Digital Forensics. Module 6 CS 996
|
|
|
- Suzan Bruce
- 6 years ago
- Views:
Transcription
1 Digital Forensics Module 6 CS 996
2 Module #5 Covered B of A case; corporate responsibility for security New security standards: NIST and ITIL Another new security standard: ISF Standard of Good Practice (January, 2005) Using EnCase Basic Linux forensics commands 3/16/2005 Module 6 2
3 Outline of Module #6 SamSpade Presentation Discussion re Infragard meeting Recent host forensic case in the news Host forensics, continued Linux Windows Don t forget vacation next week 3/16/2005 Module 6 3
4 Infragard: Takeaways Cross-validation between tools Documentation!! Tools network discovery image analysis Business issues Kruse: main business is intellectual property related 3/16/2005 Module 6 4
5 Intellectual Property Theft Fakes! BusinessWeek, 2/7/2005 Counterfeit products = $500+B/year!! Forensic opportunities Uncovering evidence of IP theft Reverse engineering computer products to determine if they are real or not Developing countermeasures 3/16/2005 Module 6 5
6 Today s Incredible replica watches in stock Get a first-class Rolex watch We only sell top-notch watches and handbags. There's no battery in these replicas just like the real ones since they charge themselves as you move. The second hand moves JUST like the real ones, too. These original watches sell in stores for thousands of dollars. We sell them for much less. Our Rolex are: - Replicated to the smallest detail - 98% Perfectly Accurate Markings - Signature Green Sticker w/ serial number on watch back - Magnified Quickset Date - Includes all Proper Markings Please copy and paste the following link into your browser to learn more. Link to web site - ->> elitereplicasonline.com 3/16/2005 Module 6 6
7 Ohio v. Morris (2/16/2005) Morris, Jr. finds child porn on his computer after seeing Morris, Sr. using computer Computer sent to lab; imaged and analyzed using EnCase. Viewed images; ran keyword searches ( preteen lolita, etc.) Hard drive overwritten at lab! Convicted of pandering child porn Morris appeals 3/16/2005 Module 6 7
8 Appeals Contentions Denied Due Process because original evidence was deleted Claims images were virtual Were images really minors or possibly his own children or wards? 3/16/2005 Module 6 8
9 Open Source Forensic Tools Sleuthkit (v2.0) Autopsy (Sleuthkit with browser interface) Knoppix (includes forensic tools) Helix-Knoppix + forensic utilities 3/16/2005 Module 6 9
10 Using Open Source Forensic Tools Great for learning and research Great for background investigations Will be subject to attack if used in court Autopsy/Sleuthkit: not used in US courts (Carrier) Exception: SMART ( a commercial product--$2000 Used in many investigations, including Enron 3/16/2005 Module 6 10
11 What Drives Are on Host? 3/16/2005 Module 6 11
12 Add Image to Autopsy 3/16/2005 Module 6 12
13 Autopsy Evidence Folder 3/16/2005 Module 6 13
14 Image Details 3/16/2005 Module 6 14
15 File Analysis 3/16/2005 Module 6 15
16 Inode Contents 3/16/2005 Module 6 16
17 Activity Timeline 3/16/2005 Module 6 17
18 Timeline Results 3/16/2005 Module 6 18
19 Linux MAC Times Modify time (mtime) Last time file was written to or appended to For directory: time when file was added, deleted or renamed Access time (atime) Last time file/directory was read Can turn off with noatime option Change time (ctime) Alter file attributes (inode) or content 3/16/2005 Module 6 19
20 Win32 MAC Times Modify time Time when file is last modified. Carried over when file is copied to new directory Access time Time when file was last accesses by application program Create time Time when file was created in the current directory. New value is set when file is copied 3/16/2005 Module 6 20
21 MAC Time Example IIS file: graphic.jpg Observations made on 3/15/2005 Created: 2/14/2005 Modified: 1/20/2005 Accessed: 3/15/2005 What happened? 3/16/2005 Module 6 21
22 Internet Temp File Time Stamps 3/16/2005 Module 6 22
23 Using Helix Knoppix plus many forensic tools! Autopsy Sleuthkit Etc. Current version 1.6 ( e-fense, inc) Applications Tool kit installed on your hard drive Preview machines in the field, before acquisition Other? 3/16/2005 Module 6 23
24 3/16/2005 Module 6 24
25 Using Helix/Knoppix for Incident Response Preliminary on site investigation Run quick evaluation without altering evidence drives Boot from CD drive Install your USB memory key Change permissions to read/write for USB Reference: 3/16/2005 Module 6 25
26 File Search (JPEG on NTFS) 3/16/2005 Module 6 26
27 Image Gallery (save to USB) 3/16/2005 Module 6 27
28 Investigating Windows Systems Basic Application log files Temp files Recently used documents Recycle bin History + temporary Internet files Registry Hidden Files ADS.chk files Swap space 3/16/2005 Module 6 28
29 Investigating Windows Registry Log files Windows IIS Application data search Graphics files in Windows 3/16/2005 Module 6 29
30 Windows Registry Great digital dumpster for investigations! Two primary hives HKEY_LOCAL MACHINE HKEY_USERS Registry files No extension Full copy of hive data.alt extension Backup copy.log extension Changes to data.sav extension 3/16/2005 Module 6 30
31 Location of Registry Files Win2000 and XP C:\winnt\system32\config Win98 C:\windows 3/16/2005 Module 6 31
32 Discovering Deleted User Accounts Deleted accounts may not be visible in Windows Computer Manager (Win2000) Check registry HKEY_LOCAL_MACHINE\SOFTWARE\MICRO SOFT\WINDOWS NT\CURRENT VERSION\PROFILE LIST\ Shows deleted account names! 3/16/2005 Module 6 32
33 3/16/2005 Module 6 33
34 Searching Windows Registry Regedit has limited search ability Regedt32 has no search ability Resplendence Registrar: good search ability Freeware version: Resplendence Lite Searching under username What has user done on machine? Looking for recent searches of current user using Windows Search function 3/16/2005 Module 6 34
35 Investigating the Registry Registrar Lite editor (free at Investigate old user names Most recently used files Recent searches for files 3/16/2005 Module 6 35
36 3/16/2005 Module 6 36
37 3/16/2005 Module 6 37
38 What Files Has User Searched For? HKEY_USERS\SID\Software\Microsoft\Inte rnet Explorer\Explorer Bars\ID\Files Named MRU\ List of recent Windows searches Why do we need this? Might not have access to disk image Court may give you a smaller sandbox! Minimize collateral damage in investigations! 3/16/2005 Module 6 38
39 3/16/2005 Module 6 39
40 Windows Log Files (Win2000) Configure for proactive forensics Review for potential evidence Location: c:\winnt\system32\config\ appevent.evt secevent.evt sysevent.evt Basic configuration: administrative tools computer management event viewer 3/16/2005 Module 6 40
41 3/16/2005 Module 6 41
42 Setting Audit Policy Administrative Tools Local Security Policy Local Policies Audit Policy Default: nothing logged! 3/16/2005 Module 6 42
43 3/16/2005 Module 6 43
44 Security Events of Interest Account logon Logs local access Account management Logs administrator activities Logon events Where account is used System events 3/16/2005 Module 6 44
45 Auditing IIS Log Files Default location: c:\winnt\system32\logfiles Configure through: Administrative Tools Internet Services Manager Three possible log file formats: W3C Extended: configurable Microsoft IIS: not configurable NCSA Common Format 3/16/2005 Module 6 45
46 IIS Log File Format 3/16/2005 Module 6 46
47 3/16/2005 Module 6 47
48 Investigative Searching Free evaluation Step #1: build document index of words Index specific folders Index entire harddrive! Step #2: run searches Desktop search Internet search 3/16/2005 Module 6 48
49 Search Options Boolean Stemming: grammatical forms Phonic: sounds like Fuzzy: misspellings Synonyms Files filters: date, size, name, etc. 3/16/2005 Module 6 49
50 Copernic Desktop Search 3/16/2005 Module 6 50
51 Managing Graphics Files in Windows Thumbsplus Finds and creates thumbnail view of all graphic files Creates database of images Finds images like selected image Free trial download 3/16/2005 Module 6 51
52 3/16/2005 Module 6 52
53 References for Module #6 Warren Kruse, Computer Forensics, Kyle Rankin, Knoppix Hacks, Knoppix tutorial: nglish/ 3/16/2005 Module 6 53
Digital Forensics. Module 7 CS 996
Digital Forensics Module 7 CS 996 Module #6 Covered Using Autopsy Using Helix 3/30/2005 Module 7 2 Outline of Module #7 Review mid-term Helix presentation Forensic business news Gates v. Bando case Linux
Guide to Computer Forensics and Investigations Fourth Edition. Chapter 2 Understanding Computer Investigations
Guide to Computer Forensics and Investigations Fourth Edition Chapter 2 Understanding Computer Investigations Objectives Explain how to prepare a computer investigation Apply a systematic approach to an
Digital Forensics. Module 10 CS 996
Digital Forensics Module 10 CS 996 Outline of Module #10 Review MidTerm exam Legal update Suni Munshani Howard Carmack EnCase workshop 4/19/2004 Module 10 2 QUESTION #5 Return-Path:
Forensic Analysis - 2nd Lab Session
File System Forensic and Analysis December 12, 2014 File System Analysis File System Analysis can be used for Analysis the activities of an attacker on the honeypot file system. Analysis of a malware leaving
Windows Registry. Windows Registry. A Wealth of Evidence. What is the Registry? Some Evidence that Can Be Recovered. Registry History: Windows 3.
Windows Registry Windows Registry Week 3 Part 1 A great source of evidence and headaches What is the Registry? A Wealth of Evidence Collection of files that, together, form all the settings needed by applications
Windows Core Forensics Forensic Toolkit / Password Recovery Toolkit /
The Windows Forensics Core Training follows up the AccessData BootCamp training. This advanced AccessData training class provides the knowledge and skills necessary to use AccessData products to conduct
Computer Forensics: Investigating File and Operating Systems, Wireless Networks, and Storage, 2nd Edition. Chapter 5 Windows Forensics II
Computer Forensics: Investigating File and Operating Systems, Wireless Networks, and Storage, 2nd Edition Chapter 5 Windows Forensics II Objectives After completing this chapter, you should be able to:
Operating System Specification Mac OS X Snow Leopard (10.6.0) or higher and Windows XP (SP3) or higher
BlackLight is a multi-platform forensic analysis tool that allows examiners to quickly and intuitively analyze digital forensic media. BlackLight is capable of analyzing data from Mac OS X computers, ios
Digital Forensics. Module 8 CS 996
Digital Forensics Module 8 CS 996 Outline of Module #8 Presentation on hping Discussion of important forensic cases Windows host forensics and Windows forensic tools Network forensic tools and methods
S23: You Have Been Hacked, But Where s the Evidence? A Quick Intro to Digital Forensics Bill Pankey, Tunitas Group
S23: You Have Been Hacked, But Where s the Evidence? A Quick Intro to Digital Forensics Bill Pankey, Tunitas Group You Have Been Hacked, But Where s the Evidence? A Quick Intro to Digital Forensics Bill
AccessData Advanced Forensics
This advanced five-day course provides the knowledge and skills necessary to install, configure and effectively use Forensic Toolkit (FTK ), FTK Imager Password Recovery Toolkit (PRTK ) and Registry Viewer.
Forensic Analysis. The Treachery of Images. Alexandre Dulaunoy. February 5, Forensic Analysis Bibliography Use case Q and A
Bibliography Use case Q and A The Treachery of Images February 5, 2016 Bibliography Use case Q and A Introduction Disclaimer Images ( The Treachery of Images ) (1928) Rene Magritte La Trahison des Bibliography
Digital Forensics ITP 375 (3 Units)
Digital Forensics ITP 375 (3 Units) Description In 2007, the FBI reported that over 200 major companies reported a loss of over 60 million dollars due to computer crime. Computers are becoming more of
24) Type a note then click the OK button to save the note. This is a good way to keep notes on items of interest.
23) Click File Analysis Tab - This allows forensic investigators to look for files on the system as they would on a regular system. Key file attributes are provided to assist the investigator (file size,
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner ACCREDITATIONS EXAM INFORMATION The Certified Digital Forensics Examiner exam is taken online through Mile2 s Assessment and Certification System ( MACS ), which is
Background Using Registry
How To Change Windows Xp Logon Screen Background Using Registry Top four free software to change the lock or logon screen background of In prior versions of Windows 7, in Windows XP and Vista, changing
Ed Ferrara, MSIA, CISSP
MIS 5208 - Lecture 12 Investigation Methods Data Acquisition Ed Ferrara, MSIA, CISSP eferrara@temple.edu Objectives List digital evidence storage formats Explain ways to determine the best acquisition
Setting Up a Linux Operating System
Name: Setting Up a Linux Operating System We will be using the Linux operating system for most of our practical work in this class. Knoppix is a live CD distribution of Linux, based on the Debian distribution.
Forensics on the Windows Platform, Part Two by Jamie Morris last updated February 11, 2003
SecurityFocus HOME Infocus: Forensics on the Windows Platform, Part Two 2003-02-17 12:56:05-0900 SFOnline Forensics on the Windows Platform, Part Two by Jamie Morris last updated February 11, 2003 Introduction
Computer Hacking Forensic Investigator. Module X Data Acquisition and Duplication
Computer Hacking Forensic Investigator Module X Data Acquisition and Duplication Scenario Allen a forensic investigator was hired by a bank to investigate employee fraud. The bank has four 30 GB machines
Forensic Timeline Splunking. Nick Klein
Forensic Timeline Splunking Nick Klein A long time ago... Brian Carrier brought us Sleuthkit, based on the earlier work of Dan Farmer and Wietse Venema date size type meta file 16 Nov 2011 15:39:44 17
COMPUTER HACKING FORENSIC INVESTIGATOR (CHFI) V9
COMPUTER HACKING FORENSIC INVESTIGATOR (CHFI) V9 Course Code: 3401 Prepare for the CHFI certification while learning advanced forensics investigation techniques. EC-Council released the most advanced computer
Digital forensics. Andrej Brodnik. Andrej Brodnik: Digital Forensics
Digital forensics Andrej Brodnik Computer pre-knowledge: architecture of computers basics (BIOS) operating system secondary memory (disc) and its organization file systems chapter 15 Startup startup steps
OHLONE COLLEGE Ohlone Community College District OFFICIAL COURSE OUTLINE
OHLONE COLLEGE Ohlone Community College District OFFICIAL COURSE OUTLINE I. Description of Course: 1. Department/Course: CNET - 174 2. Title: Computer Forensics 3. Cross Reference: 4. Units: 3 Lec Hrs:
How To Remove Windows 7 Genuine Advantage Notification From Registry
How To Remove Windows 7 Genuine Advantage Notification From Registry review(s) for the wga removal tool for windows 7. Review by:vik.leonova Update? Remover 1.5? Download Now Genuine Advantage Notification
How To Access Iphone Backup Without Itunes Windows 7 Using
How To Access Iphone Backup Without Itunes Windows 7 Using You can copy and save the data on your iphone, ipad, or ipod touch by backing up Read more about making backups of your device using itunes and
Chapter Two File Systems. CIS 4000 Intro. to Forensic Computing David McDonald, Ph.D.
Chapter Two File Systems CIS 4000 Intro. to Forensic Computing David McDonald, Ph.D. 1 Learning Objectives At the end of this section, you will be able to: Explain the purpose and structure of file systems
Digital Forensics. Module 6 CS 996
Digital Forensics Module 6 CS 996 Review from Module #5 Class action suits and forensics ADS and slack space Basic Windows investigations Hard drive properties Hard drive case study Disposal of hard drives
CYB 610 Project 6 Workspace Exercise
CYB 610 Project 6 Workspace Exercise I. Digital Forensics Lab (Introduction to FTK Imager) a. Lab Rules: Each student has to do the lab individually. No content directly quoted from Internet or other sources
ANALYSIS AND VALIDATION
UNIT V ANALYSIS AND VALIDATION Validating Forensics Objectives Determine what data to analyze in a computer forensics investigation Explain tools used to validate data Explain common data-hiding techniques
Windows Artifacts as a part of Digital Investigation
Windows Artifacts as a part of Digital Investigation Divyang Rahevar, Nisarg Trivedi Institute of Forensic Science Gujarat Forensic Sciences University Gandhinagar, Gujarat India divurahevar@gmail.com,
Digital Forensics. Module 9 CS 996
Digital Forensics Module 9 CS 996 Outline of Module #9 Presentation on Achilles Discussion of forensic topics in the news Windows host forensics and Windows forensic tools Network forensic tools and methods
CompTIA A+ Certification ( ) Study Guide Table of Contents
CompTIA A+ Certification (220-902) Study Guide Table of Contents Course Introduction About This Course About CompTIA Certifications Module 1 / Supporting Windows 1 Module 1 / Unit 1 Windows Operating System
Digital Forensics Practicum CAINE 8.0. Review and User s Guide
Digital Forensics Practicum CAINE 8.0 Review and User s Guide Ana L. Hernandez Master of Science in Cybersecurity Digital Forensics Concentration University of South Florida 12-8-2017 Table of Contents
A+ Guide to Software: Managing, Maintaining, and Troubleshooting, 5e. Chapter 7 Fixing Windows Problems
: Managing, Maintaining, and Troubleshooting, 5e Chapter 7 Fixing Windows Problems Objectives Learn what to do when a hardware device, application, or Windows component gives a problem Learn what to do
Disk Drill by LaWanda Warren
Disk Drill by LaWanda Warren GOAL OF PROJECT If you're a forensic investigator or even an everyday computer user and you want to recover some files or images from corrupt hard drive or even an external
Digital Forensics Lecture 01- Disk Forensics
Digital Forensics Lecture 01- Disk Forensics An Introduction to Akbar S. Namin Texas Tech University Spring 2017 Digital Investigations and Evidence Investigation of some type of digital device that has
Report For Algonquin Township Highway Department
Report For Algonquin Township Highway Department Prepared For: Prepared By: Robert Hanlon Attorney at Law robert@robhanlonlaw.com Andy Garrett Garrett Discovery Inc agarrett@garrettdiscovery.com Date:
Incident Response Data Acquisition Guidelines for Investigation Purposes 1
Incident Response Data Acquisition Guidelines for Investigation Purposes 1 1 Target Audience This document is aimed at general IT staff that may be in the position of being required to take action in response
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner Course Title: Certified Digital Forensics Examiner Duration: 5 days Class Format Options: Instructor-led classroom Live Online Training Prerequisites: A minimum of
File System NTFS. Section Seven. NTFS, EFS, Partitioning, and Navigating Folders
13 August 2002 File System Section Seven NTFS, EFS, Partitioning, and Navigating Folders NTFS DEFINITION New Technologies File System or NTFS was first applied in Windows NT 3.0 back in 1992. This technology
From the Lab to the Boardroom; Forensics goes mainstream
From the Lab to the Boardroom; Forensics goes mainstream Jim Butterworth, EWC USN (Ret.), EnCE & GCIA, Director of Incident Response, Guidance Software Definition: P A G E 1 Computer Forensics The Scientific
Instruction How To Use Laptop As Monitor For Desktop Windows 7
Instruction How To Use Laptop As Monitor For Desktop Windows 7 In this article, I'll show you the process in Windows XP and Windows 7, the to split programs on the second monitor using Windows XP or Windows
A+ Guide to Managing and Maintaining Your PC, 7e. Chapter 16 Fixing Windows Problems
A+ Guide to Managing and Maintaining Your PC, 7e Chapter 16 Fixing Windows Problems Objectives Learn what to do when a hardware device, application, or Windows component gives a problem Learn what to do
Digital Forensics Lecture 5. DF Analysis Techniques
Digital Forensics Lecture 5 DF Analysis Techniques Current, Relevant Topics Wells Fargo is notifying an unspecified number of employees that their personal data, including names, Social Security numbers
What will I learn today?
What will I learn today? CNG Safe Hierarchy Dashboard Customize Your View Toolbars and Buttons CNG Speed Bar What can We Do with a CNG Document So Many Ways to Search in CNG Sorting How to File in CNG
10/13/11. Objectives. Live Acquisition. When do we consider doing it? What is Live Acquisition? The Order of Volatility. When do we consider doing it?
Live Acquisition Objectives Understand what Live Acquisition is and when it is appropriate Understand the concept of Order of Volatility Understand live acquisition issues and limitations Be able to perform
Certification review procedure for standalone systems or peer-to-peer networks with Windows NT, 2000, and XP
Date: System ID: Certification review procedure for standalone systems or peer-to-peer networks with Windows NT, 2000, and XP Instructions: Complete each of the following steps. "No" responses indicate
Cyber Chain of Custody. Acquisition. Cyber Chain of Custody. Evidence Dynamics and the Introduction of Error. Must Be Proven!
Acquisition Cyber Chain of Custody Week 2 Protect the data from the Investigator Cyber Chain of Custody Cyber Chain of Custody Just like regular evidence, e- evidence must adhere to a Chain of Custody
User s Manual. Hi-Speed USB 2.0 Flash Disk
User s Manual Hi-Speed USB 2.0 Flash Disk Contents Introduction...3 Features System.........3 Requirements.......3 Before use.....4 Driver Installation...4 Driver Installation for Windows 98/98SE.........4
WEEK 2.0. Any sufficiently advanced technology is indistinguishable from magic.
WEEK 2.0 Any sufficiently advanced technology is indistinguishable from magic. Recycler A recycle bin for each user Created upon file deletion Only for RB aware programs ie Office, not command line tools
Windows Xp Cannot Change Desktop Wallpaper Registry
Windows Xp Cannot Change Desktop Wallpaper Registry Looking for a way to delete desktop wallpapers from your Windows PC? Windows 10 has another set of newly created wallpapers that will be shipping In
How to install the software of ZNS8022
How to install the software of ZNS8022 1. Please connect ZNS8022 to your PC after finished assembly. 2. Insert Installation CD to your CD-ROM drive and initiate the auto-run program. The wizard will run
Computer Forensics: Investigating Data and Image Files, 2nd Edition. Chapter 3 Forensic Investigations Using EnCase
Computer Forensics: Investigating Data and Image Files, 2nd Edition Chapter 3 Forensic Investigations Using EnCase Objectives After completing this chapter, you should be able to: Understand evidence files
A Study on Linux. Forensics By: Gustavo Amarchand, Keanu. Munn, and Samantha Renicker 11/1/2018
A Study on Linux 11/1/2018 Forensics By: Gustavo Amarchand, Keanu Munn, and Samantha Renicker Abstract In the field of computer forensics investigators must be familiar with many different systems and
Computer Forensics: Investigating File and Operating Systems, Wireless Networks, and Storage, 2nd Edition. Chapter 6 Linux Forensics
Computer Forensics: Investigating File and Operating Systems, Wireless Networks, and Storage, 2nd Edition Chapter 6 Linux Forensics Objectives After completing this chapter, you should be able to: Create
Guide to Computer Forensics and Investigations Fourth Edition. Chapter 6 Working with Windows and DOS Systems
Guide to Computer Forensics and Investigations Fourth Edition Chapter 6 Working with Windows and DOS Systems Understanding Disk Drives Disk drives are made up of one or more platters coated with magnetic
Acknowledgments About the Authors
Preface p. xv Acknowledgments p. xix About the Authors p. xxi Case Studies p. xxv Live Incident Response p. 1 Windows Live Response p. 3 Analyzing Volatile Data p. 5 The System Date and Time p. 6 Current
Password Changer User Guide
Active@ Password Changer User Guide Copyright 1999-2017, LSOFT TECHNOLOGIES INC. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative
In this talk you will learn how information security awareness training can be delivered to IT staff, like developers, management and helpdesk
In this talk you will learn how information security awareness training can be delivered to IT staff, like developers, management and helpdesk personnel, using actual incidents to create a lasting impression.
dtsearch Desktop dtsearch Network
dtsearch Desktop dtsearch Network Version 7 Copyright 1991-2017 dtsearch Corp. www.dtsearch.com SALES 1-800-483-4637 (301) 263-0731 Fax (301) 263-0781 sales@dtsearch.com TECHNICAL (301) 263-0731 tech@dtsearch.com
VI-CENTER EXTENDED ENTERPRISE EDITION GETTING STARTED GUIDE. Version: 4.5
VI-CENTER EXTENDED ENTERPRISE EDITION GETTING STARTED GUIDE This manual provides a quick introduction to Virtual Iron software, and explains how to use Virtual Iron VI-Center to configure and manage virtual
Product Questions: 486 Version: 12.0
Vendor: Eccouncil Exam Code: 312-49 Exam Name: Computer Hacking Forensic Investigator Exam v9 Version: DEMO Question: 1 Product Questions: 486 Version: 12.0 This organization maintains a database of hash
CSE 4482 Computer Security Management: Assessment and Forensics. Computer Forensics: Working with Windows and DOS Systems
CSE 4482 Computer Security Management: Assessment and Forensics Computer Forensics: Working with Windows and DOS Systems Instructor: N. Vlajic,, Fall 2010 Required reading: Guide to Computer Forensics
CMS 504: D2 for Space Contributors and Coordinators Updated: January 29, 2018
CMS 504: D2 for Space Contributors and s Agenda Part One What is Documentum D2? Groups: Support,, Contributor, Consumer D2 Overview: Login/Logout Main Menu User settings Workspaces Widgets Spaces Folders
Machine Language and System Programming
زبان ماشين وبرنامه نويسی سيستم Machine Language and System Programming جلسه دوازدھم دانشگاه صنعتی ھمدان پاييز 1389 Objectives Explain the purpose and structure of file systems Describe Microsoft file structures
COPYRIGHTED MATERIAL. Contents. Assessment Test
Contents Introduction Assessment Test xxvii xxxvii Chapter 1 Installing Windows 7 1 Introducing Windows 7 2 Windows 7 Architecture 5 Preparing to Install Windows 7 6 Windows 7 Starter 7 Windows 7 Home
Understanding Computer Forensics
Understanding Computer Forensics also known as: How to do a computer forensic investigation... and not get burned Nick Klein SANS Canberra Community Night 11 February 2013 The scenario... Your boss tells
Frequently Asked Questions
Frequently Asked Questions CB-ISA225-U3 - IDE/SATA TO USB 3.0 Adapter 1. Will the CB-ISA225-U3 works with my Windows 8, 8.1, 10 or Mac OS X (10.6 or newer)? Yes, it will work correctly. 2. Does this device
The Sleuth Kit v2.01 and Autopsy Forensic Browser Demonstration. Anthony Dowling
The Sleuth Kit v2.01 and Autopsy Forensic Browser Demonstration Anthony Dowling Date: June 02, 2006 ii Abstract The Sleuth Kit is a collection of Linux tools that perform different aspects of a file system
Computer Forensic Capabilities. Cybercrime Lab Computer Crime and Intellectual Property Section United States Department of Justice
Computer Forensic Capabilities Cybercrime Lab Computer Crime and Intellectual Property Section United States Department of Justice Agenda What is computer forensics? Where to find computer evidence Forensic
Running Java Programs
Running Java Programs Written by: Keith Fenske, http://www.psc-consulting.ca/fenske/ First version: Thursday, 10 January 2008 Document revised: Saturday, 13 February 2010 Copyright 2008, 2010 by Keith
Course 832 EC-Council Computer Hacking Forensic Investigator (CHFI)
Course 832 EC-Council Computer Hacking Forensic Investigator (CHFI) Duration: 5 days You Will Learn How To Understand how perimeter defenses work Scan and attack you own networks, without actually harming
Certified Cyber Security Analyst VS-1160
VS-1160 Certified Cyber Security Analyst Certification Code VS-1160 Vskills certification for Cyber Security Analyst assesses the candidate as per the company s need for cyber security and forensics. The
Computer forensics technologies for personally identifiable information detection and audits
Rochester Institute of Technology RIT Scholar Works Articles 2010 Computer forensics technologies for personally identifiable information detection and audits Yin Pan Bill Stackpole Luther Troell Follow
INSTITUTO SUPERIOR TÉCNICO
INSTITUTO SUPERIOR TÉCNICO DEPARTAMENTO DE ENGENHARIA INFORMÁTICA FORENSICS CYBER-SECURITY MEIC, METI Lab Guide III & IV Case Solving: Mr. Informant Case 2015/2016 nuno.m.santos@tecnico.ulisboa.pt 1 Introduction
Full System Restore Manually Windows 7 No Disk
Full System Restore Manually Windows 7 No Disk Found Time to Complete: 20-30 Minutes. Video (English Only) - How to use System Restore within Windows 7 with a small amount of hard disk space reserved for
Working with Apple Loops
7 Working with Apple Loops So you want to create a complete song, but you don t know how to play every instrument? An Apple Loop is a short piece of music that you can add to your song. It can be either
Project Organization and Data Security
Project Organization and Data Security Contents PROJECT ORGANIZATION AND DATA SECURITY... 1 RENAMING, DELETING, AND DUPLICATING PROJECTS... 1 MANUAL AND AUTOMATIC BACKUPS FOR PROJECTS... 2 Project Organization
COPYRIGHTED MATERIAL. Using Adobe Bridge. Lesson 1
Lesson Using Adobe Bridge What you ll learn in this lesson: Navigating Adobe Bridge Using folders in Bridge Making a Favorite Creating metadata Using automated tools Adobe Bridge is the command center
ECCouncil Computer Hacking Forensic Investigator (V8)
ECCouncil 312-49v8 ECCouncil Computer Hacking Forensic Investigator (V8) Version: 9.0 QUESTION NO: 1 ECCouncil 312-49v8 Exam What is the First Step required in preparing a computer for forensics investigation?
MFP: The Mobile Forensic Platform
MFP: The Mobile Forensic Platform Abstract Digital forensics experts perform investigations of machines for triage to see if there is a problem, as well as to gather evidence and run analyses. When the
In-Depth Guide to PaperVision Enterprise
800.422.1330 In-Depth Guide to is a simple and searchable enterprise content management (ECM) system. Securley store, share and collaborate on any type of information with unlimited users inside. 800.422.1330
Creating Web Pages Using Netscape Composer AGENDA FOR THIS WORKSHOP. 1. How does it all work? 2. What do I need to get started at Fairfield?
Creating Web Pages Using Netscape Composer AGENDA FOR THIS WORKSHOP 1. How does it all work? 2. What do I need to get started at Fairfield? 3. What is HTML coding? 4. The 10 HTML Tags that you should know.
Forensic Analysis of Windows 10 Volume Shadow Copy Service
Forensic Analysis of Windows 10 Volume Shadow Copy Service Ahmad Ghafarian, Ph.D. Dept. of Computer Science & Information Systems Mike Cottrell College of Business University of North Georgia Dahlonega,
STEP 1: PREPARE FOR DATA MIGRATION 1. Right-click the desktop and choose New > Folder. a. Type For Transferring and press Enter to name the folder.
PC Support and Repair Chapter 5 Data Migration Lab 5144 When a new computer is purchased or a new operating system is installed, it is often desirable to migrate a user s data to the new computer or OS.
Contact Details and Technical Information
Contact Details and Technical Information GetData Forensic Pty Ltd GetData Forensics USA Suite 204 1007 North Sepulveda Blvd # 1543 13a Montgomery St Manhattan Beach, CA 90267 Kogarah NSW 2217 USA Australia
Safe Mode: Solve Startup Problems & Crashes S 3/1. Solve (Almost) Any Problem Your Computer May Have
Safe Mode: Solve Startup Problems & Crashes S 3/1 Solve (Almost) Any Problem Your Computer May Have If your PC refuses to start or keeps crashing for some unknown reason, Safe Mode is often your last resort.
Manually Unlock User Account Windows 7 Standard
Manually Unlock User Account Windows 7 Standard This is an available way to unlock Windows 7 ultimate password by using USB and user. Here's how to create a User Account in Windows 8 and Windows 7: how
File System Concepts File Allocation Table (FAT) New Technology File System (NTFS) Extended File System (EXT) Master File Table (MFT)
File System Concepts File Allocation Table (FAT) New Technology File System (NTFS) Extended File System (EXT) Master File Table (MFT) 1 FILE SYSTEM CONCEPTS: FILE ALLOCATION TABLE (FAT) Alex Applegate
How To Remove Personal Antivirus Security Pro Virus Windows 8
How To Remove Personal Antivirus Security Pro Virus Windows 8 When hackers break into government servers to steal your personal data, there's As for just relying on the antivirus built into Windows 8.x,
OSForensics v5 Review by Jarno Baselier
OSForensics v5 Review by Jarno Baselier I have been curious for quite some time about the forensic software OSForensics from Passmark Software. As befits every good forensic package, many tasks can be
Lab 03. Windows Operating Systems (Cont.)
Lab 03 s (Cont.) Objectives Develop a good understanding of 1. The role of an operating system in a computer system 2. Services provided by an operating system and have some hands on experience in 1. Understanding
Virtual Desktop Infrastructure Setup for Windows 10
Virtual Desktop Infrastructure Setup for Windows 10 Virtual Desktop Infrastructure (VDI) allows you to connect to a virtual computer and use software that you don t have installed on your own computer
How Can I Manually Speed Up My Pc Performance Windows 7
How Can I Manually Speed Up My Pc Performance Windows 7 This can temporarily speed up a slow computer by "refreshing" the memory. This is only helpful if you have a desktop PC--using the High Performance
Getting Started Guide
Getting Started Guide for education accounts Setup Manual Edition 7 Last updated: September 15th, 2016 Note: Click on File and select Make a copy to save this to your Google Drive, or select Print, to
8 MANAGING SHARED FOLDERS & DATA
MANAGING SHARED FOLDERS & DATA STORAGE.1 Introduction to Windows XP File Structure.1.1 File.1.2 Folder.1.3 Drives.2 Windows XP files and folders Sharing.2.1 Simple File Sharing.2.2 Levels of access to
C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR
Page: 1 TM C HFI Computer C HFI Computer Hacking Forensic INVESTIGATOR Hacking Forensic INVESTIGATOR TM v8 v8 Page: 2 Be the leader. Deserve a place in the CHFI certified elite class. Earn cutting edge
Turn On Remote Desktop Via Registry Windows 7
Turn On Remote Desktop Via Registry Windows 7 A Remote Desktop connection is a great way to service a remote computer from the Anything older than Windows 7 will require the first option. but RDP is not
IMPORT AND EXPORT YOUR JOBS DATA BACKUP DATABASES SHARING FILES WITH OTHER USERS DATABASE MAINTENANCE
BACKING UP YOUR DATA IMPORT AND EXPORT YOUR JOBS DATA BACKUP DATABASES SHARING FILES WITH OTHER USERS DATABASE MAINTENANCE Please note on the personal edition your data is held in two folder called Jobs