Upload File

an introduction to computer forensics

17
An Introduction to Computer Forensics Jim Lindsey Western Kentucky University

Upload: barney

Post on 14-Jan-2016

35 views

Category:

Documents


2 download

Report

Tags:

DESCRIPTION

An Introduction to Computer Forensics. Jim Lindsey Western Kentucky University. What are we talking about?. Forensic …. What are we talking about?. Forensic Science is the use of science to investigate and establish facts in criminal and civil cases. What are we talking about?. - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: An Introduction to Computer Forensics

An Introduction to Computer Forensics

Jim LindseyWestern Kentucky University

Page 2: An Introduction to Computer Forensics

What are we talking about?

Forensic …

Page 3: An Introduction to Computer Forensics

What are we talking about?

Forensic Science is the use of science to investigate and establish facts in criminal and civil cases.

Fat-Free Muffins Breakeven Analysis

$0.00

$10,000.00

$20,000.00

$30,000.00

$40,000.00

$50,000.00

$60,000.00

0 5,054 10,108 15,161 20,215

Units

Do

llar

s Fixed Cost

Total Cost

Revenue

Page 4: An Introduction to Computer Forensics

What are we talking about?

Computer Forensics is the discovery, collection, and analysis of evidence found on computers and networks.

Page 5: An Introduction to Computer Forensics

Many Hats

Law

Investigative

Skills

Technology

Computer

Forensics

Page 6: An Introduction to Computer Forensics

An Exam May Explain …

Hidden data Most recently used applications Origin of documents Evidence of “wiping” Visited Internet sites

Page 7: An Introduction to Computer Forensics

An Exam May Require …

Cloning Write Blocker MD-5 & SHA-1

Cataloging Recovery of Deleted Files Search for hidden, disguised

or encrypted files Viewing files Analysis of time/date stamps

Page 8: An Introduction to Computer Forensics

Deleted Files

Page 9: An Introduction to Computer Forensics

Deleted Files

Page 10: An Introduction to Computer Forensics

An Examiner Should …

Possess requisite training and equipment

Be able to provide training Be knowledgeable of data relevant

to computer-related crimes Be able to effectively testify as an

expert in a court of law

Page 11: An Introduction to Computer Forensics

What to do?

If the computer is off, do not turn on.

If the computer is on, do not shut down normally – call for instructions.

Do not “browse” the files!

Page 12: An Introduction to Computer Forensics
Page 13: An Introduction to Computer Forensics

What to do?

Document, document, document - W H Y ?

Records chain of custody: Where the evidence came from When it was obtained Who obtained it Who secured it Who has had control of it Where it is stored

Page 14: An Introduction to Computer Forensics

Final Notes

Forensic Examinations Normally 1-2 hours to forensically

image a hard drive Exams can take 4-40 hours,

depending on requests Helpful if “keywords” provided Know what you want to search for…..

Page 15: An Introduction to Computer Forensics

Final Notes Average HD Volume 590 GB* Gigabyte 1,073,741,824 bytes Subtotal 633,507,676,160 bytes Page size 3000 bytes Pages 211,169,225 Ream 500 pages Reams 422,338 Reams Ream height 2” Total height 844,676” Height in feet 70,389 feet Height of Mt Everest 29,029 feet**

Note these figures are conservative!

* http://www.tomshardware.com/news/seagate-hdd-gigabyte-terabyte-quarter-result,13118.html** http://www.teameverest03.org/everest_info/index.html

http://www.tomshardware.com/news/seagate-hdd-gigabyte-terabyte-quarter-result,13118.html
http://www.tomshardware.com/news/seagate-hdd-gigabyte-terabyte-quarter-result,13118.html
http://www.teameverest03.org/everest_info/index.html
Page 16: An Introduction to Computer Forensics

Explain what the 'Chain of Custody' is in computer forensics. Furthermore, explain why it is important for forensic examiners to establish 'Chain of Custody' as soon as they arrive on a scene and maintain it throughout the life of a case.

We spent a day discussing computer forensics. How could knowledge of this topic help a human resources manager do their job? How could knowledge of this topic help a police officer do their job?

Page 17: An Introduction to Computer Forensics

Are there any questions?


Introduction to filesystems and computer forensics

Computer Forensics: Basics Lecture 1 The Context of Computer Forensics

COMPUTER FORENSICS - Boise Chapter€¦ · 3 Mobile device forensics 4 Other 5 References Computer forensics Main article: computer forensics ... 1.19 Computer Forensics Solution

Computer forensics - Jordan University of Science and ...tawalbeh/aabfs/presentations/computer_forensics.pdf · 29.08.2006 Computer forensics 2 Computer forensics Definitions: Forensics

SAK 4801 INTRODUCTION TO COMPUTER FORENSICS Chapter 5 Computer Forensics Tools Mohd Taufik Abdullah Department of Computer Science Faculty of Computer

Cloud Storage Forensics - SANS Computer Forensics

UNIT III INTRODUCTION TO COMPUTER FORENSICS · UNIT III INTRODUCTION TO COMPUTER FORENSICS ... commerce, research, education, entertainment, and public discourse. A global ... Cyberspace

Computer Forensics

Introduction to Computer Forensics€¦ · JNTU World Introduction to Computer Forensics 6 “Evidence” Circumstantial evidence (“Indiz”): A hint, which (alone or together with

Xinwen Fu Anonymous Communication & Computer Forensics 91.580.203 Computer & Network Forensics

Master of Science(Cyber Security) (MSCS) …...Master of Science(Cyber Security) (MSCS) Computer Forensics (CSP-18) Block 1 Introduction to Computer Forensics Unit – 1: INTRODUCTION

Introduction to Computer Forensics...Michael Sonntag Introduction to Computer Forensics 6 “Evidence” Circumstantial evidence (“Indiz”): A hint, which (alone or together with

COMPUTER FORENSICS · 2019-08-24 · 1.0 Computer Forensics In Today’s World 1.0 Intro To Computer Forensics 2.0 Need For Computer Forensics 3.0 What is Cyber Crime 4.0 Forensics

Introduction to Computer Forensics - carfield · An introduction to: Computer Forensics table of contents table of contents 2 1 introduction 3 2 computer forensics 4 3 electronic

An Introduction to Computer Forensics Jim Lindsey Western Kentucky University

Defining computer forensics Computer Forensics ......Computer Forensics Computer forensics is a fascinating field. As enterprises become more com-plex and exchange more information

SAK 4801 INTRODUCTION TO COMPUTER FORENSICS Chapter 7 Image Files Forensics Mohd Taufik Abdullah Department of Computer Science Faculty of Computer Science

Introduction to Computer Forensics - FIM Homepage · 2012-08-24 · Michael Sonntag Introduction to Computer Forensics 5 What is "Computer Forensics"? The main elements: Has something

Computer)Forensics - Computing Science and Mathematics ... · Computer)Security)&)Forensics Autumn)2014 Computer)Forensics! Computer)Forensics)is)the)process)of)analysing)digital)media)to)determine)if)

COEN 252 Computer Forensics Introduction to Computer Forensics Thomas Schwarz, S.J. 2009 w/ T. Scocca

Digital Evidence and Computer Forensics Oct 7-8 2013/Tab 02 Oct 7-8... · Digital Evidence and Computer Forensics COMPUTER FORENSICS FORENSICS FORENSICS

Introduction to Computer Forensics and Hashing 1

Live Forensics Investigations Computer Forensics 2013

Computer Forensics: Introduction - AMAN Systemamansystem.com › apps › people › sallay › CF › slides › CF-Lecture1.pdf · 1 Computer Forensics: Introduction Lecture 1!

Computer Forensics. Definition What is Computer Forensics?? –Computer forensics involves the preservation, identification, extraction, documentation,

Introduction to Computer forensics - Michael Sonntag's Homepage

Introduction To Computer Forensics - DTIC · © 2010 Carnegie Mellon University Introduction To Computer Forensics [DISTRIBUTION STATEMENT A] This material has been approved for public

Introduction to Computer Forensics In Class.pdf · CIS 4000 Introduction to Computer Forensics Steganography and Its Detection with JP Hide and Seek, StegDetect, and StegBreak Purpose:

Solving Computer Crime: An Introduction to Digital Forensics Golden G. Richard III, Ph.D. Dept. of Computer Science Gulf Coast Computer Forensics Laboratory

Introduction: CIS8630 Business Computer Forensics and ... · Computer forensics is the process of methodically examining computer media (hard disks, diskettes, tapes, etc.) for evidence

Computer Forensics. Introduction Topics to be covered –Defining Computer Forensics –Reasons for gathering evidence –Who uses Computer Forensics –Steps

SAK 4801 INTRODUCTION TO COMPUTER FORENSICS Chapter 5 Computer Forensics Tools

Computer +forensics

My ERP got Hacked, an Introduction to Computer Forensics

Nuix Workshop – Introduction to Forensics€¦ · Nuix Workshop – Introduction to Forensics W HAT IS C OMPUTER F ORENSICS ? Computer) forensics,) also) called) cyber) forensics,)