Computer Forensics By: Chris Rozic.

Slides:

Advertisements

Similar presentations

Computer Forensic Analysis By Aaron Cheeseman Excerpt from Investigating Computer-Related Crime By Peter Stephenson (2000) CRC Press LLC - Computer Crimes.

Advertisements

Chapter Extension 24 Computer Crime and Forensics © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke.

An Introduction to Computer Forensics James L. Antonakos Professor Computer Science Department.

August 19, 2014 watch me!.  Describe the steps to take when processing a crime scene  Describe how to package evidence  Explain the importance of preserving.

We’ve got what it takes to take what you got! NETWORK FORENSICS.

McGraw-Hill/Irwin Copyright © 2013 by The McGraw-Hill Companies, Inc. All rights reserved. Extended Learning Module H Computer Crime and Digital Forensics.

Guide to Computer Forensics and Investigations, Second Edition

Computer Forensics and Digital Investigation – a brief introduction Ulf Larson/Erland Jonsson.

Teaching Computer Forensics Using Student Developed Evidence Files Anna Carlin Cal Poly Pomona.

Mod H-1 Examples of Computer Crimes. Mod H-2 Stuxnet.

Digital Forensics Module 11 CS /26/2004Module 112 Outline of Module #11 Overview of Windows file systems Overview of ProDiscover Overview of UNIX.

Evidence Computer Forensics. Law Enforcement vs. Citizens  Search must have probable cause –4 th amendment search warrant  Private citizen not subject.

COS/PSA 413 Day 5. Agenda Questions? Assignment 2 Redo –Due September 3:35 PM Assignment 3 posted –Due September 3:35 PM Quiz 1 on September.

COS/PSA 413 Day 15. Agenda Assignment 3 corrected –5 A’s, 4 B’s and 1 C Lab 5 corrected –4 A’s and 1 B Lab 6 corrected –A, 2 B’s, 1 C and 1 D Lab 7 write-up.

Hard Drive / Hard Disk Functions of hard disk

Introduction to Computer Forensics Fall Computer Crime Computer crime is any criminal offense, activity or issue that involves computers (

By Drudeisha Madhub Data Protection Commissioner Date:

Data Acquisition Chao-Hsien Chu, Ph.D.

Security+ All-In-One Edition Chapter 20 – Forensics Brian E. Brzezicki.

Role of Technology in Combating Crime Against Woman and Children Presented by Detective Constable Janelle Blackadar Child Exploitation Section Toronto.

Guide to Computer Forensics and Investigations, Second Edition

Guide to Computer Forensics and Investigations, Second Edition Chapter 2 Understanding Computer Investigation.

7 Handling a Digital Crime Scene Dr. John P. Abraham Professor UTPA.

Dr Richard Overill Department of Informatics King’s College London Cyber Sleuthing or the Art of the Digital Detective.

Digital Crime Scene Investigative Process

1 Book Cover Here PART D THE INFLUENCE AND IMPACT OF TECHNOLOGY Criminal Investigation: A Method for Reconstructing the Past, 7 th Edition Copyright ©

Computer Forensics Principles and Practices

An Introduction to Computer Forensics Jim Lindsey Western Kentucky University.

Bits, Bytes, Files, Hard Drives. Bits, Bytes, Letters and Words ● Bit – single piece of information ● Either a 0 or a 1 ● Byte – 8 bits of information.

© 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. System Forensics, Investigation, and Response.

1 IT Investigative Tools Tools and Services for the Forensic Auditor.

Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #8 Guest Lecture September 21, 2009.

Guide to Computer Forensics and Investigations Fourth Edition

Forensic Procedures 1. Assess the situation and understand what type of incident or crime is to be investigated. 2. Obtain senior management approval to.

Remote Forensic Tools --- PDIR and EEE Tool review - remote forensic preservation and examination tools Editor : Eoghan Casey, Aaron Stanley Source : Digital.

Chapter 2 Understanding Computer Investigations Guide to Computer Forensics and Investigations Fourth Edition.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond,

Chapter 5 Processing Crime and Incident Scenes Guide to Computer Forensics and Investigations Fourth Edition.

Cybercrime What is it, what does it cost, & how is it regulated?

CJ 317 – Computer Forensics

 Forensics  Application of scientific knowledge to a problem  Computer Forensics  Application of the scientific method in reconstructing a sequence.

Forensics Jeff Wang Code Mentor: John Zhu (IT Support)

Chao-Hsien Chu, Ph.D. College of Information Sciences and Technology The Pennsylvania State University University Park, PA Search.

Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #8 File Systems September 22, 2008.

1 Introduction to Forensic Science and the Law Fourth amendment protects citizens against “unreasonable search and seizures” Police and crime scene investigators.

Digital Forensics. Hardware components Motherboard Motherboard System bus System bus CPU CPU ROM ROM RAM RAM HDD HDD Input devices Input devices Output.

Chapter 8 File Systems FAT 12/16/32. Defragmentation Defrag a hard drive – Control Panel  System and Security  Administration tools  Defrag hard drive.

Computer Forensics Kelsey Bretz. Overview Introduction What happens when a file is deleted Typical Computer Forensic Investigations Who uses Computer.

ONLINE COURSES - SIFS FORENSIC SCIENCE PROGRAMME - 2 Our online course instructors are working professionals handling real-life cases related to various.

By: Jeremy Henry. Road Map  What is a cybercrime?  Statistics.  Tools used by an investigator.  Techniques and procedures used.  Specific case.

CIT 180 Security Fundamentals Computer Forensics.

Digital Forensics Market Analysis: By Forensic Tools; By Application (Network Forensics, Mobile Forensics, Database Forensics, Computer Forensics) - Forecast.

Computer Forensics By Chris Brown. Computer Forensics Defined Applying computer science to aid in the legal process Utilization of predefined set of procedures.

* Fingerprint Development* OUR ORGANIZATION PROVIDES THE SERVICES OF FINGERPRINT (INVISIBLE OR PARTIAL) DEVELOPMENT THROUGH VARIOUS TECHNIQUES I.E. POWDER.

Computer Forensics. OVERVIEW OF SEMINAR Introduction Introduction Defining Cyber Crime Defining Cyber Crime Cyber Crime Cyber Crime Cyber Crime As Global.

Electronic Crime: Incident Reporting and Forensics Between Law Enforcement and Private Industry D/Sgt. Michael Harrington CEECS, CFCE, EnCE Michigan State.

Digital Forensics and Hand Held Devices Robert Trimble COSC

18-1 PRENTICE HALL ©2008 Pearson Education, Inc. Upper Saddle River, NJ FORENSIC SCIENCE An Introduction By Richard Saferstein.

Introduction to Computer Forensics Fall Computer Crime Computer crime is any criminal offense, activity or issue that involves computers (

Chapter 17 Computer Crime Hess Introduction Computer crimes are relatively easy to commit and difficult to detect Most computer crimes are not prosecuted.

Presented by Steve Abrams, M.S. Charleston, SC / Long Island, NY

Computer Forensics 1 1.

Guide to Computer Forensics and Investigations Fifth Edition

Chapter 17 Risks, Security and Disaster Recovery

Introduction to Computer Forensics

Crime Scene Basics STEM Forensics.

Introduction to Computer Forensics

Digital Forensics Chris Rozic.

Fourth Amendment: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall.

Introduction to Digital Forensics

Presentation transcript:

Computer Forensics By: Chris Rozic

What is Computer Forensics? The use of Computer Science and engineering principles and practices to investigate unauthorized computer use or the use of a computer to support illegal activities.

What warrants the investigation? The cost/benefit analysis Internet/email Usage Theft of information Child pornography Web page defacement Murder Network used as a jump-off point to attack other networks Cost of the investigation outweighs the benefits, then no investigation needed Internet usage is higher than the a tolerable level. Offencive material sent through email An individual in a company illegaly taking confidentail information and/or individuals obtaining personal information through spoofed web pages, which can result in identity theft Child pornography thrives over the internet, due to this a thorough investigation is needed in order for law enforcement to properly prosecute.

Steps to follow as a Computer Crime investigator Secure the Scene Collect evidence Interview Witnesses Plant sniffers Obtain analysis of collected evidence Turn findings into the proper authority If the attacker is still online, initiate backtrace, as an attempt to obtain the geographical locations. Unplug the system. Document and label every piece taken from the scene as well as photograph if permitted. Establish a chain of command for the transportation of the evidence. This should be well documented. The person or persons that were on the machine at the time of the incident If no intrusion detection system is in place Through special software, the hard drive can be thoroughly searched and analyzed. Encase

Encase Software produced by Guidance Software A forensic data acquisition and analysis program based on the specifications and requirements of law enforcement Allows for a digital snapshot of the storage medium under investigation

MD5 Hash File Integrity: Completely Verified, 0 Errors. Acquisition Hash: 340C8B5EF96DCCEE4B552CE084CCF941 Verification Hash: 340C8B5EF96DCCEE4B552CE084CCF941

Encase Report Example Drive Geometry: Total Size 1.4MB (2,880 sectors) Volume “3” Parameters File System: FAT12 Drive Type: Removable Sectors Per Cluster: 1 Bytes Per Sector: 512 Total Sectors: 2,880 Total Capacity: 1,457,664 bytes (1.4MB) Total Clusters: 2,847 Unallocated: 219,136 bytes (214.0KB) Free Clusters: 428 Allocated: 1,238,528 bytes (1.2MB) Volume Name: NO NAME Volume Offset: 0 OEM Version: *zQ9FIHC Volume Serial #: 1068-7526 Heads: 2 Sectors Per Track: 18 Unused Sectors: 0 Number of FATs: 2 Sectors Per FAT: 9 Boot Sectors: 1 +-0 3 +-0 Hawaii - The Islands of Aloha_files

Example of Search Session 5 Start: 03/28/03 11:43:46AM Stop: 03/28/03 11:45:14AM Time: 0:01:28 Size: 4.0GB processed 4697 Files scanned 127 Signature mismatches detected 0 Hash values computed Hits New Keyword 12 12 campbell\@[a-z0-9]+\[[0-9]\]\.txt (GREP)

Conclusion Computer dependency will continue to grow resulting in more opportunities for crimes to be committed through the use of computers. Software is not for sale to the general public. The retail value of Encase is 3,500 dollars, and specialized versions can cost upwards of 5,000 dollars per liscence.