Design Tradeoffs for Developing Fragmented Video Carving Tools
|
|
|
- Henry Poole
- 6 years ago
- Views:
Transcription
1 DIGITAL FORENSIC RESEARCH CONFERENCE Design Tradeoffs for Developing Fragmented Video Carving Tools By Eoghan Casey and Rikkert Zoun Presented At The Digital Forensic Research Conference DFRWS 2014 USA Denver, CO (Aug 3 rd - 6 th ) DFRWS is dedicated to the sharing of knowledge and ideas about digital forensics research. Ever since it organized the first open workshop devoted to digital forensics in 2001, DFRWS continues to bring academics and practitioners together in an informal environment. As a non-profit, volunteer organization, DFRWS sponsors technical working groups, annual conferences and challenges to help drive the direction of research and development.
2 Design Tradeoffs for Developing Fragmented Video Carving Tools Eoghan Casey (MITRE/DC3) & Rikkert Zoun (NFI) DFRWS2014
3 Example Scenario Crime Recorded with smartphone camera Smartphone is seized for forensic examination
4 Example Scenario Investigation with conventional tools reveals? File was deleted and overwritten No valid video file could be recovered END OF INVESTIGATION?
5 Example Scenario Closer inspection of smartphone reveals:? Deleted file was only partly overwritten. Fragment of video file was recoverable and images made viewable
6 Motivation Maximize playable video fragments Minimize missed fragments Minimize unplayable fragments HARDER THAN YOU MIGHT THINK!
7 Personal Motivation
8 Fragmented Lessons DFRWS2007 Forensic Challenge Make use of cluster boundaries Container Video data Audio data Video data Audio data (etc ) Fragment classification (Simson et al, 2010) Reassembly of compressed video data (Lewis, 2012) Reassembling individual frames (Na et al, 2014)
9 Fragmented Digital Videos Carving challenges There are no safe assumptions Flexible file specifications Codecs
10 Strategy Rely on human review and reassembly Requires person with knowledge of file formats Employ multiple automated methods Results in more output to review, including dups OPTIMAL COMBINATION OF HUMAN-AUTOMATED?
11 NFI Defraser Digital Evidence Fragment Search & Rescue MPEG-1 & -2 Systems AVI 3GP / QT / MP4 ASF / WMV Decoding of encoded video formats MPEG-1, -2 & -4 video and H.264 (developing)
12 Carved 3GP Fragments (iphone)
13 DC3 Carver Also known as DCCI_StegCarver 2 methods for carving MPEG videos (contig & frag) 4 method for carving AVI videos (contig & frag) 3 method for carving 3GP videos (contig & frag) Repair of MPEG and AVI
14 Reassembled MPEG Fragments DFRWS2007 Forensic Challenge Combined Carved_MPEG_Fragment_dfrws-2007-challenge.img_301_ _ MPG And Carved_MPEG_Fragment_dfrws challenge.img_296_ _ mpg Combined Carved_MPEG_Fragment_dfrws-2007-challenge.img_301_ _ MPG And Carved_MPEG_Fragment_dfrws challenge.img_408_ _ mpg Combined Carved_MPEG_Fragment_dfrws-2007-challenge.img_301_ _ MPG And Carved_MPEG_Fragment_dfrws challenge.img_295_ _ mpg Combined Carved_MPEG_Fragment_dfrws-2007-challenge.img_301_ _ MPG And Carved_MPEG_Fragment_dfrws challenge.img_410_ _ mpg Combined Carved_MPEG_Fragment_dfrws-2007-challenge.img_301_ _ MPG And Carved_MPEG_Fragment_dfrws challenge.img_362_ _ mpg Combined Carved_MPEG_Fragment_dfrws-2007-challenge.img_301_ _ MPG And Carved_MPEG_Fragment_dfrws challenge.img_364_ _ mpg Combined Carved_MPEG_Fragment_dfrws-2007-challenge.img_301_ _ MPG And Carved_MPEG_Fragment_dfrws challenge.img_363_ _ mpg Inserted 12 byte pack header copied from byte location 6144 into E:\dfrws2007\log_4_21_2011_10_23_41_AM\Logical MPEGs\Carved_8_ _Logical.mpg
15 File System Considerations Most forensic tools Unallocated = 408,068,096 bytes (389 MB) EnCase Unallocated = 376,360,960 bytes (359 MB) Subtracts size of recovered deleted files +?
16 File System Considerations NTFS VDL Slack
17 Finding AVI Video Fragments Description Hex values Byte range File header RIFF - Total size of AVI - AVI Header list LIST - Size of header list - hdrl AVI header avih - Size of avi header - Various flags - # of video frames LIST structures - Size of list - List type (movi, odml or stream) Chunk four character code ( db, dc, wb or tx ) - Size of chunk - Data Index idx1 - Size of index - Index entries Index entry four character code( db, dc, wb or tx ) - Flags - Offset of chunk - Size of chunk \x52\x49\x46\x46-4 bytes (little endian) - \x41\x56\x49\x20 \x4c\x49\x53\x54-4 bytes (little endian) - \x68\x64\x72\x6c \x61\x76\x69\x68-4 bytes (little endian) \x4c\x49\x53\x54-4 bytes (little endian) - [movi, odml or stream] [Hex of db, dc, wb or tx] - 4 bytes (little endian) - [binary data] \x69\x64\x71\x31-4 bytes (little endian) [Hex of db, dc, wb or tx] - [flags] - 4 bytes (little endian) - 4 bytes (little endian) [0:3] - [4:7] - [8:b] [0:3] - [4:7] - [8:b] [0:3] - [4:7] - - [18:1b] [0:3] - [4:7] - [8:b] [0:3] - [4:7] - [8:size] [0:3] - [4:7] - [8:size] [0:3] - [4:7] - [8:b] - [c:f]
18 MPEG-2 fragments (DFRWS2007) Offset Size (bytes) Type Attribute PackHeader SystemClockReference= SystemHeader PesPacket PresentationTimeStamp=0, DecodingTimeStamp=" " SequenceHeader GroupOfPicturesHeader TimeCode="00:00: PackHeader SystemClockReference= PesPacket PresentationTimeStamp= PackHeader SystemClockReference= SequenceHeader GroupOfPicturesHeader TimeCode="00:00:00-10
19 Finding MPEG-4 Video Fragments Offset Size (bytes) Type Attribute Comment ftyp MajorBrand="isom" CompatibleBrands="mp41" mdat Vop TimeIncrement=0 CodingType="I_VOP" Vop TimeIncrement=1 CodingType="P_VOP" Vop TimeIncrement=2 CodingType="P_VOP" Vop TimeIncrement=3 CodingType="P_VOP" Vop TimeIncrement=4 CodingType="P_VOP" Vop TimeIncrement=5 CodingType="P_VOP" Vop TimeIncrement=6 CodingType="P_VOP" Vop TimeIncrement=7 CodingType="P_VOP" Vop TimeIncrement=8 CodingType="P_VOP" Vop TimeIncrement=9 CodingType="P_VOP" Vop TimeIncrement=10 CodingType="P_VOP" Vop TimeIncrement=11 CodingType="P_VOP" Vop TimeIncrement=12 CodingType="I_VOP" Vop TimeIncrement=13 CodingType="P_VOP" Vop TimeIncrement=14 CodingType="P_VOP" moov trak TrackID=1 Video
20 Measure Once, Cut Twice ftyp moov mdat Streams (part 1) Streams (part 2): Overwritten Streams (part 3) ftyp mdat Streams (part 1) Streams (part 2): Overwritten Streams (part 3) moov
21 Repair Unassigned Fragments
22 Repair Unassigned Fragments
23 Determine Whether Playable
Digital Investigation
Digital Investigation 11 (2014) S30eS39 Contents lists available at ScienceDirect Digital Investigation journal homepage: www.elsevier.com/locate/diin Design tradeoffs for developing fragmented video carving
Categories of Digital Investigation Analysis Techniques Based On The Computer History Model
DIGITAL FORENSIC RESEARCH CONFERENCE Categories of Digital Investigation Analysis Techniques Based On The Computer History Model By Brian Carrier, Eugene Spafford Presented At The Digital Forensic Research
A SURVEY ON MULTIMEDIA FILE CARVING
A SURVEY ON MULTIMEDIA FILE CARVING Raj Kumar Pahade 1, Bhupendra Singh 2 and Upasna Singh 3 Department of Computer Science & Engineering, Defence Institute of Advanced Technology (DIAT), Pune, India ABSTRACT
FRAME BASED RECOVERY OF CORRUPTED VIDEO FILES
FRAME BASED RECOVERY OF CORRUPTED VIDEO FILES D.Suresh 1, D.V.Ramana 2, D.Arun Kumar 3 * 1 Assistant Professor, Department of ECE, GMRIT, RAJAM, AP, INDIA 2 Assistant Professor, Department of ECE, GMRIT,
Forensic Analysis of Video File Formats
Forensic Analysis of Video File Formats Thomas Gloe André Fischer Matthias Kirchner Digital Forensics Research Workshop Europe 07.05. 09.05.2014 Amsterdam Investigation of Digital Video Typical questions
Developing a New Digital Forensics Curriculum
DIGITAL FORENSIC RESEARCH CONFERENCE Developing a New Digital Forensics Curriculum By Anthony Lang, Masooda Bashir, Roy Campbell and Lizanne Destefano Presented At The Digital Forensic Research Conference
The Normalized Compression Distance as a File Fragment Classifier
DIGITAL FORENSIC RESEARCH CONFERENCE The Normalized Compression Distance as a File Fragment Classifier By Stefan Axelsson Presented At The Digital Forensic Research Conference DFRWS 2010 USA Portland,
File Fragment Encoding Classification: An Empirical Approach
DIGITAL FORENSIC RESEARCH CONFERENCE File Fragment Encoding Classification: An Empirical Approach By Vassil Roussev and Candice Quates Presented At The Digital Forensic Research Conference DFRWS 2013 USA
Extracting Hidden Messages in Steganographic Images
DIGITAL FORENSIC RESEARCH CONFERENCE Extracting Hidden Messages in Steganographic Images By Tu-Thach Quach Presented At The Digital Forensic Research Conference DFRWS 2014 USA Denver, CO (Aug 3 rd - 6
Rapid Forensic Imaging of Large Disks with Sifting Collectors
DIGITAL FORENSIC RESEARCH CONFERENCE Rapid Forensic Imaging of Large Disks with Sifting Collectors By Jonathan Grier and Golden Richard Presented At The Digital Forensic Research Conference DFRWS 2015
Monitoring Access to Shared Memory-Mapped Files
DIGITAL FORENSIC RESEARCH CONFERENCE Monitoring Access to Shared Memory-Mapped Files By Christian Sarmoria, Steve Chapin Presented At The Digital Forensic Research Conference DFRWS 2005 USA New Orleans,
System for the Proactive, Continuous, and Efficient Collection of Digital Forensic Evidence
DIGITAL FORENSIC RESEARCH CONFERENCE System for the Proactive, Continuous, and Efficient Collection of Digital Forensic Evidence By Clay Shields, Ophir Frieder and Mark Maloof Presented At The Digital
Ranking Algorithms For Digital Forensic String Search Hits
DIGITAL FORENSIC RESEARCH CONFERENCE Ranking Algorithms For Digital Forensic String Search Hits By Nicole Beebe and Lishu Liu Presented At The Digital Forensic Research Conference DFRWS 2014 USA Denver,
Hash Based Disk Imaging Using AFF4
DIGITAL FORENSIC RESEARCH CONFERENCE Hash Based Disk Imaging Using AFF4 By Michael Cohen and Bradley Schatz Presented At The Digital Forensic Research Conference DFRWS 2010 USA Portland, OR (Aug 2 nd -
A Functional Reference Model of Passive Network Origin Identification
DIGITAL FORENSIC RESEARCH CONFERENCE A Functional Reference Model of Passive Network Origin Identification By Thomas Daniels Presented At The Digital Forensic Research Conference DFRWS 2003 USA Cleveland,
Unification of Digital Evidence from Disparate Sources
DIGITAL FORENSIC RESEARCH CONFERENCE Unification of Digital Evidence from Disparate Sources By Philip Turner Presented At The Digital Forensic Research Conference DFRWS 2005 USA New Orleans, LA (Aug 17
A Correlation Method for Establishing Provenance of Timestamps in Digital Evidence
DIGITAL FORENSIC RESEARCH CONFERENCE A Correlation Method for Establishing Provenance of Timestamps in Digital Evidence By Bradley Schatz, George Mohay, Andrew Clark Presented At The Digital Forensic Research
File Classification Using Sub-Sequence Kernels
DIGITAL FORENSIC RESEARCH CONFERENCE File Classification Using Sub-Sequence Kernels By Olivier DeVel Presented At The Digital Forensic Research Conference DFRWS 2003 USA Cleveland, OH (Aug 6 th - 8 th
Multidimensional Investigation of Source Port 0 Probing
DIGITAL FORENSIC RESEARCH CONFERENCE Multidimensional Investigation of Source Port 0 Probing By Elias Bou-Harb, Nour-Eddine Lakhdari, Hamad Binsalleeh and Mourad Debbabi Presented At The Digital Forensic
An Evaluation Platform for Forensic Memory Acquisition Software
DIGITAL FORENSIC RESEARCH CONFERENCE An Evaluation Platform for Forensic Memory Acquisition Software By Stefan Voemel and Johannes Stuttgen Presented At The Digital Forensic Research Conference DFRWS 2013
Android Forensics: Automated Data Collection And Reporting From A Mobile Device
DIGITAL FORENSIC RESEARCH CONFERENCE Android Forensics: Automated Data Collection And Reporting From A Mobile Device By Justin Grover Presented At The Digital Forensic Research Conference DFRWS 2013 USA
Introduction. Collecting, Searching and Sorting evidence. File Storage
Collecting, Searching and Sorting evidence Introduction Recovering data is the first step in analyzing an investigation s data Recent studies: big volume of data Each suspect in a criminal case: 5 hard
Breaking the Performance Wall: The Case for Distributed Digital Forensics
DIGITAL FORENSIC RESEARCH CONFERENCE Breaking the Performance Wall: The Case for Distributed Digital Forensics By Vassil Roussev, Golden Richard Presented At The Digital Forensic Research Conference DFRWS
Multi-version Data recovery for Cluster Identifier Forensics Filesystem with Identifier Integrity
Multi-version Data recovery for Cluster Identifier Forensics Filesystem with Identifier Integrity Mohammed Alhussein, Duminda Wijesekera Department of Computer Science George Mason University Fairfax,
Honeynets and Digital Forensics
DIGITAL FORENSIC RESEARCH CONFERENCE Honeynets and Digital Forensics By Lance Spitzner Presented At The Digital Forensic Research Conference DFRWS 2004 USA Baltimore, MD (Aug 11 th - 13 th ) DFRWS is dedicated
A Study of User Data Integrity During Acquisition of Android Devices
DIGITAL FORENSIC RESEARCH CONFERENCE By Namheun Son, Yunho Lee, Dohyun Kim, Joshua I. James, Sangjin Lee and Kyungho Lee Presented At The Digital Forensic Research Conference DFRWS 2013 USA Monterey, CA
Computer Forensics: Investigating Data and Image Files, 2nd Edition. Chapter 3 Forensic Investigations Using EnCase
Computer Forensics: Investigating Data and Image Files, 2nd Edition Chapter 3 Forensic Investigations Using EnCase Objectives After completing this chapter, you should be able to: Understand evidence files
On Criteria for Evaluating Similarity Digest Schemes
DIGITAL FORENSIC RESEARCH CONFERENCE On Criteria for Evaluating Similarity Digest Schemes By Jonathan Oliver Presented At The Digital Forensic Research Conference DFRWS 2015 EU Dublin, Ireland (Mar 23
Searching for Yahoo Chat fragments in Unallocated Space Detective Eric Oldenburg, Phoenix Police Department
Searching for Yahoo Chat fragments in Unallocated Space Detective Eric Oldenburg, Phoenix Police Department Purpose and Goal To demonstrate a methodology used for locating Yahoo Instant Messenger chat
Designing Robustness and Resilience in Digital Investigation Laboratories
DIGITAL FORENSIC RESEARCH CONFERENCE Designing Robustness and Resilience in Digital Investigation Laboratories By Philipp Amann and Joshua James Presented At The Digital Forensic Research Conference DFRWS
File Carving Using Sequential Hypothesis Testing
File Carving Using Sequential Hypothesis Testing Anandabrata (Pasha) Pal, Taha Sencar and Nasir Memon Introduction File Carving: recovery without file system meta-data. Recovery based on file structure/content
Information Assurance In A Distributed Forensic Cluster
DIGITAL FORENSIC RESEARCH CONFERENCE Information Assurance In A Distributed Forensic Cluster By Nicholas Pringle and Mikhaila Burgess Presented At The Digital Forensic Research Conference DFRWS 2014 EU
Introduction to carving File fragmentation Object validation Carving methods Conclusion
Simson L. Garfinkel Presented by Jevin Sweval Introduction to carving File fragmentation Object validation Carving methods Conclusion 1 Carving is the recovery of files from a raw dump of a storage device
Fast Indexing Strategies for Robust Image Hashes
DIGITAL FORENSIC RESEARCH CONFERENCE Fast Indexing Strategies for Robust Image Hashes By Christian Winter, Martin Steinebach and York Yannikos Presented At The Digital Forensic Research Conference DFRWS
Leveraging CybOX to Standardize Representation and Exchange of Digital Forensic Information
DIGITAL FORENSIC RESEARCH CONFERENCE Leveraging CybOX to Standardize Representation and Exchange of Digital Forensic Information By Eoghan Casey, Greg Back, and Sean Barnum Presented At The Digital Forensic
A Novel Approach of Mining Write-Prints for Authorship Attribution in Forensics
DIGITAL FORENSIC RESEARCH CONFERENCE A Novel Approach of Mining Write-Prints for Authorship Attribution in E-mail Forensics By Farkhund Iqbal, Rachid Hadjidj, Benjamin Fung, Mourad Debbabi Presented At
Beyond TS Workshop
ISOBMFF@DVB Beyond TS Workshop Cyril Concolato, Jean Le Feuvre (Telecom ParisTech) David Singer (Apple) IRT, Munich, May 19th, 2015 1 Overview ISOBMFF, standards and statuses ISOBMFF basic concepts Types
Dissecting Files. Endianness. So Many Bytes. Big Endian vs. Little Endian. Example Number. The "proper" order of things. Week 6
Dissecting Files Endianness Week 6 The "proper" order of things So Many Bytes So Many Bytes On a 32-bit system, each word consists of 4 bytes So, when any 32-bit value is stored in memory, each of those
RAPID RECOGNITION OF BLACKLISTED FILES AND FRAGMENTS MICHAEL MCCARRIN BRUCE ALLEN
RAPID RECOGNITION OF BLACKLISTED FILES AND FRAGMENTS MICHAEL MCCARRIN BRUCE ALLEN MANY THANKS TO: OSDFCon and Basis Bruce Allen Scott Young Joel Young Simson Garfinkel All of whom have helped with this
FRACTAL COMPRESSION USAGE FOR I FRAMES IN MPEG4 I MPEG4
FRACTAL COMPRESSION USAGE FOR I FRAMES IN MPEG4 I MPEG4 Angel Radanov Kanchev FKTT, Technical University of Sofia, Todor Alexandrov bvd 14, 1303 Sofia, Bulgaria, phone: +3592 9306413, e-mail: angel_kanchev@mail.bg
Audio Engineering Society. Conference Paper. Presented at the Conference on Audio Forensics 2017 June Arlington, VA, USA
Audio Engineering Society Conference Paper Presented at the Conference on Audio Forensics 2017 June 15 17 Arlington, VA, USA This paper was peer-reviewed as a complete manuscript for presentation at this
Tool reviewdwinhex. Eoghan Casey a,b, ) PRODUCT REVIEW. Introduction
Digital Investigation (2004) 1, 114e128 www.elsevier.com/locate/diin PRODUCT REVIEW Tool reviewdwinhex Eoghan Casey a,b, ) a Knowledge Solutions LLC, 61535 S Hwy 97 #9-148, Bend, OR 97702, United States
Can Digital Evidence Endure the Test of Time?
DIGITAL FORENSIC RESEARCH CONFERENCE By Michael Duren, Chet Hosmer Presented At The Digital Forensic Research Conference DFRWS 2002 USA Syracuse, NY (Aug 6 th - 9 th ) DFRWS is dedicated to the sharing
Analysis of the Db Windows Registry Data Structure
Analysis of the Db Windows Registry Data Structure Damir Kahvedžić Centre for Cyber Crime Investigation, University College Dublin, Ireland, Tel: +353 1 716 2485 Email: damir.kahvedzic@ucd.ie Tahar Kechadi
CAT Detect: A Tool for Detecting Inconsistency in Computer Activity Timelines
DIGITAL FORENSIC RESEARCH CONFERENCE CAT Detect: A Tool for Detecting Inconsistency in Computer Activity Timelines By Andrew Marrington, Ibrahim Baggili, George Mohay and Andrew Clark Presented At The
Speech Upload & Annotation Tool User Guide for Instructors
Speech Upload & Annotation Tool User Guide for Instructors For technical support call 1-800-936-6899 TABLE OF CONTENTS Quick Facts & Helpful Features 2 The Upload Tool... 3 Uploading a New Clip... 3 Locating
BinComp: A Stratified Approach to Compiler Provenance Attribution
DIGITAL FORENSIC RESEARCH CONFERENCE BinComp: A Stratified Approach to Compiler Provenance Attribution By Saed Alrabaee, Paria Shirani, Mourad Debbabi, Ashkan Rahimian and Lingyu Wang Presented At The
Privacy-Preserving Forensics
DIGITAL FORENSIC RESEARCH CONFERENCE Privacy-Preserving Email Forensics By Frederik Armknecht, Andreas Dewald and Michael Gruhn Presented At The Digital Forensic Research Conference DFRWS 2015 USA Philadelphia,
INSTITUTO SUPERIOR TÉCNICO
INSTITUTO SUPERIOR TÉCNICO DEPARTAMENTO DE ENGENHARIA INFORMÁTICA FORENSICS CYBER-SECURITY MEIC, METI Lab Guide II Evidence Examination 2015/2016 nuno.m.santos@tecnico.ulisboa.pt 1 Introduction This guide
DATA RECOVERY FROM PROPRIETARY- FORMATTED CCTV HARD DISKS
Chapter 15 DATA RECOVERY FROM PROPRIETARY- FORMATTED CCTV HARD DISKS Aswami Ariffin, Jill Slay and Kim-Kwang Choo Abstract Digital video recorders (DVRs) for closed-circuit television (CCTV) commonly have
10 Good Reasons Why You Should Shift Focus to Small Scale Digital Device Forensics
DIGITAL FORENSIC RESEARCH CONFERENCE 10 Good Reasons Why You Should Shift Focus to Small Scale Digital Device Forensics By Ronald van der Knijff Presented At The Digital Forensic Research Conference DFRWS
Guide to Computer Forensics and Investigations Fourth Edition. Chapter 6 Working with Windows and DOS Systems
Guide to Computer Forensics and Investigations Fourth Edition Chapter 6 Working with Windows and DOS Systems Understanding Disk Drives Disk drives are made up of one or more platters coated with magnetic
MP4-Karver: CARVING OF CORRUPTED MP4 VIDEOS USING ASMD REPAIRING TECHNIQUE
1 MP4-Karver: CARVING OF CORRUPTED MP4 VIDEOS USING ASMD REPAIRING TECHNIQUE AHMED NUR ELMI ABDI UNIVERSITI TUN HUSSEIN ONN MALAYSIA Corrupted MP4 Carving using MP4-karver AHMED NUR ELMI ABDI A thesis
Provided by the author(s) and University College Dublin Library in accordance with publisher policies. Please cite the published version when available. Title An Analytical Approach to the Recovery of
Automated Identification of Installed Malicious Android Applications
DIGITAL FORENSIC RESEARCH CONFERENCE Automated Identification of Installed Malicious Android Applications By Mark Guido, Justin Grover, Jared Ondricek, Dave Wilburn, Drew Hunt and Thanh Nguyen Presented
Mobile memory dumps, MSAB and MPE+ Data collection Information recovery Analysis and interpretation of results
Mobile memory dumps, MSAB and MPE+ Data collection Information recovery Analysis and interpretation of results Physical Extraction Physical extraction involves either Removing chips from circuit board
Domain-Specific Languages for Digital Forensics
Domain-Specific Languages for Digital Forensics Jeroen van den Bos Centrum Wiskunde & Informatica Nederlands Forensisch Instituut jeroen@infuse.org Abstract. Due to strict deadlines, custom requirements
Testing the Date Maintenance of the File Allocation Table File System
Abstract Testing the Date Maintenance of the File Allocation Table File Tom Waghorn Edith Cowan University e-mail: twaghorn@student.ecu.edu.au The directory entries used in the File Allocation Table filesystems
Predicting the Types of File Fragments
Predicting the Types of File Fragments William C. Calhoun and Drue Coles Department of Mathematics, Computer Science and Statistics Bloomsburg, University of Pennsylvania Bloomsburg, PA 17815 Thanks to
ANALYSIS AND VALIDATION
UNIT V ANALYSIS AND VALIDATION Validating Forensics Objectives Determine what data to analyze in a computer forensics investigation Explain tools used to validate data Explain common data-hiding techniques
Automating Video File Carving and Content Identification
Automating Video File Carving and Content Identification York Yannikos, Nadeem Ashraf, Martin Steinebach, Christian Winter To cite this version: York Yannikos, Nadeem Ashraf, Martin Steinebach, Christian
A Framework for Attack Patterns Discovery in Honeynet Data
DIGITAL FORENSIC RESEARCH CONFERENCE A Framework for Attack Patterns Discovery in Honeynet Data By Olivier Thonnard, Marc Dacier Presented At The Digital Forensic Research Conference DFRWS 2008 USA Baltimore,
Java Oriented Object Programming II Files II - Binary I/O Lesson 3
Java Oriented Object Programming II Files II - Binary I/O Lesson 3 The objectives in this lesson are: Convert Binary to Hexadecimals (vice versa) Understand Binary Code Use Hex Editors Explain how Streams
Oracle Forensics Part 2: Locating dropped objects
Oracle Forensics Part 2: Locating dropped objects David Litchfield [davidl@ngssoftware.com] 24 th March 2007 An NGSSoftware Insight Security Research (NISR) Publication 2007 Next Generation Security Software
Computer Forensics CCIC Training
Computer Forensics CCIC Training Chapter 7: Recycle Bin Lauren Pixley and Cassidy Elwell May 2017 (Version 1) This work by California Cyber Training Complex is licensed under a Creative Commons Attribution-NonCommercial
Media Formats. Sound. Image. Video. WAV (uncompressed, PCM) MIDI. BMP XML dia MPEG
Media Formats Sound WAV (uncompressed, PCM) MIDI Image BMP XML dia Video MPEG Sources WAV Sound Chapter 4, main text Kientzle, T. (1998). A Programmer s Guide to Sound. Addison-Wesley. WAV file format
Optimizing A/V Content For Mobile Delivery
Optimizing A/V Content For Mobile Delivery Media Encoding using Helix Mobile Producer 11.0 November 3, 2005 Optimizing A/V Content For Mobile Delivery 1 Contents 1. Introduction... 3 2. Source Media...
Media Analyzer User s Guide
Media Analyzer User s Guide MEDIA ANALYZER USER S GUIDE 2 LEGAL NOTICE The information in this manual is furnished for informational use only. No part of this manual may be reproduced or transmitted in
Digital Forensics File Carving Advances
Digital Forensics File Carving Advances Team: Jay Smith KoreLogic Klayton Monroe KoreLogic Andy Bair MITRE Version 1.1 (October 2006) KoreLogic DFRWS-2006 Project Agenda Introduction to Digital File Carving
Source: https://articles.forensicfocus.com/2018/03/02/evidence-acquisition-using-accessdata-ftk-imager/
by Chirath De Alwis Source: https://articles.forensicfocus.com/2018/03/02/evidence-acquisition-using-accessdata-ftk-imager/ Forensic Toolkit or FTK is a computer forensics software product made by AccessData.
CIS-331 Final Exam Fall 2015 Total of 120 Points. Version 1
Version 1 1. (25 Points) Given that a frame is formatted as follows: And given that a datagram is formatted as follows: And given that a TCP segment is formatted as follows: Assuming no options are present
Standard Exponential Creative Specifications
Standard Exponential Creative Specifications 2017 Contents 5 Creative Checklist 6 Pre-Roll In-Stream 7 Pre-Roll Mobile 8 Standard Iab Banner Tablet 9 Standard Iab Banner Smartphone 10 Non-Expanding Adhesion
Model-Driven Engineering in Digital Forensics. Jeroen van den Bos with Tijs van der Storm and Leon Aronson
Model-Driven Engineering in Digital Forensics Jeroen van den Bos (jeroen@infuse.org) with Tijs van der Storm and Leon Aronson Contents Digital forensics MDE in forensics Domain-specific optimizations Conclusion
Chapter Two File Systems. CIS 4000 Intro. to Forensic Computing David McDonald, Ph.D.
Chapter Two File Systems CIS 4000 Intro. to Forensic Computing David McDonald, Ph.D. 1 Learning Objectives At the end of this section, you will be able to: Explain the purpose and structure of file systems
Topic Data carving, as defined by Digital Forensic Research Workshop is the process of
Chad Cravens 8/25/2006 DF Research Project 1 Data Carving Topic Data carving, as defined by Digital Forensic Research Workshop is the process of extracting a collection of data from a larger data set.
Encoder Core. API Specification. Revision: SOC Technologies Inc.
Encoder Core API Specification Revision: 2.2 2018.01.29 2018 SOC Technologies Inc. SOC is disclosing this user manual (the Documentation ) to you solely for use in the development of designs to operate
After Conversation - A Forensic ICQ Logfile Extraction Tool
Edith Cowan University Research Online ECU Publications Pre. 2011 2005 After Conversation - A Forensic ICQ Logfile Extraction Tool Kim Morfitt Edith Cowan University Craig Valli Edith Cowan University
Funcom Multiplayer Online Games - FTP Site Statistics. Top 20 Directories Sorted by Disk Space
Property Value FTP Server ftp.funcom.com Description Funcom Multiplayer Online Games Country United States Scan Date 13/Jul/2014 Total Dirs 186 Total Files 1,556 Total Data 67.25 GB Top 20 Directories
A Strategy for Testing Hardware Write Block Devices
DIGITAL FORENSIC RESEARCH CONFERENCE A Strategy for Testing Hardware Write Block Devices By James Lyle Presented At The Digital Forensic Research Conference DFRWS 2006 USA Lafayette, IN (Aug 14 th - 16
OneClick Video Converter Free Version
Document No.: OneClickSoftware OneClick Video Converter Free Version OneClick Software Inc. http://www.oneclicksoftware.com Page 1 Pages Order Introduction...Pages 3 Button Preview...Pages 4 How to...pages
CHAPTER 5 A Closer Look at Instruction Set Architectures
CHAPTER 5 A Closer Look at Instruction Set Architectures 5.1 Introduction 5.2 Instruction Formats 5.2.1 Design Decisions for Instruction Sets 5.2.2 Little versus Big Endian 5.2.3 Internal Storage in the
Running Head: IPHONE FORENSICS 1. iphone Forensics Jaclyn Sottilaro Monica Figueroa-Santos Antonina Spinella Saint Leo University
Running Head: IPHONE FORENSICS 1 iphone Forensics Jaclyn Sottilaro Monica Figueroa-Santos Antonina Spinella Saint Leo University IPHONE FORENSICS 2 Abstract With an ever-growing evolution on technology,
Case Study. Log Analysis. Automated Windows event log forensics. Engagement Preliminary Results Final Report. Extract Repair. Correlate.
Automated Windows event log forensics Case Study Engagement Preliminary Results Final Report Log Analysis Extract Repair Interpret Rich Murphey ACS Extract Repair DFRWS Aug 13, 2007 1 Sponsor: Special
File Systems and Volumes
File Systems and Volumes Section II. Basic Forensic Techniques and Tools CSF: Forensics Cyber-Security MSIDC, Spring 2015 Nuno Santos Summary! Data organization in storage systems! File deletion and recovery!
DERRIC. Model-Driven Engineering in Digital Forensics. Jeroen van den Bos
DERRIC Model-Driven Engineering in Digital Forensics Jeroen van den Bos jeroen@infuse.org DERRIC Model-Driven Engineering in Digital Forensics Experience: Jeroen van den Bos jeroen@infuse.org 1998: software
CIS-331 Fall 2013 Exam 1 Name: Total of 120 Points Version 1
Version 1 1. (24 Points) Show the routing tables for routers A, B, C, and D. Make sure you account for traffic to the Internet. NOTE: Router E should only be used for Internet traffic. Router A Router
J. A. Drew Hamilton, Jr., Ph.D. Director, Center for Cyber Innovation Professor, Computer Science & Engineering
J. A. Drew Hamilton, Jr., Ph.D. Director, Center for Cyber Innovation Professor, Computer Science & Engineering CCI Post Office Box 9627 Mississippi State, MS 39762 Voice: (662) 325-2294 Fax: (662) 325-7692
Introduction Mapping the ELF Pinpointing Fragmentation Evaluation Conclusion. Bin-Carver. Automatic Recovery of Binary Executable Files
Bin-Carver Automatic Recovery of Binary Executable Files Scott Hand, Zhiqiang Lin, Guofei Gu*, Bhavani Thuraisingham Department of Computer Science, The University of Texas at Dallas *Deparment of Computer
Identification, Recovery and Verification of MP3 frames from Obfuscated Files. Paul Flack
Identification, Recovery and Verification of MP3 frames from Obfuscated Files Paul Flack - 40135925 Submitted in partial fulfilment of the requirements of Edinburgh Napier University for the Degree of
Video Assignment 7/9/2014
7/9/2014 Video Assignment Your instructor might create a video assignment, in which you will be asked to record and submit a video to. You will likely need a Webcam in order to create videos for such assignments.
GNSS High Rate Binary Format (v2.1) 1 Overview
GNSS High Rate Binary Format (v2.1) 1 Overview This document describes a binary GNSS data format intended for storing both low and high rate (>1Hz) tracking data. To accommodate all modern GNSS measurements
My Media Hub Quick Start Guide for USB Devices. Sharing media content with the Fetch Box from a USB device
My Media Hub Quick Start Guide for USB Devices Sharing media content with the Fetch Box from a USB device What s inside Welcome to your My Media Hub 3 Supported media file formats 4 Getting Started 5 Play
Source coding and compression
Computer Mathematics Week 5 Source coding and compression College of Information Science and Engineering Ritsumeikan University last week binary representations of signed numbers sign-magnitude, biased
CEIC 2007 May 8, 2007
Basic File Carving With FTimes CEIC 2007 May 8, 2007 KoreLogic, Inc: Andy Bair pab-ceic@korelogic.com Jay Smith jsmith-ceic@korelogic.com 1 Overall Agenda Basic Section Introduction - File Carving Overview
Computer Forensic Capabilities. Cybercrime Lab Computer Crime and Intellectual Property Section United States Department of Justice
Computer Forensic Capabilities Cybercrime Lab Computer Crime and Intellectual Property Section United States Department of Justice Agenda What is computer forensics? Where to find computer evidence Forensic
Module 10 MULTIMEDIA SYNCHRONIZATION
Module 10 MULTIMEDIA SYNCHRONIZATION Lesson 36 Packet architectures and audio-video interleaving Instructional objectives At the end of this lesson, the students should be able to: 1. Show the packet architecture
Quicktime Player Error Codec For Mac Avi
Quicktime Player Error Codec For Mac Avi Oct 2, 2014. I donwlaoded a movie and its.avi and i am getting an error post "converting" where it says. QuickTime player can't open. Help please After reviewing
ExtremeTech Technology News - FTP Site Statistics. Top 20 Directories Sorted by Disk Space
ExtremeTech Technology News - FTP Site Statistics Property Value FTP Server ftp.extremetech.com Description ExtremeTech Technology News Country United States Scan Date 14/Oct/2014 Total Dirs 281 Total
DbsEditor v1.8 (Database Editor) QUICK REFERENCE
DbsEditor v1.8 (Database Editor) QUICK REFERENCE By S. KIRANYAZ This application is a dialog-based program, which is designed to perform several off-line tasks of the MUVIS multimedia databases. DbsEditor
Archival Science, Digital Forensics and New Media Art
DIGITAL FORENSIC RESEARCH CONFERENCE Archival Science, Digital Forensics and New Media Art By Dianne Dietrich and Frank Adelstein Presented At The Digital Forensic Research Conference DFRWS 2015 USA Philadelphia,