Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Review for the Final Exam December 8, 2008

How are you doing in class so far? l Based on mid-term exams and the assignments everyone is doing very well in class – please see your mid-term grade l Please keep up with good work until the final grade

Overview of Course Work l Two exams each worth 16 points - Mid-term (done) and Final exams (December 12) l Programming project worth 16 points - Due date; December 12th l Four homework assignments worth 10 points each - All assignments completed by December 8th l Term paper (12 points – by December 8 th ) l Total 100 points l Extra credit – Encase project – 10 points

Final Exam Tips l Answer 6 out of 9 questions (maybe 7 out of 10) l Network Forensics – 2 questions - Based on the lectures and the book chapter l , application Forensics – 1 question, based on lectures and book chapter l Military Forensics – 1 question, lecture notes l Expert witness and report writing – 1 question – based on book chapters and lectures l Rest of the questions (4-5 l questions) on the papers we have discussed in class - Papers will be listed in the next page l Extra credit question, from the additional papers listed in page after next

Key Papers to Read for the Final Exam l Iowa State Paper l FORZA – Digital forensics investigation framework that incorporate legal issues l A cyber forensics ontology: Creating a new approach to studying cyber forensics l Arriving at an anti-forensics consensus: Examining how to define and control the anti-forensics problem l Forensic feature extraction and cross-drive analysis l A correlation method for establishing provenance of timestamps in digital evidence -

Following Papers will be included as Extra credit questions Cyber Forensics: a Military Perspective 99E5-632B-FF420389C0633B1B.pdf How to Reuse Knowledge about Forensic Investigations Danilo Bruschi, Mattia Monga, Universit`a degli Studi di Milano John Lowry, BBN Systems: Adversary Modeling to Develop Forensic Observables bles.pdf Dr. Golden G. Richard III, University of New Orleans, New Orleans, LA: Breaking the Performance Wall: The Case for Distributed Digital Forensics

Project l Project description l Software modules (prefer diagram) and description l Results l Analysis l Future improvements l References

My Office Hours before exam l I will be at work on Tuesday and Friday if I am not called for Jury duty l Tuesday afternoon (3-4pm) and Friday morning (10-11am) – December 9, 12 th l I will be in my office December 23 rd from 11am – 12 noon l You can send me