Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Review for Final Exam November 19, 2010

Review l Please check the Introduction unit for details on Exam #2 l I will send 3 papers via on November 23 (in pdf form that you can also obtain in the web) for review for exam #2

Objective of the Course l The course describes concepts, developments, challenges, and directions in Digital Forensics. l Text Book: Computer Forensics and Investigations. Bill Nelson et al, 2007/2008. l Topics include: - Digital forensics fundamentals, systems and tools, Digital forensics evidence and capture, Digital forensics analysis,

Outline of the Course l Introduction to Data and Applications Security and Digital Forensics l SECTION 1: Computer Forensics l Part I: Background on Information Security l Part II: Computer Forensics Overview - Chapters 1, 2, 3, 4, 5 l Part III: Computer Forensics Tools - Chapters 6, 7, 8 l Part IV: Computer Forensics Analysis - Chapters 9, 10 l Part V Applications - Chapters 11, 12, 13

Outline of the Course l Part VI: Expert Witness - Chapters 14, 15, 16 l SECTION II - Selected Papers - Digital Forensics Research Workshop l Guest Lectures - Richardson Police Department - North Texas FBI - Digital Forensics Company in DFW area

Course Work l Two exams each worth 15 points - Mid-term and Final exams (October 22, December 3) l Programming project worth 14 points (December 3) l Three homework assignments worth 8 points each (September 17, September 24, November 12; 9-1, 9-2, 10-3) l Term paper 10 points (December 3, 2010) l Digital Forensics Project 14 points (SAIAL Lab, November 19) l Total 92 points (i.e., if you get 92 points then you get 100% for the course) l Extra credit opportunities

Term Paper Outline l Abstract l Introduction l Analyze algorithms, Survey, l Give your opinions l Summary/Conclusions

Programming/Digital Forensics Projects – l Encase evaluation l Develop a system/simulation related to digital forensics - Intrusion detection - Ontology management for digital forensics - Representing digital evidence in XML - Search for certain key words

Course Rules l Unless special permission is obtained from the instructor, each student will work individually l Copying material from other sources will not be permitted unless the source is properly referenced l Any student who plagiarizes from other sources will be reported to the Computer Science department and any other committees as advised by the department

Contact l For more information please contact - Dr. Bhavani Thuraisingham - Professor of Computer Science and - Director of Cyber Security Research Center Erik Jonsson School of Engineering and Computer Science EC31, The University of Texas at Dallas Richardson, TX Phone: Fax:

Assignments: Due September 17, Hands-on Project l Assignments #1 and #2 l Chapter 2: 2.1, 2.2, 2.3 l Chapter 4: 4.1, 4.2 l Chapter 5: 5.1 l Assignment #3 l Chapter 9: 9-1, 9-2 l Chapter 10: 10-1

Papers to Read for Exam #1 l 1. Iowa State University Paper 1. Iowa State University Paper l hs.pdf hs.pdf l 2. Papers on Intelligent Digital Forensics l l XIRAF – XML-based indexing and querying for digital forensics l Selective and intelligent imaging using digital evidence bags l l Detecting false captioning using common-sense reasoning

Papers to Read for Exam #1 l 3. Database Tampering (check Dr. Snodgrass website for the pdf form of the papers) 3. Database Tampering (check Dr. Snodgrass website for the pdf form of the papers) l Richard T. Snodgrass, Stanley Yao and Christian Collberg, "Tamper Detection in Audit Logs," In Proceedings of the International Conference on Very Large Databases, Toronto, Canada, August–September 2004, pp. 504– Tamper Detection in Audit Logs l Did the problem occur? (e.g. similar to intrusion detection) l Kyri Pavlou and Richard T. Snodgrass, "Forensic Analysis of Database Tampering," in Proceedings of the ACM SIGMOD International Conference on Management of Data (SIGMOD), pages , Chicago, June, l Who caused the problem (e.g., similar to digital forensics analysis)

Papers to Read for Exam #1 l 4. Detecting Malcious Executables – this will be useful for lecture 10, pdf from IEEE Explore 4. Detecting Malcious Executables – this will be useful for lecture 10, pdf from IEEE Explore Mohammad M. MasudMohammad M. Masud, Latifur Khan, Bhavani M. Thuraisingham: A Hybrid Model to Detect Malicious Executables. ICC 2007: Latifur KhanICC 2007 l 5. Steganography (High level Understanding of the following paper _03_research01.htm 004_03_research01.htm l 6. Initial chapters of the Thesis from Ireland for Event Reconstruction l Formalizing Event Reconstruction in Digital Investigations Pavel Gladyshev, Ph.D. dissertation, 2004, University College Dublin, Ireland

Papers to Read for Exam #2 l Forensic feature extraction and cross-drive analysis l A correlation method for establishing provenance of timestamps in digital evidence -

Papers to Review for Exam #2 l FORZA – Digital forensics investigation framework that incorporate legal issues l A cyber forensics ontology: Creating a new approach to studying cyber forensics l Arriving at an anti-forensics consensus: Examining how to define and control the anti-forensics problem -

Papers to Review for Exam #2 l Paper on File Carving l Paper on Video Surveillance l Paper on Secure voting machine (for the extra credit question) l MS Thesis paper

Questions for Exam l 6 questions on the 6 papers (please see previous three charts) l Digital Watermarking l Expert Witness l File Carving MS Thesis (first few Chapters) l Next Generation Digital Forensics / Suspicious event detection (video surveillance) l Extra credit: (1) Secure voting machines (ii) Biometrics (iii) Virus/Worms