A Short Introduction to Digital and File System Forensics
|
|
|
- Miles Dalton
- 8 years ago
- Views:
Transcription
1 Antonio Barili Lab Dept. of Industrial and Information Engineering University of Pavia (Italy) Every contact leaves a trace Culprit Scene Victim Edmond Locard ( ) Università degli Studi di Pavia - Antonio Barili 2 1
2 Exchange of Energy Exchange of Information Exchange of Matter Università degli Studi di Pavia - Antonio Barili 3 The uncovering and examinaton of artifacts with evidentiary value located on all kind of electronic devices Università degli Studi di Pavia - Antonio Barili 4 2
3 The Challenges of Data authenticity and volatility Data scale Data variety Università degli Studi di Pavia - Antonio Barili 5 The Purposes of Find evidence of crimes that took place in the real world (e.g. stalking, murder) Find evidence of crimes that inherently involved a computer system (e.g. hacking) Università degli Studi di Pavia - Antonio Barili 6 3
4 Why is so powerful? Computer system store a vast amount of information Intentionally (documents, databases, log files) Unintentionally (partially erased documents and other artifacts) Computer systems are windows into the past!!! Università degli Studi di Pavia - Antonio Barili 7 What makes Digital Evidence different from traditional forms of evidence Witnesses can testify in Courts Traditional documents may be directly evaluated by judges and jurors Digital Evidence needs and expert witness to be translated into meaningful evidence to the Court Università degli Studi di Pavia - Antonio Barili 8 4
5 Useful byproducts of Data recovery Auditing and incident response Security testing of hardware and services Università degli Studi di Pavia - Antonio Barili 9 Procedures and methods Legal issues Technical issues The bound is not what is technically possible, but what is cost-effective for a particular case Università degli Studi di Pavia - Antonio Barili 10 5
6 The Model (RFC 3227 / 2002) Identification Acquisition Preservation Analysis Presentation Università degli Studi di Pavia - Antonio Barili 11 The Model - Acquisition Physical images (disk images) Logical images (documents and files) Live data capture (memory dumps) Network data capture (logfiles, packet capture) Università degli Studi di Pavia - Antonio Barili 12 6
7 Example - File System Forensic dd if=/dev/sdb of=/temp/image.raw Forensic image formats: RAW (DD), EWF; AFF Università degli Studi di Pavia - Antonio Barili 13 Example - File System Forensics dd if=/dev/sdb of=/temp/image.raw Write Blockers preserve original evidence from tampering Università degli Studi di Pavia - Antonio Barili 14 7
8 Example - File System Forensics Università degli Studi di Pavia - Antonio Barili 15 Example - File System Forensics Example - File System Forensics DEMO TEST00 FORMATTED AND WIPED TEST01 JPEG IMAGE ALLOCATED TEST02 JPEG IMAGE DELETED TEST03 FORMATTED (NOT WIPED) Università degli Studi di Pavia - Antonio Barili 16 8
9 Example - File System Forensics Volume metadata (MBR, GPT...) File System metadata (FAT, MFT, indexes, logfiles...) File metadata (file headers, EXIF codes...) File content Università degli Studi di Pavia - Antonio Barili 17 Example - File System Forensics Preserving information integrity Document any operation Chain of custody Hashing Università degli Studi di Pavia - Antonio Barili 18 9
10 Evaluating Digital Evidences The Daubert Standard a. Empirical testing: whether the theory or technique is falsifiable, refutable, and/or testable b. Whether it has been subjected to peer review and publication c. The known or potential error rate d. The existence and maintenance of standards and controls concerning its operation e. The degree to which the theory and technique is generally accepted by a relevant scientific community Università degli Studi di Pavia - Antonio Barili 19 Evaluating Digital Evidences FRE TESTIMONY BY EXPERT WITNESSES A witness who is qualified as an expert by knowledge, skill, experience, training, or education may testify in the form of an opinion or otherwise if: (a) The expert s scientific, technical, or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue; (b) The testimony is based on sufficient facts or data; (c) The testimony is the product of reliable principles and methods; and (d) The expert has reliably applied the principles and methods to the facts of the case Università degli Studi di Pavia - Antonio Barili 20 10
11 Example - File System Forensics A GPS Navigation Device was imaged, all strings longer than 8 chars (ascii or unicode) were carved from the image using sysinternals string.exe Note: carving requires the image to be mounted as a RAW (uncompressed) file Università degli Studi di Pavia - Antonio Barili 21 One final question: Is digital evidence that much fragile? Friends, Romans, countrymen, lend me your ears I come to bury Caesar, not to praise him. The evil that men do lives after them The good is oft interred with their bones FaceBook was yet to come! Università degli Studi di Pavia - Antonio Barili 22 11
12 References [1] Garfinkel, S. L., Digital forensics, Am. Sci., vol. 101, no. 5, pp , [2] Carrier, B., File system forensic analysis, Addison- Wesley, Università degli Studi di Pavia - Antonio Barili 23 Thank You! Università degli Studi di Pavia - Antonio Barili 24 12
Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation
Computer Forensics and Digital Investigation Computer Security EDA263, lecture 14 Ulf Larson Lecture outline! Introduction to Computer Forensics! Digital investigation! Conducting a Digital Crime Scene
CCE Certification Competencies
CCE Certification Competencies May 10, 2012 Page 1 The Certified Computer Examiner (CCE) has evolved into one of the most desired certifications in the computer forensics industry. The certification is
Hands-On How-To Computer Forensics Training
j8fm6pmlnqq3ghdgoucsm/ach5zvkzett7guroaqtgzbz8+t+8d2w538ke3c7t 02jjdklhaMFCQHihQAECwMCAQIZAQAKCRDafWsAOnHzRmAeAJ9yABw8v2fGxaq skeu29sdxrpb25zidxpbmznogtheories...ofhilz9e1xthvqxbb0gknrc1ng OKLbRXF/j5jJQPxXaNUu/It1TQHSiyEumrHNsnn65aUMPnrbVOVJ8hV8NQvsUE
1/26/15. Chapter 2 Crime Scene
Chapter 2 Crime Scene Chapter 2 Crime Scene By the end of this chapter you will be able to: By the end of this chapter you will be able to: Investigation and Evidence Collection 1 Investigation and Evidence
Computer Hacking Forensic Investigator v8
CÔNG TY CỔ PHẦN TRƯỜNG CNTT TÂN ĐỨC TAN DUC INFORMATION TECHNOLOGY SCHOOL JSC LEARN MORE WITH LESS! Computer Hacking Forensic Investigator v8 Course Description: EC-Council releases the most advanced Computer
Digital Forensic Tool for Decision Making in Computer Security Domain
Digital Forensic Tool for Decision Making in Computer Security Domain S. K. Khode 1,V. N. Pahune 2 and M. R. Sayankar 3 1, 2, 3 Computer Engineering Department of Bapurao Deshmukh College of Engineering,
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE. Vahidin Đaltur, Kemal Hajdarević,
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE Vahidin Đaltur, Kemal Hajdarević, Internacional Burch University, Faculty of Information Technlogy 71000 Sarajevo, Bosnia
Introduction to Network Security Comptia Security+ Exam. Computer Forensics. Evidence. Domain 5 Computer Forensics
Introduction to Network Security Comptia Security+ Exam Domain 5 Computer Forensics Computer Forensics Forensics relates to the application of scientific knowledge and method to legal problems Investigating
EC-Council Ethical Hacking and Countermeasures
EC-Council Ethical Hacking and Countermeasures Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
Digital Forensics Tutorials Acquiring an Image with FTK Imager
Digital Forensics Tutorials Acquiring an Image with FTK Imager Explanation Section Digital Forensics Definition The use of scientifically derived and proven methods toward the preservation, collection,
MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1
MSc Computer Security and Forensics Cohort: MCSF/09B/PT Examinations for 2009-2010 / Semester 1 MODULE: COMPUTER FORENSICS & CYBERCRIME MODULE CODE: SECU5101 Duration: 2 Hours Instructions to Candidates:
2! Bit-stream copy. Acquisition and Tools. Planning Your Investigation. Understanding Bit-Stream Copies. Bit-stream Copies (contd.
Acquisition and Tools COMP 2555: Principles of Computer Forensics Autumn 2014 http://www.cs.du.edu/2555 1 Planning Your Investigation! A basic investigation plan should include the following activities:!
Overview of Computer Forensics
Overview of Computer Forensics Don Mason, Associate Director National Center for Justice and the Rule of Law University of Mississippi School of Law [These materials are based on 4.3.1-4.3.3 in the National
Design Document for Implementing a Digital Forensics Laboratory
Design Document for Implementing a Digital Forensics Laboratory Version.00 Group CNWIS-G4 Department of Computer Science and Engineering University of Moratuwa Project Supervisors: Dr Chandana Gamage Project
Digital Forensic Techniques
Digital Forensic Techniques Namrata Choudhury, Sr. Principal Information Security Analyst, Symantec Corporation Professional Techniques T23 CRISC CGEIT CISM CISA AGENDA Computer Forensics vs. Digital Forensics
RECOVERING DELETED DATA FROM FAT PARTITIONS WITHIN MOBILE PHONE HANDSETS USING TRADITIONAL IMAGING TECHNIQUES
RECOVERING DELETED DATA FROM FAT PARTITIONS WITHIN MOBILE PHONE HANDSETS USING TRADITIONAL IMAGING TECHNIQUES KEVIN MANSELL CONTROL-F LTD. KEVIN.MANSELL@CONTROLF.CO.UK DARREN LOLE & FIONA LITCHFIELD SERVICE
Digital Forensics and Cyber Crime Datamining
Journal of Information Security, 2012, 3, 196-201 http://dx.doi.org/10.4236/jis.2012.33024 Published Online July 2012 (http://www.scirp.org/journal/jis) Digital Forensics and Cyber Crime Datamining K.
COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL)
COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL) COURSE DESCRIPTION: Computer Forensics is focused on teaching
Survey of Disk Image Storage Formats
Survey of Disk Image Storage Formats Version 1.0 Common Digital Evidence Storage Format Working Group Digital Forensic Research Workshop September 1, 2006 Digital data that could be used as evidence are
EnCase 7 - Basic + Intermediate Topics
EnCase 7 - Basic + Intermediate Topics Course Objectives This 4 day class is designed to familiarize the student with the many artifacts left behind on Windows based media and how to conduct a forensic
Survey on Different Phases of Digital Forensics Investigation Models
Survey on Different Phases of Digital Forensics Investigation Models Priya S. Patil 1, Prof. A. S. Kapse 2 P. R. Patil College of Engineering and Technology, Amravati, India ABSTRACT: Most forensics models
Term Report. Forensics for IT
Term Report Forensics for IT Trisia Yung ACC 626 Professor Malik Datardina June 28, 2012 Introduction Technology has enhanced the operational aspects of today s businesses by improving productivity and
Digital Forensics for Attorneys Overview of Digital Forensics
Lars Daniel,, EnCE, ACE, CTNS Digital Forensic Examiner Digital Forensics for Attorneys Overview of Digital Forensics Digital Forensics For Attorneys Overview of Digital Forensics Types of Digital Evidence
Computer Forensics. Securing and Analysing Digital Information
Computer Forensics Securing and Analysing Digital Information Aims What is a computer? Where is the evidence? Why is digital forensics important? Seizing evidence Encryption Hidden files and folders Live
CYBER FORENSICS. KRISHNA SASTRY PENDYALA Cyber Forensic Division Central Forensic Science Laboratory Hyderabad.
CYBER FORENSICS KRISHNA SASTRY PENDYALA Cyber Forensic Division Central Forensic Science Laboratory Hyderabad. 11 DIGITAL EVIDENCE? Cyber crimes Digital evidence Digital evidence is any information of
Cell Phone Forensics For Legal Professionals
1 Cell Phone Forensics For Legal Professionals Lars E. Daniel, EnCE, ACE, AME, CTNS, SCE, SCCM, SCA Digital Forensics Examiner Cell Phone Acquisition and Examination Collection and Acquiring Cell Phones
Spoliation of Evidence. Prepared for:
Spoliation of Evidence Prepared for: Spoliation Nationwide anti-spoliation trend Cases can be thrown out of court Insurers can be denied subrogation claims An insured who destroys evidence of a claim can
INCIDENT RESPONSE & COMPUTER FORENSICS, SECOND EDITION
" - * INCIDENT RESPONSE & COMPUTER FORENSICS, SECOND EDITION CHRIS PROSISE KEVIN MANDIA McGraw-Hill /Osborne New York Chicago San Francisco Lisbon London Madrid Mexico City Milan New Delhi San Juan Seoul
Incident Response and Forensics
Incident Response and Forensics Yiman Jiang, President and Principle Consultant Sumus Technology Ltd. James Crooks, Manager - Advisory Services PricewaterhouseCoopers LLP UBC 2007-04-12 Outline Computer
ITU Session Four: Device Imaging And Analysis. Mounir Kamal Q-CERT
ITU Session Four: Device Imaging And Analysis Mounir Kamal Q-CERT 2 Applying Forensic Science to Computer Systems Like a Detective, the archaeologist searches for clues in order to discover and reconstruct
CONCEPT MAPPING FOR DIGITAL FORENSIC INVESTIGATIONS
Chapter 22 CONCEPT MAPPING FOR DIGITAL FORENSIC INVESTIGATIONS April Tanner and David Dampier Abstract Research in digital forensics has yet to focus on modeling case domain information involved in investigations.
Bringing Science to Digital Forensics with Standardized Forensic Corpora.
Bringing Science to Digital Forensics with Standardized Forensic Corpora. Digital Evaluation and Exploitation (DEEP) Group http://domex.nps.edu/ February 2010 1 NPS is the Navyʼs Research University. Location:
InfoSec Academy Forensics Track
Fundamental Courses Foundational Courses InfoSec Academy Specialized Courses Advanced Courses Certification Preparation Courses Certified Information Systems Security Professional (CISSP) Texas Security
Journal of Digital Forensic Practice
Journal of Digital Forensic Practice Journal of Digital Forensic Practice, 2:57 61, 2008 Copyright Taylor & Francis Group, LLC ISSN: 1556-7281 print / 1556-7346 online DOI: 10.1080/15567280801958464 UDFP
Scene of the Cybercrime Second Edition. Michael Cross
Scene of the Cybercrime Second Edition Michael Cross Chapter 1 Facing the Cybercrime Problem Head-On 1 Introduction 2 Defining Cybercrime 2 Understanding the Importance of Jurisdictional Issues 3 Quantifying
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065 Introduction The Computer Forensics and Investigation course presents methods to properly conduct a computer forensics investigation
Linux in Law Enforcement
Linux in Law Enforcement It's all about CONTROL Barry J. Grundy CALUG MEETING JUNE 2008 !! Disclaimer!! This presentation is not sponsored by any organization of the US Government I am here representing
CYBER FORENSICS (W/LAB) Course Syllabus
6111 E. Skelly Drive P. O. Box 477200 Tulsa, OK 74147-7200 CYBER FORENSICS (W/LAB) Course Syllabus Course Number: CSFS-0020 OHLAP Credit: Yes OCAS Code: 8134 Course Length: 130 Hours Career Cluster: Information
Where is computer forensics used?
What is computer forensics? The preservation, recovery, analysis and reporting of digital artifacts including information stored on computers, storage media (such as a hard disk or CD-ROM), an electronic
Computer Forensic Tools. Stefan Hager
Computer Forensic Tools Stefan Hager Overview Important policies for computer forensic tools Typical Workflow for analyzing evidence Categories of Tools Demo SS 2007 Advanced Computer Networks 2 Important
Digital Evidence Search Kit
Digital Evidence Search Kit K.P. Chow, C.F. Chong, K.Y. Lai, L.C.K. Hui, K. H. Pun, W.W. Tsang, H.W. Chan Center for Information Security and Cryptography Department of Computer Science The University
Detection of Data Hiding in Computer Forensics. About Your Presenter
Detection of Data Hiding in Computer Forensics NEbraskaCERT Conference August 22nd, 2008 James E. Martin CISSP, JD About Your Presenter 2008-Present: Security Engineer, West Corporation 2004-2008: Senior
COWLEY COLLEGE & Area Vocational Technical School
COWLEY COLLEGE & Area Vocational Technical School COURSE PROCEDURE FOR Student Level: This course is open to students on the college level in either the freshman or sophomore year. Prerequisites: Basic
Computer Forensics: an approach to evidence in cyberspace
Computer Forensics: an approach to evidence in cyberspace Abstract This paper defines the term computer forensics, discusses how digital media relates to the legal requirements for admissibility of paper-based
Just EnCase. Presented By Larry Russell CalCPA State Technology Committee May 18, 2012
Just EnCase Presented By Larry Russell CalCPA State Technology Committee May 18, 2012 What is e-discovery Electronically Stored Information (ESI) Discover or Monitor for Fraudulent Activity Tools used
How To Do Digital Forensics
Enterprise Risk Management Miami, FL Digital Forensics Risk Management and Information Systems Security Consulting Services January 2011 UMiami alumnus Bachelors: Information Systems and Marketing MS Computer
Large Scale Cloud Forensics
Large Scale Cloud Forensics Edward L. Haletky AstroArch Consulting, Inc. Sam Curry RSA, The Security Division of EMC Session ID: STAR-302 Session Classification: Advanced Happenstance Lo and Behold Sam
Computer Forensics as an Integral Component of the Information Security Enterprise
Computer Forensics as an Integral Component of the Information Security Enterprise By John Patzakis 10/28/03 I. EXECUTIVE SUMMARY In addition to fending off network intrusions and denial of service attacks,
What Happens When You Press that Button? Explaining Cellebrite UFED Data Extraction Processes
What Happens When You Press that Button? Explaining Cellebrite UFED Data Extraction Processes Table of Contents UFED Basics...3 Extraction Types...4 Logical extraction...5 Logical extractions of ios devices...5
The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices
The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices Introduction As organizations rely more heavily on technology-based methods of communication, many corporations
Information Technology Audit & Forensic Techniques. CMA Amit Kumar
Information Technology Audit & Forensic Techniques CMA Amit Kumar 1 Amit Kumar & Co. (Cost Accountants) A perfect blend of Tax, Audit & Advisory services Information Technology Audit & Forensic Techniques
What is Digital Forensics?
DEVELOPING AN UNDERGRADUATE COURSE IN DIGITAL FORENSICS Warren Harrison PSU Center for Information Assurance Portland State University Portland, Oregon 97207 warren@cs.pdx.edu What is Digital Forensics?
About Your Presenter. Digital Forensics For Attorneys. Overview of Digital Forensics
Larry E. Daniel, EnCE, DFCP, BCE Digital Forensic Examiner Digital Forensics for Attorneys An Overview of Digital Forensics About Your Presenter EnCase Certified Examiner (EnCE) Digital Forensics Certified
Digital Forensics Lecture 3. Hard Disk Drive (HDD) Media Forensics
Digital Forensics Lecture 3 Hard Disk Drive (HDD) Media Forensics Current, Relevant Topics defendants should not use disk-cleaning utilities to wipe portions of their hard drives before turning them over
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING MODULE A INTRODUCTION TO COMPUTER FORENSICS AND NVESTIGATIONS A1.0 Explain concepts related to computer forensics. A1.1 This module is measured
Taxonomy of Anti-Computer Forensics Threats
1 Taxonomy of Anti-Computer Forensics Threats Joseph C. Sremack & Alexandre V. Antonov 12 September 2007 2 Overview 1. Introduction 2. Problem Statement 3. High-Level Overview of Investigation Phases 4.
CDFE Certified Digital Forensics Examiner (CFED Replacement)
Course: CDFE Certified Digital Forensics Examiner (CFED Replacement) Description: Price: $3,450.00 Category: Popular Courses Duration: 5 days Schedule: Request Dates Outline: COURSE OVERVIEW Computer Forensics
Computer Forensics & Electronic Discovery Setec Investigations offers unparalleled expertise in computer forensics and electronic discovery,
Computer Forensics & Electronic Discovery Setec Investigations offers unparalleled expertise in computer forensics and electronic discovery, providing highly personalized, case-specific forensic analysis
Ten Deadly Sins of Computer Forensics
Ten Deadly Sins of Computer Forensics Cyber criminals take advantage of the anonymity of the Internet to escape punishment. Computer Forensics has emerged as a new discipline to counter cyber crime. This
Framework for Live Digital Forensics using Data Mining
Framework for Live Digital Forensics using Data Mining Prof Sonal Honale #1, Jayshree Borkar *2 Computer Science and Engineering Department, Aabha Gaikwad College of Engineering, Nagpur, India Abstract
Computer Forensic Capabilities
Computer Forensic Capabilities Agenda What is computer forensics? Where to find computer evidence Forensic imaging Forensic analysis What is Computer Forensics? The preservation, identification, extraction,
Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers
Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers Brian Carrier Research Scientist @stake Abstract This paper uses the theory of abstraction layers to describe the purpose
CERIAS Tech Report 2003-29 GETTING PHYSICAL WITH THE DIGITAL INVESTIGATION PROCESS. Brian Carrier & Eugene H. Spafford
CERIAS Tech Report 2003-29 GETTING PHYSICAL WITH THE DIGITAL INVESTIGATION PROCESS Brian Carrier & Eugene H. Spafford Center for Education and Research in Information Assurance and Security, Purdue University,
Microsoft Vista: Serious Challenges for Digital Investigations
Proceedings of Student-Faculty Research Day, CSIS, Pace University, May 2 nd, 2008 Microsoft Vista: Serious Challenges for Digital Investigations Darren R. Hayes and Shareq Qureshi Seidenberg School of
Digital Forensics & e-discovery Services
Digital Forensics & e-discovery Services U.S. Security Associates Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities
Introduction to Computer Forensics ITP 499 (3 Units)
Introduction to Computer Forensics ITP 499 (3 Units) Description In 2007, the FBI reported that over 200 major companies reported a loss of over 60 million dollars due to computer crime. Computers are
Robotics Core School 1
Robotics Core School 1 Robotics Core School 2 Cyber Forensics & Crime Investigation This workshop is dedicated on Cyber Forensics & Crime Investigation. Computer Forensics is a detailed and scientific
Course Structure 2015/2016
Master of Science in Business Administration UNIVERSITA DEGLI STUDI DI ROMA TOR VERGATA Course Structure 2015/2016 Management SSD CFU Service Management SECS P/08 6 Control and Auditing SSD CFU Marketing
Breakfast Meeting: Securing your Secured Data Digital Forensics, Fraud and Forensic Advancements
Breakfast Meeting: Securing your Secured Data Digital Forensics, Fraud and Forensic Advancements 9 April 2013 Facilitator: Dr. Sheau-Dong Lang, Coordinator Master of Science in Digital Forensics University
An overview of IT Security Forensics
An overview of IT Security Forensics Manu Malek, Ph.D. Stevens Institute of Technology mmalek@ieee.org www.cs.stevens.edu/~mmalek April 2008 IEEE Calif. 1 Outline Growing Threats/Attacks Need for Security
Digital Forensics & e-discovery Services
Digital Forensics & e-discovery Services Andrews International Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities
Design and Implementation of a Live-analysis Digital Forensic System
Design and Implementation of a Live-analysis Digital Forensic System Pei-Hua Yen Graduate Institute of Information and Computer Education, National Kaohsiung Normal University, Taiwan amber8520@gmail.com
INF 3510 INFORMATION SECURITY Guest Lecture @UiO on Digital Forensics April 17 2012. André Årnes, PhD andre.arnes@hig.no
INF 3510 INFORMATION SECURITY Guest Lecture @UiO on Digital Forensics April 17 2012 André Årnes, PhD andre.arnes@hig.no Who am I? Enterprise Security @Telenor and Assoc Professor @HiG PhD and MSc from
NEW IMPROVEMENT IN DIGITAL FORENSIC STANDARD OPERATING PROCEDURE (SOP)
NEW IMPROVEMENT IN DIGITAL FORENSIC STANDARD OPERATING PROCEDURE (SOP) Sundresan Perumal 1, and Norita Md Norwawi. 2 1 Universiti Sains Islam Malaysia,sundresan@hotmail.com 2 Universiti Sains Islam Malaysia,
The Contribution of Tool Testing to the Challenge of Responding to an IT Adversary
The Contribution of Tool Testing to the Challenge of Responding to an IT Adversary Jim Lyle National Institute of Standards and Technology 23 October 2006 10/18/2006 1 DISCLAIMER Certain trade names and
Impact of Digital Forensics Training on Computer Incident Response Techniques
Impact of Digital Forensics Training on Computer Incident Response Techniques Valorie J. King, PhD Collegiate Associate Professor University of Maryland University College Presentation to AFCEA June 25,
Introduction. IMF Conference September 2008
Live Forensic Acquisition as Alternative to Traditional Forensic Processes Marthie Lessing* Basie von Solms Introduction The Internet and technology developments introduced a sharp increase in computer
Admissibility of Digital Photographs in Criminal Trials
Admissibility of Digital Photographs in Criminal Trials Keith Hodges, Senior Instructor, Keith.Hodges@dhs.gov Federal Law Enforcement Training Center Glynco, GA 1 What we will discuss Digital photos captured
Services. Computer Forensic Investigations
DataTriangle, Inc. is uniquely structured to provide you with a high quality expert as expeditiously as possible. Charles Snipes has nearly 15 years of experience with criminal investigations in the areas
Open Source Digital Forensics Tools
The Legal Argument 1 carrier@cerias.purdue.edu Abstract This paper addresses digital forensic analysis tools and their use in a legal setting. To enter scientific evidence into a United States court, a
Forensics source: Edward Fjellskål, NorCERT, Nasjonal sikkerhetsmyndighet (NSM)
s Unix Definition of : Computer Coherent application of a methodical investigatory techniques to solve crime cases. Forensics source: Edward Fjellskål, NorCERT, Nasjonal sikkerhetsmyndighet (NSM) s Unix
Digital Forensic. A newsletter for IT Professionals. I. Background of Digital Forensic. Definition of Digital Forensic
I Digital Forensic A newsletter for IT Professionals Education Sector Updates Issue 10 I. Background of Digital Forensic Definition of Digital Forensic Digital forensic involves the collection and analysis
Keywords: Computers, digital evidence, digital evidence bags, forensics, forensics tools
Computer Forensics Procedures, Tools, and Digital Evidence Bags 1 Computer Forensic Tools Keywords: Computers, digital evidence, digital evidence bags, forensics, forensics tools Computer Forensics Procedures,
Computer Forensics Today
L A W, I N V E S T I G A T I O N S, A N D E T H I C S Computer Forensics Today Kelly J. (KJ) Kuchta When people hear the word forensics, it often generates a mental image of the movie series with Jack
How Important are Facebook Artifacts?
How Important are Facebook Artifacts? In March 2013, Facebook reportedly had just over 1 billion users worldwide. Founded in February 2004, it can be considered one of the grandfathers of social networking.
Getting Physical with the Digital Investigation Process
Getting Physical with the Digital Investigation Process Brian Carrier Eugene H. Spafford Center for Education and Research in Information Assurance and Security CERIAS Purdue University Abstract In this
BOR 6432 Cybersecurity and the Constitution. Course Bibliography and Required Readings:
BOR 6432 Cybersecurity and the Constitution Course Description This course examines the scope of cybercrime and its impact on today s system of criminal justice. Topics to be studied include: cybercrime
Digital Forensic Research: Current State-of-the-Art
Digital Forensic Research: Current State-of-the-Art Sriram Raghavan Queensland University of Technology Brisbane, Queensland 4000, AUSTRALIA s.raghavan@qut.edu.au Abstract Digital Forensics is the process
IAPE STANDARDS SECTION 16 DIGITAL EVIDENCE
IAPE STANDARDS SECTION 16 DIGITAL EVIDENCE IAPE STANDARD SECTION 16.1 DIGITAL EVIDENCE Standard: Digital evidence is a critical element of modern criminal investigation that should be maintained in strict
EVALUATION OF REGISTRY DATA REMOVAL BY SHREDDER PROGRAMS
Chapter 5 EVALUATION OF REGISTRY DATA REMOVAL BY SHREDDER PROGRAMS Harry Velupillai and Pontjho Mokhonoana Abstract Shredder programs attempt to overcome Window s inherent inability to erase data completely.
Computer Anti-forensics Methods and Their Impact on Computer Forensic Investigation
Computer Anti-forensics Methods and Their Impact on Computer Forensic Investigation Przemyslaw Pajek and Elias Pimenidis School of Computing IT and Engineering, University of East London, United Kingdom
Chapter 7 Securing Information Systems
1 Chapter 7 Securing Information Systems LEARNING TRACK 3: COMPUTER FORENSICS For thirty years, a serial murderer known as the BTK killer (standing for bind, torture, and kill) remained at large in Wichita,
Quality Digital Forensics - the Frontier
Quality Digital Forensics - the Frontier Mark M. Pollitt Asst. Professor University of Central Florida Bachelor of Science Engineering Technology (BSET) BSET- Design BSET- Operation BSET- GeomaticsBSET-
https://agency.governmentjobs.com/dakota/job_bulletin.cfm?jobid=1017820
Page 1 of 5 DAKOTA COUNTY Employee Relations Administration Center, 1590 Highway 55 Hastings, MN 55033-2372 651.438.4435 http://www.dakotacounty.us INVITES APPLICATIONS FOR THE POSITION OF: Electronic
State of the art of Digital Forensic Techniques
State of the art of Digital Forensic Techniques Enos K. Mabuto 1, H. S Venter 2 Department of Computer Science University of Pretoria, Pretoria, 0002, South Africa Tel: +27 12 420 3654 Email: nasbutos@yahoo.co.uk
Tuskegee University Department of Computer Science Course No: CSCI 390 (Computer Forensics) Fall 2011 - MWF 1:00-2:300, BRIM 301
Tuskegee University Department of Computer Science Course No: CSCI 390 (Computer Forensics) Fall 2011 - MWF 1:00-2:300, BRIM 301 Instructor: Dr. C. L. Chen Office: In the office complex Phone: 727-8554
Digital Forensics. Larry Daniel
Digital Forensics Larry Daniel Introduction A recent research report from The Yankee Group found that 67.6 percent of US households in 2002 contained at least one PC The investigators foresee three-quarters
Running head: DIGITAL EVIDENCE: 1
Running head: DIGITAL EVIDENCE: 1 Digital Evidence: How can the Des Moines Fire Department utilize this evidence in fire investigations? Mark Dooley Des Moines Fire Department, Des Moines, IA DIGITAL EVIDENCE:
Sensitive Incident Investigations. Digital Risk Management. Forensics Testing.
Sensitive Incident Investigations. Digital Risk Management. Forensics Testing. 2009 Innovation Award Winner Austin Chamber of Commerce 2010 Innovation Award Finalist Austin Chamber of Commerce Only private