Overview of Computer Forensics Highline Community College Seattle University University of Washington in conjunction with the National Science Foundation

Computer Forensics The application of forensic science techniques to the discovery, collection and analysis of digital evidence.

Data Recovery Digital recovery of data Digital recovery of data Not connected with an investigation typically Not connected with an investigation typically Have a good idea of what you are looking for Have a good idea of what you are looking for Can involve Can involve file repairfile repair repair repair Physical damage to drives Physical damage to drives

Disaster Recovery Natural Disaster Natural Disaster Power outages Power outages Mechanical failures Mechanical failures Productivity Productivity

Suspect / Victim Drive corporate investigation corporate investigation fraudfraud embezzlementembezzlement corporate espionagecorporate espionage policy violationspolicy violations criminal investigation criminal investigation kidnappingkidnapping murdermurder drugsdrugs

Suspect / Victim Drive civil investigations civil investigations divorcedivorce harassmentharassment stalkingstalking

Host Based Forensics External or internal attack External or internal attack Known OS Known OS Known vulnerabilities Known vulnerabilities isolate what harm was done isolate what harm was done determine method determine method notify Network Admin notify Network Admin

Network Based Forensics External and Internal attacks External and Internal attacks determines how someone got in determines how someone got in what they did what they did what ports were used what ports were used tries to determine source tries to determine source

Course Topics Review OSs Review OSs file structurefile structure boot up issuesboot up issues Review hardware and storage media Review hardware and storage media Available software Available software Evaluation of new software Evaluation of new software Windows Registry Windows Registry

Course Topics RAID devices RAID devices PDAs PDAs Cell phones Cell phones Combos Combos Compressed drives Compressed drives Multiple drives Multiple drives Sparse collection Sparse collection

Course Topics Linux and computer forensics Linux and computer forensics Knoppix STD Knoppix STD The Auditor and Helix The Auditor and Helix Database Investigations Database Investigations