Regional Computer Forensic Laboratory & Digital Forensics. Presented By: D. Justin Price FBI - Philadelphia Computer Analysis Response Team
|
|
|
- Wendy Simon
- 8 years ago
- Views:
Transcription
1 Regional Computer Forensic Laboratory & Digital Forensics Presented By: D. Justin Price FBI - Philadelphia Computer Analysis Response Team
2 Objectives
3 Objectives RCFL Program Overview PHRCFL Services Forensic Capabilities Forensic Process Career with the FBI
4 Philadelphia Regional Computer Forensics Laboratory The PHRCFL is a multi-agency partnership of federal, state and local law enforcement agencies engaged in serving the computer forensics needs of several counties within the Greater Philadelphia area.
5 Philadelphia Regional Computer Forensics Laboratory The PHRCFL is a multi-agency partnership of federal, state and local law enforcement agencies engaged in serving the computer forensics needs of several counties within the Greater Philadelphia area.
6 Philadelphia Regional Computer Forensics Laboratory The PHRCFL is a multi-agency partnership of federal, state and local law enforcement agencies engaged in serving the computer forensics needs of several counties within the Greater Philadelphia area.
7 Philadelphia Regional Computer Forensics Laboratory The PHRCFL is a multi-agency partnership of federal, state and local law enforcement agencies engaged in serving the computer forensics needs of several counties within the Greater Philadelphia area.
8 Philadelphia Regional Computer Forensics Laboratory The PHRCFL is a multi-agency partnership of federal, state and local law enforcement agencies engaged in serving the computer forensics needs of several counties within the Greater Philadelphia area.
9 Philadelphia Regional Computer Forensics Laboratory The PHRCFL is a multi-agency partnership of federal, state and local law enforcement agencies engaged in serving the computer forensics needs of several counties within the Greater Philadelphia area.
10 Computer Forensics?
11 Computer Forensics? The scientific examination of digital evidence for the purpose of presenting findings during court proceedings. A verifiable and repeatable process that protects the integrity of original evidence and renders it unchanged.
12 What is Digital Evidence? Computers (Desktops, Laptops, Servers ) Windows, Macintosh, Linux Removable Media Magnetic Media, Flash Disks, Optical Media, etc. PDAs Palm/Windows CE/Blackberry) Palm OS, Windows CE and Blackberry Cell Phones Audio/Visual Systems (i.e. Surveillance) Networks Servers, SAN, NAS, etc.
13
14
15
16
17
18
19
20
21 Digital Storage Media USB Watch Stores Data
22 Digital Storage Media USB Watch Stores Data
23 Digital Storage Media USB Watch Stores Data
24 Digital Storage Media USB Watch Stores Data
25 Digital Storage Media USB Watch Stores Data
26 Digital Storage Media USB Watch Stores Data
27 Digital Storage Media USB Watch Stores Data
28 Digital Storage Media
29 Digital Storage Media The key chain is a wireless device that communicates with the USB device. If the two devices get separated by more than 2 meters, the hard drive is encrypted.
30 As a Result: Traditional Crimes are producing digital evidence (lots!) Cyber Crimes are producing complex digital evidence Law enforcement, at all levels are unprepared for data glut, Information famine One solution...
31 Regional Computer Forensic Laboratory (RCFL) A one stop, full service forensic laboratory devoted entirely to the examination of digital evidence in support of criminal investigations A unique law enforcement partnership that promotes quality and strengthens computer forensics laboratory capacity
32 RCFL Video
33 Typical RCFL Organization Local Executive Board State and local positions
34 RCFL Evolution NT NT NT SD SD SD SD SD st Selection SV CG KC NJRCFL WNYRCFL NWRCFL GHRCFL IWRCFL SVRCFL HARCFL CGRCFL 2003 NTRCFL SDRCFL Philadelphia Dayton Denver Philadelphia NJRCFL WNYRCFL PNWRCFL GHRCFL IWRCFL SVRCFL HARCFL CGRCFL NTRCFL SDRCFL nd Selection
35 Status of National Program
36 Why was the program launched? Increase the law enforcement s capability to investigate crimes and detect and prevent acts of terrorism Respond to rapidly growing demand for digital forensic examination services Enhance the FBI s support state and local law enforcement Combine the talents and resources of law enforcement agencies at all levels
37 PHRCFL Services Offered Digital Forensic Examination All submitted criminal Evidence from service area Assistance to law enforcement agencies Warrant Service Consulting and assistance prior to service. On-site evidence examination when needed Training Search and Seizure ImageScan Understanding the Forensic Report
38 Specialization ASCLD Digital Forensics Computers Audio Video FBI CART WinTel ( Windows / Intel based ) Macintosh Unix / Linux PDA Cell Phones
39 Examiner Equipment Wintel Two Dell 690 Precisions MPC Transport 3200 Laptop Logicube Talon Imaging Devices HP Laser Printer Digital Camera Sony Digital Photo Printer Wiebetech RT5 (RAID Box) Wiebetech Forensic Combodocks SCSI Cards and Cables Media Card Readers Various Software Suites Pelican Search Case Reference Library Linux Gigabit Switches Gigabit NICs Cables Reference Library PDA Garmin ique M4 Various PDA Cable Kit Reference Library Cell Phone SIM Card Readers DataPilot Forensic Cell Phone Kit Reference Library Macintosh Mac Pro Macbook Pro Various Software Suites Reference Library Each program procures equipment upgrades each year
40 Types of Investigations Terrorism Child Pornography Homicide Violent Crimes The Theft or Destruction of Intellectual Property Internet Crime Fraud Public Corruption Every Investigation...
41 Cases By Priority 1) Terrorism Neutralize, dismantle, and prevent terrorist acts against American citizens and assets. 2) Counterintelligence Expose, prevent, and investigate illegal activities on U.S. soil with a focus on keeping weapons of mass destruction and other embargoed technologies from foreign enemies, protecting the secrets of the U.S. intelligence community, protecting the secrets of the U.S. Government and contractors, protecting our nation s critical national assets; and focusing on countries that pose the greatest threat to the United States. 3) Cybercrimes Track and trace persons who use the Internet and computers to illegally penetrate business and government computer systems, including stealing trade secrets and intellectual property, trafficking in child pornography, enticing children from the safety of their homes, and infrastructure protection such as computer networks and power grids. 4) Public corruption Investigate public officials and those acting under the color of law to seek financial gain based on the public s trust. These acts include embezzlement, voter fraud, subsidy fraud, illegal kickbacks, and bribes committed by government and/or elected officials.
42 Cases By Priority 5) Civil rights Investigate hate crimes, involuntary servitude/slavery, and blocking patients from accessing health clinics. 6) Organized Crime Investigate and infiltrate entire organizations that are established for the purpose of committing a host of criminal activities for financial gain or territorial control through various means, including threats, intimidation, and collusion. 7) White Collar Crime Investigate and trace financial transactions that are deliberately deceptive and have the sole purpose of deriving unlawful financial gain at the public s expense. Corporate fraud can take place in the areas of health care, mortgage lending, identity theft, insurance, telemarketing, and asset forfeiture/money laundering. 8) Major Thefts/Violent Crime Investigate and prevent crimes against children, such as molestation, kidnappings, and those criminal acts, including homicide, committed by gangs and drug traffickers.
43 FY06 RCFL Program Accomplishments at a Glance Accepted 4,214 requests for assistance Trained 3,262 law enforcement personnel Conducted 4,500 digital forensics examinations Available to more than 3,500 law enforcement agencies across 11 states Participated in 803 search and seizure operations Processed 916 terabytes of data
44 CART Capabilities Analyze IBM compatible CPUs, Macintosh, Linux, Unix, optical media, magnetic media, PDAs and cell phones. Analyze Servers ( , Web, File, etc.), RAID Arrays (Hardware and Software), SANs, etc. Create a complete file listing of each exhibit with all attributes. Recover deleted data. Recover deleted partitions. Recover data from formatted media. Recover text from password protected and/or encrypted documents. Disable boot-up passwords. Recover text fragments from chat rooms and instant messaging. Recover files that have not been saved, but printed or scanned. Recover computer s internet activity. Generate a timeline of computer activity. Recover Data from Registry (i.e. passwords, recent chats, etc.)
45 CART Capabilities Analyze IBM compatible CPUs, Macintosh, Linux, Unix, optical media, magnetic media, PDAs and cell phones. Analyze Servers ( , Web, File, etc.), RAID Arrays (Hardware and Software), SANs, etc. Create a complete file listing of each exhibit with all attributes. Recover deleted data. Recover deleted partitions. Recover data from formatted media. Recover text from password protected and/or encrypted documents. Disable boot-up passwords. Recover text fragments from chat rooms and instant messaging. Recover files that have not been saved, but printed or scanned. Recover computer s internet activity. Generate a timeline of computer activity. Recover Data from Registry (i.e. passwords, recent chats, etc.)
46 CART Capabilities Analyze IBM compatible CPUs, Macintosh, Linux, Unix, optical media, magnetic media, PDAs and cell phones. Analyze Servers ( , Web, File, etc.), RAID Arrays (Hardware and Software), SANs, etc. Create a complete file listing of each exhibit with all attributes. Recover deleted data. Recover deleted partitions. Recover data from formatted media. Recover text from password protected and/or encrypted documents. Disable boot-up passwords. Recover text fragments from chat rooms and instant messaging. Recover files that have not been saved, but printed or scanned. Recover computer s internet activity. Generate a timeline of computer activity. Recover Data from Registry (i.e. passwords, recent chats, etc.)
47 CART Capabilities Analyze IBM compatible CPUs, Macintosh, Linux, Unix, optical media, magnetic media, PDAs and cell phones. Analyze Servers ( , Web, File, etc.), RAID Arrays (Hardware and Software), SANs, etc. Create a complete file listing of each exhibit with all attributes. Recover deleted data. Recover deleted partitions. Recover data from formatted media. Recover text from password protected and/or encrypted documents. Disable boot-up passwords. Recover text fragments from chat rooms and instant messaging. Recover files that have not been saved, but printed or scanned. Recover computer s internet activity. Generate a timeline of computer activity. Recover Data from Registry (i.e. passwords, recent chats, etc.)
48 What are the problems? Often, computers are not in pristine condition when they arrive for examination. They are occasionally: Burned Water-logged Shot Dropped Bludgeoned Just such antiques that the technology to retrieve information from them no longer exists.
49 Where is digital evidence? Digital Information in evidence may be: Encrypted Compressed Hidden Deleted In free space Password-protected In all cases, attempts must be made to render the information viewable.
50
51
52
53
54
55
56 What is the Process? With legal authority, evidence is seized Evidence is collected and a chain of custody begins The case investigator requests an examination for certain (relevant) items It is admitted into the Laboratory and documented by barcode, photograph and markings. It is prioritized and assigned to an Examiner The Examiner further photographs and marks the evidence to ensure uniqueness Protocols are followed to ensure that the digital evidence is unchanged and an archive image is made. Subsequent examination is of the archive image, not the original evidence unless otherwise unfeasible.
57 Protecting the Original Evidence Hardware Write-Blocking Devices Logicube Talon Device Wiebetech Forensic ComboDock A-Card Software Write-Blocking Devices Linux (Mounting Read-Only) Windows Write-Blocking Software (In-House Product)
58 Protecting the Original Evidence Hardware Write-Blocking Devices Logicube Talon Device Wiebetech Forensic ComboDock A-Card Software Write-Blocking Devices Linux (Mounting Read-Only) Windows Write-Blocking Software (In-House Product)
59 Protecting the Original Evidence Hardware Write-Blocking Devices Logicube Talon Device Wiebetech Forensic ComboDock A-Card Software Write-Blocking Devices Linux (Mounting Read-Only) Windows Write-Blocking Software (In-House Product)
60 How is digital media copied? All tools has been tested and verified by the FBI. All tools create a low level bit-by-bit copy of the original physical device. Forensic suites use the MD5 and/or SHA2 algorithm to verify the image s authenticity. Physical Devices Logicube Software Devices Linux DD command EnCase Forensic Tool Kit (FTK)
61 Imaging in the Laboratory Hard Drives External Hard Drives SAN HP Ultrium 960
62 On-Site Imaging Mobile SAN Wiebetech RT5 RAID Falcon
63 The Process (continued) Hardware, software, programs, techniques, and skills are employed to uncover and render viewable any relevant information from the device: messages are made viewable Deleted files are restored File remnants in slack are carved and restored Compressed files are opened and examined Passworded files are bypassed and made viewable Encrypted files are identified and broken in most cases Steganographic files are identified Databases are reconstructed and made workable Other things happen depending on need Meticulous notes are kept so that each step could be repeated by another examiner to get the same result
64
65
66 The Process (continued) A file listing, logs, and relevant files are copied to an unalterable media, usually CD-R or DVD-R as archive A report of the examination process and the contents of the report media ( CD-R or DVD-R ) is made The case file is submitted to another Examiner for Peer Review to ensure that all protocols were followed and that the report matches what was requested The case is returned to the Examiner and then submitted to the Laboratory Director for Administrative Review Once all reviews are satisfied, the case investigator is notified to pick up the report and evidence from the Lab. The chain of custody, reports, report media, notes, receipts, legal authority and logs are archived.
67 A Career with the FBI Visit for all jobs postings CART positions are posted as IT Specialist (Forensic Examiner) GS 11/12/13 ($57,845 to $107,185) All applicants must have a baccalaureate degree with at least 20 semester hours in one or more of the following disciplines: computer science, information systems analysis, science/technology, information management, mathematics, computer engineering, or electrical/ electronic engineering. Must pass (survive) intensive background investigation for TS level clearance.
68 Contact Information
69 Contact Information D. Justin Price Federal Bureau of Investigation Computer Analysis Response Team 201 King of Prussia Road, Suite 300 Radnor, PA QUESTIONS??
How To Improve The Criminal Justice System
Regional Computer Forensic Laboratory (RCFL) National Program Office (NPO) Commonwealth of Virginia Joint Commission on Technology and Science September 8, 2004 Search Warrant What is an RCFL? A Regional
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065 Introduction The Computer Forensics and Investigation course presents methods to properly conduct a computer forensics investigation
Certified Digital Forensics Examiner
Cyber Security Training & Consulting Certified Digital COURSE OVERVIEW 5 Days 40 CPE Credits $3,000 Digital is the investigation and recovery of data contained in digital devices. This data is often the
COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL)
COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL) COURSE DESCRIPTION: Computer Forensics is focused on teaching
MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1
MSc Computer Security and Forensics Cohort: MCSF/09B/PT Examinations for 2009-2010 / Semester 1 MODULE: COMPUTER FORENSICS & CYBERCRIME MODULE CODE: SECU5101 Duration: 2 Hours Instructions to Candidates:
Computer Forensic Capabilities
Computer Forensic Capabilities Agenda What is computer forensics? Where to find computer evidence Forensic imaging Forensic analysis What is Computer Forensics? The preservation, identification, extraction,
Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition
APR. 08 Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition Cover photographs copyright 2001 PhotoDisc, Inc. NCJ 219941 Chapter 1. Electronic Devices: Types, Description,
Supporting Law Enforcement's Needs in the Digital Age
Supporting Law Enforcement's Needs in the Digital Age 4600 Bohannon Drive, Suite 200 Menlo Park, CA 94025 (650) 289-3000 www.rcfl.gov www.svrcfl.net info@svrcfl.net ACLURM014355 FBI014469 Contact Information
CERTIFIED DIGITAL FORENSICS EXAMINER
CERTIFIED DIGITAL FORENSICS EXAMINER KEY DATA Course Title: C)DFE Duration: 5 days CPE Credits: 40 Class Format Options: Instructor-led classroom Live Online Training Computer Based Training Who Should
Case Study: Smart Phone Deleted Data Recovery
Case Study: Smart Phone Deleted Data Recovery Company profile McCann Investigations is a full service private investigations firm providing complete case solutions by employing cutting-edge computer forensics
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING MODULE A INTRODUCTION TO COMPUTER FORENSICS AND NVESTIGATIONS A1.0 Explain concepts related to computer forensics. A1.1 This module is measured
Case Study: Hiring a licensed Security Provider
Case Study: Hiring a licensed Security Provider Company Profile McCann Investigations is a full service private investigation firm providing complete case solutions by employing cutting-edge computer forensics
Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation
Computer Forensics and Digital Investigation Computer Security EDA263, lecture 14 Ulf Larson Lecture outline! Introduction to Computer Forensics! Digital investigation! Conducting a Digital Crime Scene
IAPE STANDARDS SECTION 16 DIGITAL EVIDENCE
IAPE STANDARDS SECTION 16 DIGITAL EVIDENCE IAPE STANDARD SECTION 16.1 DIGITAL EVIDENCE Standard: Digital evidence is a critical element of modern criminal investigation that should be maintained in strict
Battling Current Technological Trends
Law Enforcement Incident Response to Cybercrimes & Battling Current Technological Trends Corey J. Bourgeois, Computer Forensic Examiner & David Ferris, Investigator Louisiana Department of Justice HTCU
The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices
The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices Introduction As organizations rely more heavily on technology-based methods of communication, many corporations
Case Study: Mobile Device Forensics in Texting and Driving Cases
Case Study: Mobile Device Forensics in Texting and Driving Cases Company Profile McCann Investigations is a full service private investigation firm providing complete case solutions by employing cutting-edge
ITU Session Four: Device Imaging And Analysis. Mounir Kamal Q-CERT
ITU Session Four: Device Imaging And Analysis Mounir Kamal Q-CERT 2 Applying Forensic Science to Computer Systems Like a Detective, the archaeologist searches for clues in order to discover and reconstruct
Hands-On How-To Computer Forensics Training
j8fm6pmlnqq3ghdgoucsm/ach5zvkzett7guroaqtgzbz8+t+8d2w538ke3c7t 02jjdklhaMFCQHihQAECwMCAQIZAQAKCRDafWsAOnHzRmAeAJ9yABw8v2fGxaq skeu29sdxrpb25zidxpbmznogtheories...ofhilz9e1xthvqxbb0gknrc1ng OKLbRXF/j5jJQPxXaNUu/It1TQHSiyEumrHNsnn65aUMPnrbVOVJ8hV8NQvsUE
2! Bit-stream copy. Acquisition and Tools. Planning Your Investigation. Understanding Bit-Stream Copies. Bit-stream Copies (contd.
Acquisition and Tools COMP 2555: Principles of Computer Forensics Autumn 2014 http://www.cs.du.edu/2555 1 Planning Your Investigation! A basic investigation plan should include the following activities:!
Digital Forensics for Attorneys Overview of Digital Forensics
Lars Daniel,, EnCE, ACE, CTNS Digital Forensic Examiner Digital Forensics for Attorneys Overview of Digital Forensics Digital Forensics For Attorneys Overview of Digital Forensics Types of Digital Evidence
Information Technologies and Fraud
Information Technologies and Fraud Florin Gogoasa CISA, CFE, CGEIT, CRISC ACFE Romania - Founder and Board member Managing Partner Blue Lab Consulting Information Technologies for Fraud investigation A.
Digital Forensics Tutorials Acquiring an Image with FTK Imager
Digital Forensics Tutorials Acquiring an Image with FTK Imager Explanation Section Digital Forensics Definition The use of scientifically derived and proven methods toward the preservation, collection,
Digital Forensic Techniques
Digital Forensic Techniques Namrata Choudhury, Sr. Principal Information Security Analyst, Symantec Corporation Professional Techniques T23 CRISC CGEIT CISM CISA AGENDA Computer Forensics vs. Digital Forensics
Digital Forensics. Larry Daniel
Digital Forensics Larry Daniel Introduction A recent research report from The Yankee Group found that 67.6 percent of US households in 2002 contained at least one PC The investigators foresee three-quarters
Information Technology Audit & Forensic Techniques. CMA Amit Kumar
Information Technology Audit & Forensic Techniques CMA Amit Kumar 1 Amit Kumar & Co. (Cost Accountants) A perfect blend of Tax, Audit & Advisory services Information Technology Audit & Forensic Techniques
Overview of Computer Forensics
Overview of Computer Forensics Don Mason, Associate Director National Center for Justice and the Rule of Law University of Mississippi School of Law [These materials are based on 4.3.1-4.3.3 in the National
EC-Council Ethical Hacking and Countermeasures
EC-Council Ethical Hacking and Countermeasures Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
How To Get A Computer Hacking Program
CHFI v8(computer Hacking Forensics Investigator) Course Description & Overview Overview CHFIv8 Course Description EC-Council releases the brand new Version 8 of the Computer Hacking Forensics Investigator
Scientific Working Group on Digital Evidence
Disclaimer: As a condition to the use of this document and the information contained therein, the SWGDE requests notification by e-mail before or contemporaneous to the introduction of this document, or
Chapter 7 Securing Information Systems
1 Chapter 7 Securing Information Systems LEARNING TRACK 3: COMPUTER FORENSICS For thirty years, a serial murderer known as the BTK killer (standing for bind, torture, and kill) remained at large in Wichita,
MISSISSIPPI DEPARTMENT OF HEALTH COMPUTER NETWORK AND INTERNET ACCESS POLICY
MEMORANDUM TO: FROM: RE: Employee Human Resources MISSISSIPPI DEPARTMENT OF HEALTH COMPUTER NETWORK AND INTERNET ACCESS POLICY Please find attached the above referenced policy that is being issued to each
e-discovery Forensics Incident Response
e-discovery Forensics Incident Response NetSecurity Corporation 21351 Gentry Drive Suite 230 Dulles, VA 20166 VA DCJS # 11-5605 Phone: 703.444.9009 Toll Free: 1.866.664.6986 Web: www.netsecurity.com Email:
Developing Computer Forensics Solutions for Terabyte Investigations
Developing Computer Forensics Solutions for Terabyte Investigations Eric Thompson Corporation Orem, Utah USA www.accessdata.com Overview Computer Forensic Definition, Objectives and Policies History of
Digital Forensics. Tom Pigg Executive Director Tennessee CSEC
Digital Forensics Tom Pigg Executive Director Tennessee CSEC Definitions Digital forensics Involves obtaining and analyzing digital information as evidence in civil, criminal, or administrative cases Analyze
Computer Forensics in Virginia. Presented by: Computer Forensic Examiner Christine Bryce and First Sergeant Rob Keeton
Computer Forensics in Virginia Presented by: Computer Forensic Examiner Christine Bryce and First Sergeant Rob Keeton What is Computer Crime? Romanticized notion of High Tech crimes High Tech crime portrayed
Digital Forensics & e-discovery Services
Digital Forensics & e-discovery Services U.S. Security Associates Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities
SAMPLE ELECTRONIC DISCOVERY INTERROGATORIES AND REQUESTS FOR PRODUCTION
Below are SAMPLE interrogatories and requests for production that are meant to be complementary (i.e., any devices or electronic files that are identified in answer to an interrogatory or interrogatories
ITM 642: Digital Forensics Sanjay Goel School of Business University at Albany, State University of New York
INSTRUCTOR INFORMATION Name: Sanjay Goel Email: goel@albany.edu Phone: (518) 442-4925 Office Location: BA 310b, University at Albany Office Hours: TBD CLASS INFORMATION Time: N/A Location: Online Dates:
Digital Forensics & e-discovery Services
Digital Forensics & e-discovery Services Andrews International Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities
CDFE Certified Digital Forensics Examiner (CFED Replacement)
Course: CDFE Certified Digital Forensics Examiner (CFED Replacement) Description: Price: $3,450.00 Category: Popular Courses Duration: 5 days Schedule: Request Dates Outline: COURSE OVERVIEW Computer Forensics
Sensitive Incident Investigations. Digital Risk Management. Forensics Testing.
Sensitive Incident Investigations. Digital Risk Management. Forensics Testing. 2009 Innovation Award Winner Austin Chamber of Commerce 2010 Innovation Award Finalist Austin Chamber of Commerce Only private
Computer Forensics Processing Checklist. Pueblo High-Tech Crimes Unit
Computer Forensics Processing Checklist Pueblo High-Tech Crimes Unit Cmdr. Dave Pettinari Pueblo County Sheriff's Office davepet@cops.org The purpose of this document is to provide computer forensic technicians
Course Title: Computer Forensic Specialist: Data and Image Files
Course Title: Computer Forensic Specialist: Data and Image Files Page 1 of 9 Course Description The Computer Forensic Series by EC-Council provides the knowledge and skills to identify, track, and prosecute
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE. Vahidin Đaltur, Kemal Hajdarević,
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE Vahidin Đaltur, Kemal Hajdarević, Internacional Burch University, Faculty of Information Technlogy 71000 Sarajevo, Bosnia
Scene of the Cybercrime Second Edition. Michael Cross
Scene of the Cybercrime Second Edition Michael Cross Chapter 1 Facing the Cybercrime Problem Head-On 1 Introduction 2 Defining Cybercrime 2 Understanding the Importance of Jurisdictional Issues 3 Quantifying
Building FBI computer forensics capacity: one lab at a time
Digital Investigation (2004) 1, 177e182 www.elsevier.com/locate/diin Building FBI computer forensics capacity: one lab at a time Douglas A. Schmitknecht FBI, USA The Federal Bureau of Investigation (FBI)
The Contribution of Tool Testing to the Challenge of Responding to an IT Adversary
The Contribution of Tool Testing to the Challenge of Responding to an IT Adversary Jim Lyle National Institute of Standards and Technology 23 October 2006 10/18/2006 1 DISCLAIMER Certain trade names and
To Catch a Thief: Computer Forensics in the Classroom
To Catch a Thief: Computer Forensics in the Classroom Anna Carlin acarlin@csupomona.edu Steven S. Curl scurl@csupomona.edu Daniel Manson dmanson@csupomona.edu Computer Information Systems Department California
Massachusetts Digital Evidence Consortium. Digital Evidence Guide for First Responders
Massachusetts Digital Evidence Consortium Digital Evidence Guide for First Responders May 2015 Digital Evidence Guide for First Responders - MDEC A Note to the Reader There are an unlimited number of legal
"This is a truly remarkable attack, but not. just in its scope hackers successfully. penetrated one of the most secure
ICPAK ANNUAL FORENSIC AUDIT CONFERENCE Digital Forensics in Fraud & Corruption Investigations 9 October 2014 Leisure Lodge Hotel, Diani Kenya Faith Basiye, CFE Head Group Forensic Services KCB Banking
Digital Forensics: The aftermath of hacking attacks. AHK Committee Meeting April 19 th, 2015 Eng. Jamal Abdulhaq Logos Networking FZ LLC
Digital Forensics: The aftermath of hacking attacks AHK Committee Meeting April 19 th, 2015 Eng. Jamal Abdulhaq Logos Networking FZ LLC Topics Digital Forensics: Brief introduction Case Studies Case I:
Computer Forensics. Securing and Analysing Digital Information
Computer Forensics Securing and Analysing Digital Information Aims What is a computer? Where is the evidence? Why is digital forensics important? Seizing evidence Encryption Hidden files and folders Live
Modern Digital Forensics!!
ISA 785 Research in Digital Forensics Modern Digital Forensics!! ISA 785! Angelos Stavrou, George Mason University! Modern Digital Forensics What s New 2! New Intellectual property concerns! IP/Brand related
Introduction to Data Forensics. Jeff Flaig, Security Consultant January 15, 2014
Introduction to Data Forensics Jeff Flaig, Security Consultant January 15, 2014 WHAT IS COMPUTER FORENSICS Computer forensics is the process of methodically examining computer media (hard disks, diskettes,
Best Practices. For Seizing Electronic Evidence. v.3 A Pocket Guide for First Responders. United States Secret Service
Best Practices For Seizing Electronic Evidence v.3 A Pocket Guide for First Responders U.S. Department of Homeland Security United States Secret Service BEST PRACTICES FOR SEIZING ELECTRONIC EVIDENCE This
CYBER FORENSICS. KRISHNA SASTRY PENDYALA Cyber Forensic Division Central Forensic Science Laboratory Hyderabad.
CYBER FORENSICS KRISHNA SASTRY PENDYALA Cyber Forensic Division Central Forensic Science Laboratory Hyderabad. 11 DIGITAL EVIDENCE? Cyber crimes Digital evidence Digital evidence is any information of
Establishing a State Cyber Crimes Unit White Paper
Establishing a State Cyber Crimes Unit White Paper Utah Department of Public Safety Commissioner Keith Squires Deputy Commissioner Jeff Carr Major Brian Redd Utah Statewide Information & Analysis Center
Computer Forensics as an Integral Component of the Information Security Enterprise
Computer Forensics as an Integral Component of the Information Security Enterprise By John Patzakis 10/28/03 I. EXECUTIVE SUMMARY In addition to fending off network intrusions and denial of service attacks,
www.lgrmg.ca Setting the Standard in Risk Management Consulting and Investigation Services
www.lgrmg.ca Setting the Standard in Risk Management Consulting and Investigation Services Setting the Standard in Risk Management Consulting and Investigation Services AN INTRODUCTION Lions Gate Risk
WILLIAM OETTINGER PHONE (702) 292-4645 WOETTINGER@GMAIL.COM
WILLIAM OETTINGER PHONE (702) 292-4645 WOETTINGER@GMAIL.COM SUMMARY OF QUALIFICATIONS Veteran investigator in a traditional and computer-related environment. A leader experienced in organizing, directing,
Faculty/Staff/Community Mountain Home School District Computer and Network Appropriate Use Policy
Faculty/Staff/Community Mountain Home School District Computer and Network Appropriate Use Policy Mountain Home School District is responsible for securing its network and computer systems against unauthorized
The FBI and the Internet
The FBI and the Internet Special Agent Robert Flaim Federal Bureau of Investigation Presentation Goals To give you a better understanding of: The FBI Cyber Division, its priorities, and its mission The
https://agency.governmentjobs.com/dakota/job_bulletin.cfm?jobid=1017820
Page 1 of 5 DAKOTA COUNTY Employee Relations Administration Center, 1590 Highway 55 Hastings, MN 55033-2372 651.438.4435 http://www.dakotacounty.us INVITES APPLICATIONS FOR THE POSITION OF: Electronic
How To Be A Computer Forensics Examiner
Richard A. Peacock 410.346.7288 (Office) 443.398.5246 (Cell) rich@realforensicanalysis.com EnCase Certified Examiner (EnCE) Access Data Certified Examiner (ACE) Access Data Mobile Phone Certified Examiner
Guidelines on Digital Forensic Procedures for OLAF Staff
Ref. Ares(2013)3769761-19/12/2013 Guidelines on Digital Forensic Procedures for OLAF Staff 1 January 2014 Introduction The OLAF Guidelines on Digital Forensic Procedures are internal rules which are to
Presentation Title Presentation Subtitle. The Unique Alternative to the Big Four
Presentation Title Presentation Subtitle The Unique Alternative to the Big Four Speaker Biography Tim L. Bryan, CPA/CFF/CITP, CISA, EnCE Senior Manager, Crowe Horwath LLP Forensic Technology Services Leader
INSTRUCTION: Instructional Services
INSTRUCTION: Instructional Services Technology Acceptable use Policy (TAUP) for Students I. Purpose Baltimore County Public Schools (BCPS) offers a wide array of technology resources for student use. These
CYBER FORENSICS (W/LAB) Course Syllabus
6111 E. Skelly Drive P. O. Box 477200 Tulsa, OK 74147-7200 CYBER FORENSICS (W/LAB) Course Syllabus Course Number: CSFS-0020 OHLAP Credit: Yes OCAS Code: 8134 Course Length: 130 Hours Career Cluster: Information
Guide to Computer Forensics and Investigations, Second Edition
Guide to Computer Forensics and Investigations, Second Edition Chapter 4 Current Computer Forensics Tools Objectives Understand how to identify needs for computer forensics tools Evaluate the requirements
Digital Evidence. Robert J. O Leary, CFCE; DFCP Director NIJ ECTCoE 550 Marshall St. Suite B Phillipsburg, NJ 08865
Digital Evidence Robert J. O Leary, CFCE; DFCP Director NIJ ECTCoE 550 Marshall St. Suite B Phillipsburg, NJ 08865 Russell Yawn, CFCE; Deputy Director NIJ ECTCoE 550 Marshall St. Suite B Phillipsburg,
Cybersecurity Opportunities. Presented to: National Professional Science Masters Association November 13, 2013
Cybersecurity Opportunities Presented to: National Professional Science Masters Association November 13, 2013 Overall Themes For Discussion Advice for Grads Your Degree Is A Place To Start. It does not
CHAPTER 18 CYBER CRIMES
CHAPTER 18 CYBER CRIMES 18.1 With increased use of computers in homes and offices, there has been a proliferation of computer-related crimes. These crimes include: Crimes committed by using computers as
data recovery specialists
data recovery specialists Last year we helped thousands of clients to recover data from media including hard disk drives, RAID, USB drives, tapes and even mobile phones. This is why clients such as MITIE,
1. Redistributions of documents, or parts of documents, must retain the SWGIT cover page containing the disclaimer.
Disclaimer: As a condition to the use of this document and the information contained herein, the SWGIT requests notification by e-mail before or contemporaneously to the introduction of this document,
Getting Physical with the Digital Investigation Process
Getting Physical with the Digital Investigation Process Brian Carrier Eugene H. Spafford Center for Education and Research in Information Assurance and Security CERIAS Purdue University Abstract In this
Cyber Security Response to Physical Security Breaches
Cyber Security Response to Physical Security Breaches INTRODUCTION Physical break-ins and other unauthorized entries into critical infrastructure locations, such as electrical power substations, have historically
Niagara County Community College
Niagara County Community College NCCCnet Computer Usage Policy Document: NCCCnet Computer Usage Policy Owner: Chief Information Officer Version: 2.0 NCCCnet Policy Page 1 of 7 NCCCnet Use Policy Introduction:
COMPUTER USE POLICY. 1.0 Purpose and Summary
COMPUTER USE POLICY 1.0 Purpose and Summary 1. This document provides guidelines for appropriate use of the wide variety of computing and network resources at Methodist University. It is not an all-inclusive
OVERVIEW. 1. Cyber Crime Unit organization. 2. Legal framework. 3. Identity theft modus operandi. 4. How to avoid online identity theft
OVERVIEW 2 1. Cyber Crime Unit organization 2. Legal framework 3. Identity theft modus operandi 4. How to avoid online identity theft 5. Main challenges for investigation 6. Conclusions ORGANIZATION 3
City of Boston Department of Innovation and Technology Policy Title: Information Technology Resource Use Policy Effective Date: April 1, 2011
City of Boston Department of Innovation and Technology Policy Title: Information Technology Resource Use Policy Effective Date: April 1, 2011 Purpose and Intent The City of Boston recognizes the importance
Computer Forensic Tools. Stefan Hager
Computer Forensic Tools Stefan Hager Overview Important policies for computer forensic tools Typical Workflow for analyzing evidence Categories of Tools Demo SS 2007 Advanced Computer Networks 2 Important
Asheboro City Schools 1:1 Laptop Handbook for Elementary and Middle Schools
Asheboro City Schools 1:1 Laptop Handbook for Elementary and Middle Schools Students should use technology and the Internet in an appropriate manner. Technology is an integral part of a student s educational
Robotics Core School 1
Robotics Core School 1 Robotics Core School 2 Cyber Forensics & Crime Investigation This workshop is dedicated on Cyber Forensics & Crime Investigation. Computer Forensics is a detailed and scientific
The FBI Cyber Program. Bauer Advising Symposium //UNCLASSIFIED
The FBI Cyber Program Bauer Advising Symposium October 11, 2012 Today s Agenda What is the threat? Who are the adversaries? How are they attacking you? What can the FBI do to help? What can you do to stop
What is Digital Forensics?
DEVELOPING AN UNDERGRADUATE COURSE IN DIGITAL FORENSICS Warren Harrison PSU Center for Information Assurance Portland State University Portland, Oregon 97207 warren@cs.pdx.edu What is Digital Forensics?
Introduction Thanks Survey of attendees Questions at the end
Introduction Thanks Survey of attendees Questions at the end 1 Electronic records come in a variety of shapes and sizes and are stored in a multitude of ways. Just what are you managing? Video Cloud computing
The Enhanced Digital Investigation Process Model
The Enhanced Digital Investigation Process Model Venansius Baryamureeba and Florence Tushabe barya@ics.mak.ac.ug, tushabe@ics.mak.ac.ug Institute of Computer Science, Makerere University P.O.Box 7062,
Valmeyer Community Unit School District #3 Acceptable Use Of Computers and Networks
Valmeyer Community Unit School District #3 Acceptable Use Of Computers and Networks The Valmeyer Community Unit School District #3 Board of Education supports the use of the Internet and other computer
Breakfast Meeting: Securing your Secured Data Digital Forensics, Fraud and Forensic Advancements
Breakfast Meeting: Securing your Secured Data Digital Forensics, Fraud and Forensic Advancements 9 April 2013 Facilitator: Dr. Sheau-Dong Lang, Coordinator Master of Science in Digital Forensics University
NCIS Overview. Prevent Terrorism Protect Secrets Reduce Crime
NCIS Overview NCIS, a civilian organization, is the primary law enforcement and counterintelligence arm of the United States Department of the Navy. It works closely with other local, state, federal, and
Lance Eliot Sloves. Computer Forensic Services, Inc. 2807 Allen St. #743 E-mail: lancesl@cfsiusa.com
Lance Eliot Sloves Certified Computer Examiner (CCE, EnCE) Licensed Private Investigator, TX Testifying Expert Independent Government Contractor Active Top Secret/SSBI US Government Clearance Computer
Criminal Justice: Law Enforcement Technology
Criminal Justice: Law Enforcement Technology Dr. Kamal Shahrabi, Acting Chair Security Systems & Law Enforcement Technology Dept. Bachelor of Science The Bachelor of Science program in Criminal Justice:
Piecing Digital Evidence Together. Service Information
Piecing Digital Evidence Together Service Information Services Overview Mobile and Tablet Forensics Mobile Phone Forensics is the legally tested and approved systematic examination of mobile phones, SIM
Valmeyer Community Unit School District #3 Acceptable Use Of Computers and Networks
Valmeyer Community Unit School District #3 Acceptable Use Of Computers and Networks The Valmeyer Community Unit School District #3 Board of Education supports the use of the Internet and other computer
Chapter 7A. Functions of Operating Systems. Types of Operating Systems. Operating System Basics
Chapter 7A Operating System Basics Functions of Operating Provide a user interface Run programs Manage hardware devices Organized file storage 2 Types of Operating Real-time operating system Very fast
Total Backup Recovery 7
7 TM 7 Simplify and automate backup and recovery manageability while maintaining business continuity 7 Advanced Server is FarStone s next generation backup and recovery utility to protect your business