Establishes continuity of possession Proof of integrity 10
11 Direct Identification Use indelible marker to place case, item number, date and initials on item. Sharpie or Etching is best. Indirect Place item in a sealed container Record serial numbers and description Combined evidence 11
12 Refers to: Chain of Custody Unbroken control of evidence from seizure to court The paper/electronic record which demonstrates this control Is the most often used challenge to seized evidence A successful challenge may weaken or eliminate evidence from consideration at trial Applies to original, copy and derivative evidence 12
13 Evidence Examples 13
14 File Systems A system for organizing directories and files, generally in terms of how it is implemented in the disk operating system. Units are called sectors (512 bytes or 2 to the power of 9) Sectors are organized in clusters or Allocation Units. 14
15 Collecting Evidence (cont.) Sanitize the hard drive you will use to store the evidence (Wipe programs) Ensure that it is not possible to overwrite the evidence Use a hardware device to write protect the accesses Windows: HKLM\System\CurrentControlSet\Control\StorageDevicePolicies WriteProtect{REG_DWORD}=1 Unix: mount the device with the read-only option mount -o ro,loop,nodev,noexec images/honeypot.hda8.dd mnt mount r /dev/sda1 /mnt/usb 15
16 Collecting Evidence (cont.) Backup tools - don t work Commercial tools: Encase, Image, Forensic Toolkit, Forensic Replicator DD is a common UNIX program whose primary purpose is the low-level level copying and conversion of files. DCFLDD is the DD version with Steroids Other tools: PCAT, WMFT, Memdump 16
17 Real investigation takes place Two steps: Analysis Settings goals and criteria Timeline creation bedrock of the investigation. Everything centers around it. Map of activities. Data Recovery Key function of forensics. 17
18 Examining Media Goals Software tools & Methodology The Examiner s notion of what s in/out What the customer wants Media Criteria Data 18
19 Setting Goal & Criteria I m looking for: The Case Who What When Where How Why In what objects will I find: The Evidence 19
20 Data Recovery What data we should recover? Create a dirty word list Extract unallocated disk units Search the image using the dirty list 20
21 Reporting Examination Output and Reporting: Ensure on preservation of the provided documentation Ensure on proper format Ensure on the output clarity and documentation logic Ensure it meets the examination goals and scope 21
22 Report Is treated as a legal document Represents the results of the forensic exam Informs and states an opinion Will be the basis for testimony examination Associated with lab notes and exhibits 22
23 Quality Assurance Report with notes and printout are reviewed Self-review Peer review Admin review Release a report only once the proper QA has been completed Any conflicts should be resolved prior to submission Can t pull a report back 23
24 Forensic Information Theory Media Data Information Evidence 24
25 Exhibit Presentation Exhibits are connected to the testimony as facilitating objects They are not considered as evidence by themselves They need to be backed up by illustration, oral representation, and explanation. Support technical documentation to jury 25
26 Ensure on Illustration Reason to have exhibits: Illustrate on the described technology Illustrate any associated process Illustrate findings and results 26
27 Exhibit Characteristics Size Should be viewable, noted and readable by anyone in the jury Should be clear and concise Should present a point Simple yet efficient Of professional quality 27
28 Exhibit Characteristics The following should be clear and easily identifiable: Case numbers Item numbers Physical/Logical locations etc Separate exhibits by item/section Technical Logical 28 etc
29 Demonstration Case An anonymous caller has informed a corporate security department that a trusted employee, Jack Lansky, has been selling the company s secrets to a corporate spy. The caller alleges that Lansky has sent company proprietary and/or Trade Secret information to Russians in return for a trip to the Caribbean. Based on this information, security officers began an investigation. Facts: Lansky has been reported being on a cruise at the Caribbean Lansky is a top level engineer who has access to the company's confidential and sensitive information There was found a 1GB DataTraveler Kingston USB drive on Lansky s desk drawer. The company already did their internal investigation, and decided to handle the USB drive s image acquisition and handling of chain of evidence. They didn t find anything of value regarding the case. Company decides to hire us for a second opinion on the case and the USB drive image. We are denied access to image Lansky s workstation. We further ask for a copy of the workstation s registry, which is provided to us. 29
30 Questions 30
Digital Forensics Tutorials Acquiring an Image with FTK Imager
Digital Forensics Tutorials Acquiring an Image with FTK Imager Explanation Section Digital Forensics Definition The use of scientifically derived and proven methods toward the preservation, collection,
MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1
MSc Computer Security and Forensics Cohort: MCSF/09B/PT Examinations for 2009-2010 / Semester 1 MODULE: COMPUTER FORENSICS & CYBERCRIME MODULE CODE: SECU5101 Duration: 2 Hours Instructions to Candidates:
Introduction. IMF Conference September 2008
Live Forensic Acquisition as Alternative to Traditional Forensic Processes Marthie Lessing* Basie von Solms Introduction The Internet and technology developments introduced a sharp increase in computer
Incident Response and Computer Forensics
Incident Response and Computer Forensics James L. Antonakos WhiteHat Forensics Incident Response Topics Why does an organization need a CSIRT? Who s on the team? Initial Steps Detailed Project Plan Incident
CCE Certification Competencies
CCE Certification Competencies May 10, 2012 Page 1 The Certified Computer Examiner (CCE) has evolved into one of the most desired certifications in the computer forensics industry. The certification is
Digital Forensic Techniques
Digital Forensic Techniques Namrata Choudhury, Sr. Principal Information Security Analyst, Symantec Corporation Professional Techniques T23 CRISC CGEIT CISM CISA AGENDA Computer Forensics vs. Digital Forensics
Impact of Digital Forensics Training on Computer Incident Response Techniques
Impact of Digital Forensics Training on Computer Incident Response Techniques Valorie J. King, PhD Collegiate Associate Professor University of Maryland University College Presentation to AFCEA June 25,
Introduction to Data Forensics. Jeff Flaig, Security Consultant January 15, 2014
Introduction to Data Forensics Jeff Flaig, Security Consultant January 15, 2014 WHAT IS COMPUTER FORENSICS Computer forensics is the process of methodically examining computer media (hard disks, diskettes,
COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL)
COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL) COURSE DESCRIPTION: Computer Forensics is focused on teaching
https://agency.governmentjobs.com/dakota/job_bulletin.cfm?jobid=1017820
Page 1 of 5 DAKOTA COUNTY Employee Relations Administration Center, 1590 Highway 55 Hastings, MN 55033-2372 651.438.4435 http://www.dakotacounty.us INVITES APPLICATIONS FOR THE POSITION OF: Electronic
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE. Vahidin Đaltur, Kemal Hajdarević,
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE Vahidin Đaltur, Kemal Hajdarević, Internacional Burch University, Faculty of Information Technlogy 71000 Sarajevo, Bosnia
Digital Forensic. A newsletter for IT Professionals. I. Background of Digital Forensic. Definition of Digital Forensic
I Digital Forensic A newsletter for IT Professionals Education Sector Updates Issue 10 I. Background of Digital Forensic Definition of Digital Forensic Digital forensic involves the collection and analysis
The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices
The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices Introduction As organizations rely more heavily on technology-based methods of communication, many corporations
Digital Forensics Tutorials Acquiring an Image with Kali dcfldd
Digital Forensics Tutorials Acquiring an Image with Kali dcfldd Explanation Section Disk Imaging Definition Disk images are used to transfer a hard drive s contents for various reasons. A disk image can
Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation
Computer Forensics and Digital Investigation Computer Security EDA263, lecture 14 Ulf Larson Lecture outline! Introduction to Computer Forensics! Digital investigation! Conducting a Digital Crime Scene
Scientific Working Group on Digital Evidence
Disclaimer: As a condition to the use of this document and the information contained therein, the SWGDE requests notification by e-mail before or contemporaneous to the introduction of this document, or
Case Study: Hiring a licensed Security Provider
Case Study: Hiring a licensed Security Provider Company Profile McCann Investigations is a full service private investigation firm providing complete case solutions by employing cutting-edge computer forensics
Digital Forensics & e-discovery Services
Digital Forensics & e-discovery Services U.S. Security Associates Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities
Computer Forensics Processing Checklist. Pueblo High-Tech Crimes Unit
Computer Forensics Processing Checklist Pueblo High-Tech Crimes Unit Cmdr. Dave Pettinari Pueblo County Sheriff's Office davepet@cops.org The purpose of this document is to provide computer forensic technicians
Digital Forensics & e-discovery Services
Digital Forensics & e-discovery Services Andrews International Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities
EnCase Implementation Statement of Work
EnCase Implementation Statement of Work This Statement of Work ( SOW ) is an agreement by and between Guidance Software, Inc., a Delaware corporation ( GSI ) and ( Customer ), and each party
Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers
Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers Brian Carrier Research Scientist @stake Abstract This paper uses the theory of abstraction layers to describe the purpose
Overview of Computer Forensics
Overview of Computer Forensics Don Mason, Associate Director National Center for Justice and the Rule of Law University of Mississippi School of Law [These materials are based on 4.3.1-4.3.3 in the National
What is Digital Forensics?
DEVELOPING AN UNDERGRADUATE COURSE IN DIGITAL FORENSICS Warren Harrison PSU Center for Information Assurance Portland State University Portland, Oregon 97207 warren@cs.pdx.edu What is Digital Forensics?
Incident Response and Forensics
Incident Response and Forensics Yiman Jiang, President and Principle Consultant Sumus Technology Ltd. James Crooks, Manager - Advisory Services PricewaterhouseCoopers LLP UBC 2007-04-12 Outline Computer
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student
2! Bit-stream copy. Acquisition and Tools. Planning Your Investigation. Understanding Bit-Stream Copies. Bit-stream Copies (contd.
Acquisition and Tools COMP 2555: Principles of Computer Forensics Autumn 2014 http://www.cs.du.edu/2555 1 Planning Your Investigation! A basic investigation plan should include the following activities:!
Guidelines on Digital Forensic Procedures for OLAF Staff
Ref. Ares(2013)3769761-19/12/2013 Guidelines on Digital Forensic Procedures for OLAF Staff 1 January 2014 Introduction The OLAF Guidelines on Digital Forensic Procedures are internal rules which are to
DATABASE ANALYST I DATABASE ANALYST II
CITY OF ROSEVILLE DATABASE ANALYST I DATABASE ANALYST II DEFINITION To perform professional level work in designing, installing, managing, updating, and securing a variety of database systems, including
Cell Phone Forensics For Legal Professionals
1 Cell Phone Forensics For Legal Professionals Lars E. Daniel, EnCE, ACE, AME, CTNS, SCE, SCCM, SCA Digital Forensics Examiner Cell Phone Acquisition and Examination Collection and Acquiring Cell Phones
EnCase Implementation Statement of Work
EnCase Implementation Statement of Work This Statement of Work ( SOW ) is an agreement by and between Guidance Software, Inc., a Delaware corporation ( GSI ) and ( Customer ), and each party
Best Practices for Computer Forensics
Scientific Working Group on Digital Evidence Best Practices for Computer Forensics Disclaimer: As a condition to the use of this document and the information contained therein, the SWGDE requests notification
A Short Introduction to Digital and File System Forensics
Antonio Barili Lab Dept. of Industrial and Information Engineering University of Pavia (Italy) antonio.barili@unipv.it Every contact leaves a trace Culprit Scene Victim Edmond Locard (1877-1966) 2015 -
Information Technology Audit & Forensic Techniques. CMA Amit Kumar
Information Technology Audit & Forensic Techniques CMA Amit Kumar 1 Amit Kumar & Co. (Cost Accountants) A perfect blend of Tax, Audit & Advisory services Information Technology Audit & Forensic Techniques
Ricoh Legal. Live Data Acquisition: The New Default Standard for Capturing ESI?
Ricoh Legal Live Data Acquisition: The New Default Standard for Capturing ESI? By David Greetham, National Director of Forensics, Legal Enterprise Solutions Live computer forensic imaging, which is performed
Data Security Breach. How to Respond
Data Security Breach How to Respond About ERM About The Speaker Information Security Director at ERM CISSP, CISA, CRISC, PCIP, PCI-QSA Core Experience: Information Assurance Computer Forensics Penetration
CYBER FORENSICS (W/LAB) Course Syllabus
6111 E. Skelly Drive P. O. Box 477200 Tulsa, OK 74147-7200 CYBER FORENSICS (W/LAB) Course Syllabus Course Number: CSFS-0020 OHLAP Credit: Yes OCAS Code: 8134 Course Length: 130 Hours Career Cluster: Information
Page 1 of 5 Position Code #P10260. Forensic Identification - Technological Crimes Unit ASSOCIATION: Civilian LOCATION: Headquarters
Page 1 of 5 Position Code #P10260 POSITION TITLE: Computer Forensics DEPT./DIV.: Investigative Services Support Technician REPORTS TO: Sergeant, Technological Crimes Unit BRANCH: Forensic Identification
Getting Physical with the Digital Investigation Process
Getting Physical with the Digital Investigation Process Brian Carrier Eugene H. Spafford Center for Education and Research in Information Assurance and Security CERIAS Purdue University Abstract In this
Chapter 7 Securing Information Systems
1 Chapter 7 Securing Information Systems LEARNING TRACK 3: COMPUTER FORENSICS For thirty years, a serial murderer known as the BTK killer (standing for bind, torture, and kill) remained at large in Wichita,
Digital Forensics. Tom Pigg Executive Director Tennessee CSEC
Digital Forensics Tom Pigg Executive Director Tennessee CSEC Definitions Digital forensics Involves obtaining and analyzing digital information as evidence in civil, criminal, or administrative cases Analyze
CERIAS Tech Report 2003-29 GETTING PHYSICAL WITH THE DIGITAL INVESTIGATION PROCESS. Brian Carrier & Eugene H. Spafford
CERIAS Tech Report 2003-29 GETTING PHYSICAL WITH THE DIGITAL INVESTIGATION PROCESS Brian Carrier & Eugene H. Spafford Center for Education and Research in Information Assurance and Security, Purdue University,
Certified Digital Forensics Examiner
Cyber Security Training & Consulting Certified Digital COURSE OVERVIEW 5 Days 40 CPE Credits $3,000 Digital is the investigation and recovery of data contained in digital devices. This data is often the
CYBER FORENSICS. KRISHNA SASTRY PENDYALA Cyber Forensic Division Central Forensic Science Laboratory Hyderabad.
CYBER FORENSICS KRISHNA SASTRY PENDYALA Cyber Forensic Division Central Forensic Science Laboratory Hyderabad. 11 DIGITAL EVIDENCE? Cyber crimes Digital evidence Digital evidence is any information of
e Shandor Simon Director, Networking Services Latin School of Chicago
Lessons Learned about Consolidation, Virtualization at and Disaster Recovery e Shandor Simon Director, Networking Services Latin School of Chicago Agenda The Latin School of Chicago Why redundancy and
To Catch a Thief: Computer Forensics in the Classroom
To Catch a Thief: Computer Forensics in the Classroom Anna Carlin acarlin@csupomona.edu Steven S. Curl scurl@csupomona.edu Daniel Manson dmanson@csupomona.edu Computer Information Systems Department California
Computer Forensic Capabilities
Computer Forensic Capabilities Agenda What is computer forensics? Where to find computer evidence Forensic imaging Forensic analysis What is Computer Forensics? The preservation, identification, extraction,
Hands-On How-To Computer Forensics Training
j8fm6pmlnqq3ghdgoucsm/ach5zvkzett7guroaqtgzbz8+t+8d2w538ke3c7t 02jjdklhaMFCQHihQAECwMCAQIZAQAKCRDafWsAOnHzRmAeAJ9yABw8v2fGxaq skeu29sdxrpb25zidxpbmznogtheories...ofhilz9e1xthvqxbb0gknrc1ng OKLbRXF/j5jJQPxXaNUu/It1TQHSiyEumrHNsnn65aUMPnrbVOVJ8hV8NQvsUE
Massachusetts Digital Evidence Consortium. Digital Evidence Guide for First Responders
Massachusetts Digital Evidence Consortium Digital Evidence Guide for First Responders May 2015 Digital Evidence Guide for First Responders - MDEC A Note to the Reader There are an unlimited number of legal
Acronis Backup & Recovery 11
Acronis Backup & Recovery 11 Quick Start Guide Applies to the following editions: Advanced Server Virtual Edition Advanced Server SBS Edition Advanced Workstation Server for Linux Server for Windows Workstation
Reduce Cost and Risk during Discovery E-DISCOVERY GLOSSARY
2016 CLM Annual Conference April 6-8, 2016 Orlando, FL Reduce Cost and Risk during Discovery E-DISCOVERY GLOSSARY Understanding e-discovery definitions and concepts is critical to working with vendors,
Open Source Digital Forensics Tools
The Legal Argument 1 carrier@cerias.purdue.edu Abstract This paper addresses digital forensic analysis tools and their use in a legal setting. To enter scientific evidence into a United States court, a
Reading Materials: Required Text Book: Marjie T. Britz (2009). COMPUTER FORENSICS AND CYBER CRIME; ISBN-13: 978-0-13-135205-6; 2 nd
New Jersey Institute of Technology (NJIT) IS682-101: Computer forensics I Fall, 2013 Instructor: Dr. Charles Pak Email: charlespak@verizon.net Email is the best way to contact me. Here is my cell number
Digital Forensics for Attorneys Overview of Digital Forensics
Lars Daniel,, EnCE, ACE, CTNS Digital Forensic Examiner Digital Forensics for Attorneys Overview of Digital Forensics Digital Forensics For Attorneys Overview of Digital Forensics Types of Digital Evidence
Digital Forensics, ediscovery and Electronic Evidence
Digital Forensics, ediscovery and Electronic Evidence By Digital Forensics What Is It? Forensics is the use of science and technology to investigate and establish facts in a court of law. Digital forensics
Where is computer forensics used?
What is computer forensics? The preservation, recovery, analysis and reporting of digital artifacts including information stored on computers, storage media (such as a hard disk or CD-ROM), an electronic
Journal of Digital Forensic Practice
Journal of Digital Forensic Practice Journal of Digital Forensic Practice, 2:57 61, 2008 Copyright Taylor & Francis Group, LLC ISSN: 1556-7281 print / 1556-7346 online DOI: 10.1080/15567280801958464 UDFP
Digital Forensics for Attorneys - Part 2
Lars Daniel, EnCE Digital Forensics for Attorneys - Part 2 Experts, Analysis, Challenging Evidence Digital Forensics For Attorneys Part I Overview of Digital Forensics Types of Digital Evidence Acquisition
The Role of Digital Forensics within a Corporate Organization
May 2006, IBSA Conference, Vienna The Role of Digital Forensics within a Corporate Organization Bruce J. Nikkel IT Investigation & Forensics Risk Control, UBS AG Presentation Summary An overview of digital
FORENSIC ANALYSIS OF USB MEDIA EVIDENCE. Jesús Alexander García. Luis Alejandro Franco. Juan David Urrea. Carlos Alfonso Torres
FORENSIC ANALYSIS OF USB MEDIA EVIDENCE Jesús Alexander García Luis Alejandro Franco Juan David Urrea Carlos Alfonso Torres Manuel Fernando Gutiérrez UPB 2012 Content INTRODUCTION... 3 OBJECTIVE 4 EVIDENCE
Digital Forensics. Larry Daniel
Digital Forensics Larry Daniel Introduction A recent research report from The Yankee Group found that 67.6 percent of US households in 2002 contained at least one PC The investigators foresee three-quarters
EC-Council Ethical Hacking and Countermeasures
EC-Council Ethical Hacking and Countermeasures Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
Just EnCase. Presented By Larry Russell CalCPA State Technology Committee May 18, 2012
Just EnCase Presented By Larry Russell CalCPA State Technology Committee May 18, 2012 What is e-discovery Electronically Stored Information (ESI) Discover or Monitor for Fraudulent Activity Tools used
Disaster Recovery Checklist Disaster Recovery Plan for <System One>
Disaster Recovery Plan for SYSTEM OVERVIEW PRODUCTION SERVER HOT SITE SERVER APPLICATIONS (Use bold for Hot Site) ASSOCIATED SERVERS KEY CONTACTS Hardware Vendor System Owners Database Owner
CERTIFIED DIGITAL FORENSICS EXAMINER
CERTIFIED DIGITAL FORENSICS EXAMINER KEY DATA Course Title: C)DFE Duration: 5 days CPE Credits: 40 Class Format Options: Instructor-led classroom Live Online Training Computer Based Training Who Should
Survey of the Operating Landscape Investigating Incidents in the Cloud
Survey of the Operating Landscape Investigating Incidents in the Cloud SESSION ID: CSV-T09 Paul A. Henry Security & Forensics Analyst vnet Security, LLC @phenrycissp Jacob Williams Chief Scientist CSRgroup
Acronis Backup & Recovery 11.5 Quick Start Guide
Acronis Backup & Recovery 11.5 Quick Start Guide Applies to the following editions: Advanced Server for Windows Virtual Edition Advanced Server SBS Edition Advanced Workstation Server for Linux Server
COWLEY COLLEGE & Area Vocational Technical School
COWLEY COLLEGE & Area Vocational Technical School COURSE PROCEDURE FOR Student Level: This course is open to students on the college level in either the freshman or sophomore year. Prerequisites: Basic
MFR IT Technical Guides
MFR IT Technical Guides Windows 7 Backup and Recovery Page 1 of 33 Table of Contents 1 Glossary... 3 2 Backup Strategy... 4 3 Windows Backup Options... 5 3.1 Windows Backup... 5 3.2 Windows System Image
About Your Presenter. Digital Forensics For Attorneys. Overview of Digital Forensics
Larry E. Daniel, EnCE, DFCP, BCE Digital Forensic Examiner Digital Forensics for Attorneys An Overview of Digital Forensics About Your Presenter EnCase Certified Examiner (EnCE) Digital Forensics Certified
How To Image A Single Vm For Forensic Analysis On Vmwarehouse.Com
MCP+I, MCSE, CCSA, CCSE, CISSP-ISSAP, CISM, CISA, CIFI, CCE, ACE, GCFE, GCFA, GSEC, VCP4/5, vexpert Senior SANS Instructor - phenry@sans.org 1 A Lot To Cover In ½ An Hour We simply can not cover all cloud
EnCase v7 Essential Training. Sherif Eldeeb https://eldeeb.net
هللامسب EnCase v7 Essential Training What s in this course Explore the most notable features of the new version. Everything you need to know about EnCase v7 to conduct basic investigations. Create Cases
Lab III: Unix File Recovery Data Unit Level
New Mexico Tech Digital Forensics Fall 2006 Lab III: Unix File Recovery Data Unit Level Objectives - Review of unallocated space and extracting with dls - Interpret the file system information from the
Computer Forensics as an Integral Component of the Information Security Enterprise
Computer Forensics as an Integral Component of the Information Security Enterprise By John Patzakis 10/28/03 I. EXECUTIVE SUMMARY In addition to fending off network intrusions and denial of service attacks,
Operating Systems Forensics
Operating Systems Forensics Section II. Basic Forensic Techniques and Tools CSF: Forensics Cyber-Security MSIDC, Spring 2015 Nuno Santos Summary! Windows boot sequence! Relevant Windows data structures!
Open Source and Incident Response
Open Source and Incident Response Joe Lofshult, CISSP, GCIH 1 Agenda Overview Open Source Tools FIRE Demonstration 2 Overview Incident Adverse event that threatens security in computing systems and networks.
InfoSec Academy Forensics Track
Fundamental Courses Foundational Courses InfoSec Academy Specialized Courses Advanced Courses Certification Preparation Courses Certified Information Systems Security Professional (CISSP) Texas Security
Hardware/Software Guidelines
There are many things to consider when preparing for a TRAVERSE v11 installation. The number of users, application modules and transactional volume are only a few. Reliable performance of the system is
How is Your Company Positioned to Deal With Law Enforcement?
How is Your Company Positioned to Deal With Law Enforcement? Tim Proffitt September 2009 GIAC GSEC, GCIH, GCPM, GSLC, GLEG, GSNA SANS Technology Institute - Candidate for Master of Science Degree 1 1 Introduction
Oracle VM Server Recovery Guide. Version 8.2
Oracle VM Server Recovery Guide Version 8.2 Oracle VM Server for x86 Recovery Guide The purpose of this document is to provide the steps necessary to perform system recovery of an Oracle VM Server for
Domain 1 The Process of Auditing Information Systems
Certified Information Systems Auditor (CISA ) Certification Course Description Our 5-day ISACA Certified Information Systems Auditor (CISA) training course equips information professionals with the knowledge
Computer Forensics using Open Source Tools
Computer Forensics using Open Source Tools COMP 5350/6350 Digital Forensics Professor: Dr. Anthony Skjellum TA: Ananya Ravipati Presenter: Rodrigo Sardinas Overview Use case explanation Useful Linux Commands
Course Forensic Science. Unit II History
Course Forensic Science Unit II History Essential Question What is legally and ethically expected of forensic scientists and Crime Scene Investigators? TEKS 130.295(c) (4)(C) Prior Student Learning History
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING MODULE A INTRODUCTION TO COMPUTER FORENSICS AND NVESTIGATIONS A1.0 Explain concepts related to computer forensics. A1.1 This module is measured
CDFE Certified Digital Forensics Examiner (CFED Replacement)
Course: CDFE Certified Digital Forensics Examiner (CFED Replacement) Description: Price: $3,450.00 Category: Popular Courses Duration: 5 days Schedule: Request Dates Outline: COURSE OVERVIEW Computer Forensics
Monfort College of Business Semester Course Syllabus (2015-2016)
Monfort College of Business Semester Course Syllabus (2015-2016) COURSE PREFIX/TITLE: BACS 371 Introduction to Computer Forensics Sem. Hrs. 3 Ed. Cap: 40 CATALOG DESCRIPTION: Prerequisite: BACS 300 or
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065 Introduction The Computer Forensics and Investigation course presents methods to properly conduct a computer forensics investigation
ITU Session Four: Device Imaging And Analysis. Mounir Kamal Q-CERT
ITU Session Four: Device Imaging And Analysis Mounir Kamal Q-CERT 2 Applying Forensic Science to Computer Systems Like a Detective, the archaeologist searches for clues in order to discover and reconstruct
Legal view of digital evidence
Chapter 2 Legal view of digital evidence Before developing a model or a theory, it is important to understand the requirements of the domain in which the model or the theory is going to be used. The ultimate
BDO CONSULTING FORENSIC TECHNOLOGY SERVICES
BDO CONSULTING FORENSIC TECHNOLOGY SERVICES MARCH 2013 AGENDA Introduction About BDO Consulting Computer Forensics & E-Discovery Practice Current Trends Case Studies Q&A Page 2 Michael Barba Managing Director,
CONCEPT MAPPING FOR DIGITAL FORENSIC INVESTIGATIONS
Chapter 22 CONCEPT MAPPING FOR DIGITAL FORENSIC INVESTIGATIONS April Tanner and David Dampier Abstract Research in digital forensics has yet to focus on modeling case domain information involved in investigations.
IAPE STANDARDS SECTION 16 DIGITAL EVIDENCE
IAPE STANDARDS SECTION 16 DIGITAL EVIDENCE IAPE STANDARD SECTION 16.1 DIGITAL EVIDENCE Standard: Digital evidence is a critical element of modern criminal investigation that should be maintained in strict
Chapter 4. Operating Systems and File Management
Chapter 4 Operating Systems and File Management Chapter Contents Section A: Operating System Basics Section B: Today s Operating Systems Section C: File Basics Section D: File Management Section E: Backup
ESI Risk Assessment: Critical in Light of the new E-discovery and notification laws
ESI Risk Assessment: Critical in Light of the new E-discovery and notification laws Scott Bailey, CISM Christopher Sobota, J.D. Enterprise Risk Management Group Disclaimer This presentation is for informational
Case study on asset tracing
Recovering Stolen Assets: A Practitioner s Handbook ARNO THUERIG * Case study on asset tracing I. Case study background The client adviser of a Swiss private bank transferred approximately USD 1 million
Managed Security Services SLA Document. Response and Resolution Times
Managed Security Services SLA Document Appendix A Response and Resolution Times The following table shows the targets of response and resolution times for each priority level: Trouble Priority Response
Digital Forensics Lecture 3. Hard Disk Drive (HDD) Media Forensics
Digital Forensics Lecture 3 Hard Disk Drive (HDD) Media Forensics Current, Relevant Topics defendants should not use disk-cleaning utilities to wipe portions of their hard drives before turning them over
922-280 Avamar Backup and Data De-duplication Exam
922-280 Avamar Backup and Data De-duplication Exam Q&A DEMO Version Copyright (c) 2007 Chinatag LLC. All rights reserved. Important Note Please Read Carefully For demonstration purpose only, this free
The E-Discovery Process
POOLING PROVISIONS The E-Discovery Process A publication of Nevada Public Agency Insurance Pool The e- discovery process the search of electronic records for use as legal evidence can cost thousands of