Retrieving Internet chat history with the same ease as a squirrel cracks nuts
|
|
|
- Bertram Parrish
- 8 years ago
- Views:
Transcription
1 Retrieving Internet chat history with the same ease as a squirrel Yuri Gubanov CEO, Belkasoft SANS Forensic Summit September 21, 2011 London, Great Britain
2 What is Instant Messenger! Well, you know it! Simple small program for text exchange " Files and images exchange in some IMs " SMS, URLs, voice mail or audio calls " Twitter and Facebook statuses! Friends (contacts) list
3 IMs are widely used! Common means of communication nowadays! Any country! Any gender! Any age! Any computer skills
4 Popular IMs
5 Forensic IM investigation! Ways to retrieve information about Instant Messenger communication: " Post-factum analysis! Existing history file parsing! Carving for deleted data! Live RAM analysis " Real-time analysis! Network traffic capture! Keylogging
6 Existing history file parsing! Locate a file! Analyze it, knowing its format " Format description should be available! Examples " ICQ 7 or Skype SQLite " MSN xml " QQ OLE container
7 How a criminal may prevent such analysis?! Change file location from default! Move/Rename a history file/folder! Delete a history file! Quick format the drive! Encrypt the drive! Select "Do not store my history" option in advance
8 How do I?! When file location changed from default, using IM means " Not all messengers allow for this, most store under a fixed path in a user's folder " Search through all the drive(s)!! But: possibly too much false positives, e.g. MSN: xml (rather search for MessageLog.xsl but what if it is deleted?) " May need to change access rights (some folders may be inaccessible)
9 How do I?! When a history file moved/renamed " Need to be a computer savvy to know where a history file is stored " Search through all the drive(s)! " "Paranoid" search! Treat all files as history files. E.g. look for Miranda signature "Miranda ICQ DB" in all files.! Can be too slow if a messenger has no clear signature like for Miranda " Carving is another good approach in this case
10 How do I?! When a history file deleted " Need to be a computer savvy to know where a history file is stored and not to delete to a recycle bin " Recover from recycle bin " Recover using file recovery tools " Use alternative history sources! Example: Skype chatsync. But: format is proprietary and not published " What is file is already corrupted/ overwritten?! Use carving to retrieve separate messages
11 What is carving?! Going through the whole drive! Disregard file structure! Byte by byte search for signatures or patterns specific to various data items " E.g. instant messages, URLs, s! Data may persist very long time after deletion!
12 Carving! Example: Skype 3 has "l33l" signature! Will retrieve both deleted and existing messages! Works only for history types which have good signatures " E.g. old ICQ does not have one! Note the difference between file and message signature!
13 How do I?! When a user Quick formats the drive " The same way use carving! When a user encrypts the drive " Use the software like Elcomsoft's one! When a user selects "Do not store my history" option in advance " Use Live RAM analysis (explained later)
14 How a criminal prevents carving for deleted data?! Delete data and use a special program to fill a drive with random bytes " File recovery and carving will not give any results " White noise detection programs whom from 10 suspects to choose?! Never set "Store my history" " Live RAM analysis! Use special SSD drives " Live RAM analysis
15 SSD drives problem! SSD drives which designed specifically for NTFS! or SSD drive which supports TRIM! May completely remove all deleted information in minutes " Write blocker devices will not help! " See JDFSL-V5N3-Bell.pdf
16 SSD drives problem! But: " Not all OS supports TRIM " TRIM will not work efficiently on highly fragmented drives! SSDs cannot be defragmented when using wear leveling " TRIM commands compromise disk encryption " SSDs are still very expensive and not widely used
17 What is Live RAM analysis! Dumping a running computer's RAM memory to a thumb drive using special utilities: " win32dd/win64dd " Encase " FTK Imager " etc! Computer should be seized switched on! Investigation of dump contents
18 What if a computer is locked?! Rebooting will leave most of history in RAM! Reboot and boot from a thumb drive/cd " Will not work if! Boot sequence does not allow to boot from thumb drive/cd! BIOS is password protected! Or do a Firewire dump
19 How to perform analysis! Use the same technique as carving! Signatures may differ for messages in memory (but may be the same) " E.g. ICQ 7 and Skype 4 have the same signatures in RAM " E.g. AIM has a signature "EF FD" repeated 8 times! Expect to find only a few recent conversations
20 Analyzing pagefile.sys and hiberfil.sys! One is swap file (virtual memory) and another is file used for hibernation (if enabled) " Most frequently enabled for laptops though I use it on my desktop as well! Portions of memory used recently are stored in these files " The data will survive reboots/switching off! The same as Live RAM carving but need to decompress beforehand
21 How a criminal prevents Live RAM analysis?! Set BIOS password! Disable boot from anything else than own hard drive! Disable hibernation and virtual memory " Will significantly slow down the computer! Lock computer " Firewire dump still possible! Switch computer completely off
22 Real-time analysis! Two methods available " Network traffic capture (so called sniffing) " Keylogging! Both suppose being 'near' to a suspect
23 Network traffic capture! A sniffer program captures all network traffic in a local network! The same hub or switch of LAN, wifi or bluetooth hot-spot! Sniffer can save intercepted packets in PCAP files " E.g. WireShark! You can analyze these files in real time or later! IMs use protocols like Oscar (ICQ, AIM ), XMPP (Jabber, GTalk, Facebook )
24 How a criminal prevents sniffing?! There is no way to prevent interception itself (data still goes through ISP)! Not use public WiFi hot-spots! Use encrypted communication
25 Keylogging! A program running on a user's machine! Can run in stealth mode, without being shown in Task Manager, Services, etc! Can send or upload logged information! Hard to install hidden! Is not legal in many countries
26 How a criminal prevents keylogging?! Disable Windows auto-login feature! Use strong password for their login! Have only themselves as a local administrator! Have robust up-to-date antivirus and do all other stuff all others do against viruses! Use known anti-spyware tools
27 The worst setup! Disable auto-login and use strong password! Be the only one local administrator! Remove Administrators and SYSTEM accounts from a 'secret' folders! Encrypt the drive! Use SSD which supports TRIM and use Windows 7 OS! Set BIOS password! Disable boot from anything else than your hard drive! Disable history storing in Instant Messenger! Use Instant Messenger that encrypts traffic! Disable hibernation! Disable virtual memory! Have enough time to perform a quick format before police comes to you! Have enough time to switch computer off before police comes to you
28 Still, will not save one from! Investigating history on another side! Investigating ISP logs and Instant Messenger server logs
29 Live demo! Regular history extraction! Carving! Live RAM analysis
30 Case study! Is IM investigation important?! Decide yourself, basing on a cases completed with Belkasoft tools: " A country counterintelligence unit found and accused a spy with the help of Skype carving " A man was found guilty in a Second Degree Murder with the help of ICQ analysis " A spouse was found guilty for adultery in a divorce suit with the help of Yahoo analysis
31 Questions? Comments?! Ask me now! Take my business card! Attend our FREE webinar on our tools " Just send an to Site: My LinkedIn account:
A+ Guide to Managing and Maintaining Your PC, 7e. Chapter 16 Fixing Windows Problems
A+ Guide to Managing and Maintaining Your PC, 7e Chapter 16 Fixing Windows Problems Objectives Learn what to do when a hardware device, application, or Windows component gives a problem Learn what to do
Fall. Forensic Examination of Encrypted Systems Matthew Postinger COSC 374
Fall 2011 Forensic Examination of Encrypted Systems Matthew Postinger COSC 374 Table of Contents Abstract... 3 File System Encryption... 3 Windows EFS... 3 Apple FileVault... 4 Full Disk Encryption...
EAGLE EYE Wi-Fi. 1. Introduction
1. Introduction Internet access has become very popular by the emergence of broadband services, and busy yet unregulated Internet traffic causes challenges to administration and management. When it comes
Acronis True Image 2015 REVIEWERS GUIDE
Acronis True Image 2015 REVIEWERS GUIDE Table of Contents INTRODUCTION... 3 What is Acronis True Image 2015?... 3 System Requirements... 4 INSTALLATION... 5 Downloading and Installing Acronis True Image
Recovering Digital Evidence in a Cloud Computing Paradigm. Jad Saliba Founder and CTO
Recovering Digital Evidence in a Cloud Computing Paradigm Jad Saliba Founder and CTO Background Teenage geek - IT/Software industry Police officer for 7 years Worked in Tech Crimes Unit Started JADsoftware
Incident Response and Computer Forensics
Incident Response and Computer Forensics James L. Antonakos WhiteHat Forensics Incident Response Topics Why does an organization need a CSIRT? Who s on the team? Initial Steps Detailed Project Plan Incident
CLOUD STORAGE FORENSICS MATTIA EPIFANI SANS EUROPEAN DIGITAL FORENSICS SUMMIT PRAGUE, 7 OCTOBER 2013
CLOUD STORAGE FORENSICS MATTIA EPIFANI SANS EUROPEAN DIGITAL FORENSICS SUMMIT PRAGUE, 7 OCTOBER 2013 SUMMARY Cloud Storage services Testing environment and methodology Forensics artifacts left by Cloud
Computer Forensics. Securing and Analysing Digital Information
Computer Forensics Securing and Analysing Digital Information Aims What is a computer? Where is the evidence? Why is digital forensics important? Seizing evidence Encryption Hidden files and folders Live
What Happens When You Press that Button? Explaining Cellebrite UFED Data Extraction Processes
What Happens When You Press that Button? Explaining Cellebrite UFED Data Extraction Processes Table of Contents UFED Basics...3 Extraction Types...4 Logical extraction...5 Logical extractions of ios devices...5
NETWORKS AND THE INTERNET
NETWORKS AND THE INTERNET Outline to accompany the slide presentation 1. Networks and the Internet A Primer for Prosecutors and Investigators 2. Getting There From networks to the Internet Locating a place
EnCase 7 - Basic + Intermediate Topics
EnCase 7 - Basic + Intermediate Topics Course Objectives This 4 day class is designed to familiarize the student with the many artifacts left behind on Windows based media and how to conduct a forensic
NETWORK AND INTERNET SECURITY POLICY STATEMENT
TADCASTER GRAMMAR SCHOOL Toulston, Tadcaster, North Yorkshire. LS24 9NB NETWORK AND INTERNET SECURITY POLICY STATEMENT Written by Steve South November 2003 Discussed with ICT Strategy Group January 2004
Skype Forensics: Analyzing Call and Chat Data From Computers and Mobile
Skype Forensics: Analyzing Call and Chat Data From Computers and Mobile Even before being acquired by Microsoft in 2011, Skype had already established a strong presence in the VoIP and instant messaging
HIPAA Security Training Manual
HIPAA Security Training Manual The final HIPAA Security Rule for Montrose Memorial Hospital went into effect in February 2005. The Security Rule includes 3 categories of compliance; Administrative Safeguards,
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065 Introduction The Computer Forensics and Investigation course presents methods to properly conduct a computer forensics investigation
PhoneCrypt Desktop. Phone Encryption Software. PhoneCrypt Manual Mobile phone encryption for Windows Platforms
PhoneCrypt Desktop Phone Encryption Software PhoneCrypt Manual Mobile phone encryption for Windows Platforms Introduction Contents http:// www. securstar.com info@securstar.com 2009 by SecurStar GmbH,
Introduction to Encryption What it s all about
Introduction to Encryption What it s all about At MOA Project, we believe privacy and the ability to communicate without government or corporate eavesdropping is a basic right of all people. Some groups,
Uncovering the Covered Tracks: Finding What s Left Behind JAD SALIBA FOUNDER & CTO
Uncovering the Covered Tracks: Finding What s Left Behind JAD SALIBA FOUNDER & CTO Background Teenage geek - IT/Software industry Police officer for 7 years Worked in Tech Crime Unit Started JADsoftware
How Important are Facebook Artifacts?
How Important are Facebook Artifacts? In March 2013, Facebook reportedly had just over 1 billion users worldwide. Founded in February 2004, it can be considered one of the grandfathers of social networking.
IBM Rapid Restore PC powered by Xpoint - v2.02 (build 6015a)
IBM Rapid Restore PC powered by Xpoint - v2.02 (build 6015a) User s Reference Guide Internal IBM Use Only This document only applies to the software version listed above and information provided may not
Just EnCase. Presented By Larry Russell CalCPA State Technology Committee May 18, 2012
Just EnCase Presented By Larry Russell CalCPA State Technology Committee May 18, 2012 What is e-discovery Electronically Stored Information (ESI) Discover or Monitor for Fraudulent Activity Tools used
A+ Guide to Software: Managing, Maintaining, and Troubleshooting, 5e. Chapter 3 Installing Windows
: Managing, Maintaining, and Troubleshooting, 5e Chapter 3 Installing Windows Objectives How to plan a Windows installation How to install Windows Vista How to install Windows XP How to install Windows
Additional information >>> HERE <<< Online, Download Free ebook Email Address Search - ebook
Additional information >>> HERE http://f-ebook.esy.es/emailtrace/pdx/fph1
Microsoft Vista: Serious Challenges for Digital Investigations
Proceedings of Student-Faculty Research Day, CSIS, Pace University, May 2 nd, 2008 Microsoft Vista: Serious Challenges for Digital Investigations Darren R. Hayes and Shareq Qureshi Seidenberg School of
U.S. Cellular Mobile Data Security. User Guide Version 00.01
U.S. Cellular Mobile Data Security User Guide Version 00.01 Table of Contents Install U.S. Cellular Mobile Data Security...3 Activate U.S. Cellular Mobile Data Security...3 Main Interface...3 Checkup...4
SearchInform Information Security Perimeter. Contents 1. SENSITIVE DATA PROTECTION: SEARCHINFORM INFORMATION SECURITY PERIMETER...
1 SearchInform Contents 1. SENSITIVE DATA PROTECTION: SEARCHINFORM INFORMATION SECURITY PERIMETER... 3 1.1. Control of Data Leak Channels... 3 1.2. System Components... 3 1.2.1. SearchInform NetworkSniffer...
Workflow Templates Library
Workflow s Library Table of Contents Intro... 2 Active Directory... 3 Application... 5 Cisco... 7 Database... 8 Excel Automation... 9 Files and Folders... 10 FTP Tasks... 13 Incident Management... 14 Security
Risk Analysis in Skype Software Security
Risk Analysis in Skype Software Security Afnan AlOmrani, Rasheed AlZahrani, Eyas ElQawasmeh Information System Department College of Computer and Information Sciences King Saud University Riyadh, Saudi
Networks and the Internet A Primer for Prosecutors and Investigators
Computer Crime & Intellectual Property Section Networks and the Internet A Primer for Prosecutors and Investigators Michael J. Stawasz Senior Counsel Computer Crime and Intellectual Property Section ()
Kaspersky Internet Security 2014: Reviewer s Guide
Kaspersky Internet Security 2014: Reviewer s Guide Index 1 Introduction... 3 2 Key Benefits... 3 2.1 Real-time protection against all Internet threats 3 2.2 Secure online banking and shopping 4 2.3 Proactive
Help System. Table of Contents
Help System Table of Contents 1 INTRODUCTION 1.1 Features 2 GETTING STARTED! 2.1 Installation 2.2 Registration 2.3 Updates 3 VIEWING RECORDED DATA 3.1 Snapshots 3.2 Programs 3.3 Websites 3.4 Keystrokes
Operating Systems Forensics
Operating Systems Forensics Section II. Basic Forensic Techniques and Tools CSF: Forensics Cyber-Security MSIDC, Spring 2015 Nuno Santos Summary! Windows boot sequence! Relevant Windows data structures!
Protegent 360- Complete Security Software
Protegent 360- Complete Security Software It s Time to Think Beyond Anti-Virus Anti-virus, Internet Security and total security are common words describing security software, but only for Internet threats.
Using Remote Desktop Clients
CYBER SECURITY OPERATIONS CENTRE December 2011 Using Remote Desktop Clients INTRODUCTION 1. Remote access solutions are increasingly being used to access sensitive or classified systems from homes and
Chapter 4. Backup / Restore
Recovery Guide 9 Restoring with the OS CD (Only for models that ship with the operating system CD) 98 Samsung Recovery Solution (Optional) 00 Recovery Guide 9 This section describes how to restore your
Recipe for Mobile Data Security: TPM, Bitlocker, Windows Vista and Active Directory
Recipe for Mobile Data Security: TPM, Bitlocker, Windows Vista and Active Directory Tom Olzak October 2007 If your business is like mine, laptops regularly disappear. Until recently, centrally managed
Securing Your Windows Laptop
Securing Your Windows Laptop Arindam Mandal (arindam.mandal@paladion.net) Paladion Networks (http://www.paladion.net) May 2004 Now-a-days laptops are part of our life. We carry laptops almost everywhere
Cleaning your Windows 7, Windows XP and Macintosh OSX Computers
Cleaning your Windows 7, Windows XP and Macintosh OSX Computers A cleaning of your computer can help your computer run faster and make you more efficient. We have listed some tools and how to use these
HE WAR AGAINST BEING AN INTERMEDIARY FOR ANOTHER ATTACK
HE WAR AGAINST BEING AN INTERMEDIARY FOR ANOTHER ATTACK Prepared By: Raghda Zahran, Msc. NYIT-Jordan campus. Supervised By: Dr. Lo ai Tawalbeh. November 2006 Page 1 of 8 THE WAR AGAINST BEING AN INTERMEDIARY
Introduction to BitLocker FVE
Introduction to BitLocker FVE (Understanding the Steps Required to enable BitLocker) Exploration of Windows 7 Advanced Forensic Topics Day 3 What is BitLocker? BitLocker Drive Encryption is a full disk
Do "standard tools" meet your needs when it comes to providing security for mobile PCs and data media?
Product Insight Do "standard tools" meet your needs when it comes to providing security for mobile PCs and data media? Author Version Document Information Utimaco Product Management Device Security 4.30.00
AxCrypt File Encryption Software for Windows. Quick Installation Guide. Version 1.6.3. January 2008
AxCrypt File Encryption Software for Windows Quick Installation Guide Version 1.6.3 January 2008 Copyright 2005-2008 Svante Seleborg, Axantum Software AB 2(19) This guide describes how to install and quickly
Paraben s P2C 4.1. Release Notes
Paraben s P2C 4.1 Release Notes Welcome to Paraben s P2C 4.1! Paraben's P2C is a comprehensive digital forensic analysis tool designed to handle more data, more efficiently while keeping to Paraben's P2
PGP Desktop Email Quick Start Guide version 9.6
What is PGP Desktop Email? PGP Desktop Email is part of the PGP Desktop family of products. You can use PGP Desktop Email to: Automatically and transparently encrypt, sign, decrypt, and verify email messages
Safe internet for business use: Getting Started Guide
Safe internet for business use: Getting Started Guide Table of Contents 1. Preface 1 2. Before You Install 2 2.1 Disabling Firewalls 2 2.2 About Accelerators 3 3. About Profiles 4 4. Installation and Initial
Configuring, Customizing, and Troubleshooting Outlook Express
3 Configuring, Customizing, and Troubleshooting Outlook Express............................................... Terms you ll need to understand: Outlook Express Newsgroups Address book Email Preview pane
Computer Forensics: Permanent Erasing
Computer Forensics: Permanent Erasing Prepared By : Yousef T. Aburabie and Mohamd Alomari Supervised By: Dr. Lo ai Tawalbeh, New York Institute of Technology (NYIT)-Jordan s campus-2006 Introduction "Delete"
ANDRA ZAHARIA MARCOM MANAGER
10 Warning Signs that Your Computer is Malware Infected [Updated] ANDRA ZAHARIA MARCOM MANAGER MAY 16TH, 2016 6:05 Malware affects us all The increasing number of Internet users worldwide creates an equal
How To Secure Your Email From Being Hacked On A Pc Or Mac Or Ipad (For Free) For A Long Time (For A Long Period Of Time) For Free (For Commercial) For Your Money (For Business) For The Long Term
CYBER-ATLAS TOOLKIT TOOLKIT: REFERENCES FREE EMAIL ENCRYPTION SOFTWARE BEFORE YOU START Limited functionality, limited capacity, limited usage, limited platforms or restrictions disallowing commercial
Whitepaper Enhancing BitLocker Deployment and Management with SimplySecure. Addressing the Concerns of the IT Professional Rob Weber February 2015
Whitepaper Enhancing BitLocker Deployment and Management with SimplySecure Addressing the Concerns of the IT Professional Rob Weber February 2015 Page 2 Table of Contents What is BitLocker?... 3 What is
See Criminal Internet Communication as it Happens.
A PRODUCT OF See Criminal Internet Communication as it Happens. In Real Time or Recreated. From the Field or From Your Desk. That s Intelligence. That s Intellego. 2 / Visual Reconstruction & Analysis
YOUR DATA UNDER SIEGE. DEFEND IT WITH ENCRYPTION.
YOUR DATA UNDER SIEGE. DEFEND IT WITH ENCRYPTION. With Kaspersky, now you can. kaspersky.com/business Be Ready for What s Next Your Data Under Siege. Defend it with Encryption. 1.0 Keeping up with the
Time Stamp. Instruction Booklet
Time Stamp Instruction Booklet Time Stamp Introductions Time stamp is a useful solution for backing up and restoring system, it backs up the entire computer system to the Backup Zone. Time Stamp is used
Employee PC and Server Activity Monitoring Solution
Employee PC and Server Activity Monitoring Solution Employee PC and Server Activity Monitoring Ever dreamed of a software tool to track your network activity in real time? Ever thought of how useful it
How to avoid Five Blind Spots in Internet Filtering
How to avoid Five Blind Spots in Internet Filtering If you re like most managers today, you d like to know what your employees are up to on company time, especially when they re using company PCs and laptops.
Technical White Paper BlackBerry Security
Technical White Paper BlackBerry Security For Microsoft Exchange Version 2.1 Research In Motion Limited 2002 Research In Motion Limited. All Rights Reserved Table of Contents 1. INTRODUCTION... 1 2. ARCHITECTURE...
Industrial Flash Storage Trends in Software and Security
January 22, 2013 Industrial Flash Storage Trends in Software and Security Many flash storage devices in embedded applications are used to save data but also function as disks for the OS. Most users are
Practice Exercise March 7, 2016
DIGITAL FORENSICS Practice Exercise March 7, 2016 Prepared by Leidos CyberPatriot Forensics Challenge 1 Forensics Instruction Guide Introduction The goal of this event is to learn to identify key factors
The Forensic Recovery of Instant Messages from. MSN Messenger and Windows Live Messenger
The Forensic Recovery of Instant Messages from MSN Messenger and Windows Live Messenger MSN Messenger MSN Messenger and its later incarnation Windows Live Messenger are one of many Instant Messenger programs.
A new business application, that supports e- mail, IM communication, calendaring and collaboration
A new business application, that supports e- mail, IM communication, calendaring and collaboration IceWarp 2010 IceWarp Desktop Client is the most comprehensive communication client on the market, integrating
Digital Forensics Tutorials Acquiring an Image with FTK Imager
Digital Forensics Tutorials Acquiring an Image with FTK Imager Explanation Section Digital Forensics Definition The use of scientifically derived and proven methods toward the preservation, collection,
Secure and Safe Computing Primer Examples of Desktop and Laptop standards and guidelines
Secure and Safe Computing Primer Examples of Desktop and Laptop standards and guidelines 1. Implement anti-virus software An anti-virus program is necessary to protect your computer from malicious programs,
Chapter 4. System Software. What You Will Learn... Computers Are Your Future. System Software. What You Will Learn... Starting the Computer
What You Will Learn... Computers Are Your Future Chapter 4 The two major components of operating system software Why a computer isn t useful without an operating system The five basic functions of an operating
Disk Encryption. Aaron Howard IT Security Office
Disk Encryption Aaron Howard IT Security Office Types of Disk Encryption? Folder Encryption Volume or Full Disk Encryption OS / Boot Volume Data Volume Managed or Unmanaged Key Backup and Data Assurance
The Value of Physical Memory for Incident Response
The Value of Physical Memory for Incident Response MCSI 3604 Fair Oaks Blvd Suite 250 Sacramento, CA 95864 www.mcsi.mantech.com 2003-2015 ManTech Cyber Solutions International, All Rights Reserved. Physical
Network Connect & Junos Pulse Performance Logs on Windows
Network Connect & Junos Pulse Performance Logs on Windows How-to Juniper Networks, Inc. 1 Table of Contents Introduction Part 1: Client Prerequisites... 3 Step 1.1: Packet Sniffer... 3 Step 1.2: Output
10 steps to better secure your Mac laptop from physical data theft
10 steps to better secure your Mac laptop from physical data theft Executive summary: This paper describes changes Mac users can make to improve the physical security of their laptops, discussing the context
Information and Digital Technology
2014 HIGHER SCHOOL CERTIFICATE EXAMINATION Information and Digital Technology Networking and Hardware Total marks 80 Section I Pages 2 7 General Instructions Reading time 5 minutes Working time 2 hours
Countering and reducing ICT security risks 1. Physical and environmental risks
Countering and reducing ICT security risks 1. Physical and environmental risks 1. Physical and environmental risks Theft of equipment from staff areas and Theft of equipment from public areas Theft of
DeployStudio Server Quick Install
DeployStudio Server Quick Install v1.7.0 The DeployStudio Team info@deploystudio.com Requirements OS X 10.7.5 to 10.11.1 DeployStudioServer_v1.7.x.pkg and later NetBoot based deployment 100 Mb/s switched
AccessData. Registry Quick Find Chart
AccessData Registry Quick Find Chart Registry Quick Find Chart This appendix reviews common locations in the Windows and Windows Internet-related registries where you can find data of forensic interest.
Introduction to Data Forensics. Jeff Flaig, Security Consultant January 15, 2014
Introduction to Data Forensics Jeff Flaig, Security Consultant January 15, 2014 WHAT IS COMPUTER FORENSICS Computer forensics is the process of methodically examining computer media (hard disks, diskettes,
A Survey on Mobile Forensic for Android Smartphones
IOSR Journal of Computer Engineering (IOSR-JCE) e-issn: 2278-0661,p-ISSN: 2278-8727, Volume 17, Issue 2, Ver. 1 (Mar Apr. 2015), PP 15-19 www.iosrjournals.org A Survey on Mobile Forensic for Android Smartphones
TROUBLESHOOTING INFORMATION
TROUBLESHOOTING INFORMATION VinNOW Support does not support Microsoft products to include SQL Server,.NET Framework, and also cannot assist with Windows User issues, Network or VPN issues. If installing
Forensic Toolkit. Sales and Promotional Summary ACCESSDATA, ON YOUR RADAR
Forensic Toolkit Sales and Promotional Summary ACCESSDATA, ON YOUR RADAR What is AccessData s Forensic Toolkit? Also known as FTK, this application enables you to perform complete and thorough computer
ScoMIS Encryption Service
Introduction This guide explains how to implement the ScoMIS Encryption Service for a secondary school. We recommend that the software should be installed onto the laptop by ICT staff; they will then spend
Senomix Timesheets for Mac OS X
for Mac OS X Self-Installed Server Installation Guide v5.1 2015 Senomix Software Inc. www.senomix.com Table of Contents 1.0 - Introduction... 1 2.0 - System Overview... 2 3.0 - Timesheets Server Installation
How To Gather Log Files On A Pulse Secure Server On A Pc Or Ipad (For A Free Download) On A Network Or Ipa (For Free) On An Ipa Or Ipv (For An Ubuntu) On Your Pc
Network Connect & Pulse Performance Logs on Windows How-to Published Date July 2015 Contents Introduction 4 Part 1: Client Prerequisites 4 Step 1.1: Packet Sniffer 4 Step 1.2: Output of IPs, Routes, Ping,
OneDrive for Business FAQ s Updated 6/19/14
OneDrive for Business FAQ s Updated 6/19/14 What is OneDrive for Business? OneDrive for Business is an online service that provides resources for file storage, collaboration, and communication. It provides
User manual of the Work Examiner Contents
User manual of the Work Examiner Contents About this document... 4 Overview... 4 What is Work Examiner?... 4 Standard vs Professional Comparison Chart... 5 FAQ... 6 Install... 7 WE Standard Edition...
Understanding Backup and Recovery Methods
Lesson 8 Understanding Backup and Recovery Methods Learning Objectives Students will learn to: Understand Local, Online, and Automated Backup Methods Understand Backup Options Understand System Restore
Remote Forensic Software. Dr. Michael Thomas DigiTask GmbH, Germany
Dr. Michael Thomas DigiTask GmbH, Germany DigiTask Who we are and what we do Special Telecommunication Systems for Law Enforcement Agencies (LEA) Development of special solutions for the needs of LI Located
Using BitLocker As Part Of A Customer Data Protection Program: Part 1
Using BitLocker As Part Of A Customer Data Protection Program: Part 1 Tech Tip by Philip Cox Source: searchsecuritychannel.com As an information security consultant, one of my jobs is to help my clients
Triage Account Tracker (for TradeStation)
Triage Account Tracker (for TradeStation) Version: Requirements: 1.0.0.0 beta TradeStation 8.4+ (www.tradestation.com)* Triage Messaging (www.triagetrading.com) Copyright 2010 Triage Corporation, Ltd.
Digital Forensics. Tom Pigg Executive Director Tennessee CSEC
Digital Forensics Tom Pigg Executive Director Tennessee CSEC Definitions Digital forensics Involves obtaining and analyzing digital information as evidence in civil, criminal, or administrative cases Analyze
Recover Data Like a Forensics Expert Using an Ubuntu Live CD
Recover Data Like a Forensics Expert Using an Ubuntu Live CD There are lots of utilities to recover deleted files, but what if you can t boot up your computer, or the whole drive has been formatted? We
Final Project Paper Team Kappa Keyloggers: Effective uses in Cyber Forensics & Hacking IST 454 Spring 2011
Final Project Paper Team Kappa Keyloggers: Effective uses in Cyber Forensics & Hacking IST 454 Spring 2011 James R. Crawford Joshua Endter Chris Javan Ankit Jain Joe Schneider Glen Romonosky Introduction:
Hyperoo 2 User Guide. Hyperoo 2 User Guide
1 Hyperoo 2 User Guide 1 2 Contents How Hyperoo Works... 3 Installing Hyperoo... 3 Hyperoo 2 Management Console... 4 The Hyperoo 2 Server... 5 Creating a Backup Array... 5 Array Security... 7 Previous
Gladinet Cloud Backup V3.0 User Guide
Gladinet Cloud Backup V3.0 User Guide Foreword The Gladinet User Guide gives step-by-step instructions for end users. Revision History Gladinet User Guide Date Description Version 8/20/2010 Draft Gladinet
ACQUISITION AND ANALYSIS OF IOS DEVICES MATTIA EPIFANI SANS FORENSICS PRAGUE PRAGUE, 10 OCTOBER 2013
ACQUISITION AND ANALYSIS OF IOS DEVICES MATTIA EPIFANI SANS FORENSICS PRAGUE PRAGUE, 10 OCTOBER 2013 FORENSIC ACQUISITION.BEFORE STARTING When we are dealing with the forensics acquisition of an ios device
Magic Card Plus User Manual
TABLE OF CONTENTS Magic Card Plus User Manual Rogev Computers LTD http://www.rogev.com Tel: 972-9-7469155 Fax: 972-9-7469196 Copyright 2 Important notice for user 2 Chapter 1 introduction 3 1-1Scope of
3.1 RS-232/422/485 Pinout:PORT1-4(RJ-45) RJ-45 RS-232 RS-422 RS-485 PIN1 TXD PIN2 RXD PIN3 GND PIN4 PIN5 T+ 485+ PIN6 T- 485- PIN7 R+ PIN8 R-
MODEL ATC-2004 TCP/IP TO RS-232/422/485 CONVERTER User s Manual 1.1 Introduction The ATC-2004 is a 4 Port RS232/RS485 to TCP/IP converter integrated with a robust system and network management features
SSD Guru. Installation and User Guide. Software Version 1.4
SSD Guru Installation and User Guide Software Version 1.4 Contents Welcome!............................................................................. 1 Key features.........................................................................
Beyond files forensic OWADE cloud based forensic
Beyond files forensic OWADE cloud based forensic Elie Bursztein Stanford University Ivan Fontarensky Cassidian Matthieu Martin Stanford University Jean Michel Picod Cassidian 1 The world is moving to the
1! Registry. Windows System Artifacts. Understanding the Windows Registry. Organization of the Windows Registry. Windows Registry Viewer
1! Registry Understanding the Windows Registry! A database that stores hardware and software configuration information, network connections, user preferences, and setup information Windows System Artifacts
How to create a portable encrypted USB Key using TrueCrypt
How to create a portable encrypted USB Key using TrueCrypt INTRODUCTION TrueCrypt Traveler Mode provides secure encryption for programs/files on portable devices such as USB Memory keys. It uses strong
Configuring your email client to connect to your Exchange mailbox
Configuring your email client to connect to your Exchange mailbox Contents Use Outlook Web Access (OWA) to access your Exchange mailbox... 2 Use Outlook 2003 to connect to your Exchange mailbox... 3 Add
ITU Session Four: Device Imaging And Analysis. Mounir Kamal Q-CERT
ITU Session Four: Device Imaging And Analysis Mounir Kamal Q-CERT 2 Applying Forensic Science to Computer Systems Like a Detective, the archaeologist searches for clues in order to discover and reconstruct
2! Bit-stream copy. Acquisition and Tools. Planning Your Investigation. Understanding Bit-Stream Copies. Bit-stream Copies (contd.
Acquisition and Tools COMP 2555: Principles of Computer Forensics Autumn 2014 http://www.cs.du.edu/2555 1 Planning Your Investigation! A basic investigation plan should include the following activities:!