Thursday April 19, 2018 (Discussion – Storing and Retrieving Data, Processing the Electronic Crime Scene)

What is a hard disk drive (HDD)? The Daily CSI Thursday, 4/19/18 1/1 What is a hard disk drive (HDD)? A hard disk drive is typically the primary location of data storage within the computer. B A C

Remediation for Quiz 15 ends tomorrow at 5:00! Announcements Remediation for Quiz 15 ends tomorrow at 5:00!

3/29 N/A 4/6 4/9 4/12 QUIZ 15 4/13 4/16 4/18 Assignment F5 Tomorrow F6 Summative or Formative # Date Issued Gone Missing Day Last Day Accepted XC Current Events Crossword F5 3/29 N/A Tomorrow eResearch Paper – The Forensics of Document Examination F6 4/6 LAB – Paper Chromatography of Inks F7 4/9 eResearch Paper - Alterations, Erasures, Obliterations F8 4/12 QUIZ 15 S4 4/13 Forensics Files – Internal Affair F1 4/16 WS – Dennis Rader, Input to Output: How Does the Computer Work? F2 4/18 Hold for eResearch Paper

Computer Forensics (Part 2) Storing and Retrieving Data Computer Forensics (Part 2)

Storing and Retrieving Data Vocabulary Storing and Retrieving Data operating system (OS) formatting file allocation table track sector cluster

Storing and Retrieving Data The computer’s operating system (OS) is the bridge between the human user and the computer’s electronic components. It provides the user with a working environment and facilitates interaction with the system’s components.

Storing and Retrieving Data Formatting is the process of preparing a hard disk drive to store and retrieve data in its current form.

Storing and Retrieving Data A disk drive track is a circular path on the surface of a disk or diskette on which information is magnetically recorded and from which recorded information is read. A sector is the smallest unit of data that a hard drive can address. A cluster usually is the minimum space allocated to a file. Clusters are groups of sectors.

Storing and Retrieving Data A FAT is a file allocation table. It tracks the locations of files and folders on the hard disk drive.

Summary Questions What is a computer’s “operating system (OS)?” A computer’s OS provides the user with a working environment and facilitates interaction with the system’s components. What is “formatting?” Formatting is the process of preparing a hard disk drive to store and retrieve data in its current form.

Summary Questions In regards to computer hard disk drive structure, describe the relationship between tracks, sectors and clusters. A disk drive track is a circular path on the surface of a disk or diskette on which information is magnetically recorded and from which recorded information is read. A sector is the smallest unit of data that a hard drive can address. A cluster usually is the minimum space allocated to a file. Clusters are groups of sectors.

Summary Questions What is a “FAT”, and what is its purpose? A File Allocation Table tracks the locations of files and folders on the hard disk drive.

Processing the Electronic Crime Scene Aspects of a computer that should be photographed close up at an electronic crime scene include: the screen of any running computer monitor. all the connections to the main system unit, such as peripheral devices (keyboard, monitor, speakers, mouse, etc.) equipment serial numbers

Processing the Electronic Crime Scene Two situations in which an investigator would not unplug a computer at an electronic crime scene are: if encryption is being used and pulling the plug would encrypt the data, rendering it unreadable without a password or key. Encryption is the process of encoding messages or information in such a way that only authorized parties can read it. if data exists in RAM that has not been saved to HDD and will be lost if power to the system is discontinued.

Processing the Electronic Crime Scene The primary goal of obtaining data from a HDD is to do so without altering even one bit of data. To this end, a Message Digest 5 (MD5)/Secure Hash Algorithm (SHA) takes a “fingerprint” of a hard disk drive before and after forensic imaging.

Questions the screen of any running computer monitor What aspects of a computer should be photographed close up at an electronic crime scene? the screen of any running computer monitor all the connections to the main system unit, such as keyboards, monitors, speakers, mice, etc. equipment serial numbers

Questions Name two situations in which an investigator would not immediately unplug a computer at an electronic crime scene. if encryption is being used and “pulling the plug” will encrypt the data, rendering it unreadable without a password or key if data exists in RAM that has not been saved to the HDD, and will thus be lost if the power is turned off

Questions What is the primary goal of obtaining data from a HDD? to do so without altering even one bit of data

Questions What is the purpose of a Message Digest 5/Secure Hash Algorithm (MD5/SHA)? Why would a forensic computer examiner run such an algorithm? A MD5/SHA “fingerprints” a HDD before and after forensic imaging to demonstrate that the forensic image recovered is all-inclusive of the original contents and that nothing was altered in the process

Storing and Retrieving Data Processing the Electronic Crime Scene Pop Quiz Storing and Retrieving Data Processing the Electronic Crime Scene