2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA Automatically Creating Realistic Targets for Digital Forensics Investigation  Frank Adelstein  ATC-NY  33 Thornwood Drive, Suite 500  Ithaca, NY  Contact: nycorp.com nycorp.com  Yun Gao  Golden G. Richard III Department of Computer Science University of New Orleans  New Orleans, LA  Contact: August 17, 2005

2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA Abstract  The need for computer forensics education continues to grow.  An essential component of training is hands-on, realistic assignments.  Creating detailed, realistic lab is a difficult task.  FALCON (Framework for Laboratory exercises Conducted Over Networks)

2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA 1. Introduction  Keywords: computer forensics, computer security, education  Computer forensic training schools.  The weakness of the computer forensics education  FALCON cycle.

2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA Figure 1: FALCON and the lab development process

2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA 2. FALCON Architecture  2.1 Lab Creation Tool(LCT)  To automatically configure a set of target machines  Allow an instructor to carefully specify the types of activity.

2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA  2.2 Lab Execution Environment  To provide an interactive environment.  Set up scenarios on virtual target machines for the students to investigate.  Support the forensic investigation itself.  Logging the activities of the students.  OnLine DFS

2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA  2.3 Lab Evaluation Tool  Use to evaluate a laboratory exercise.  Help evaluate performance.  Provide details on what actions students took.  Use to gather information to gauge the level of difficulty of the lab. (e.g. time spent)

2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA 3. Preliminary Results  All students complete the assignments.

2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA Figure 2: Network configuration in proof-of-concept experiment.

2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA 4. Conclusions and Future Work  To provide adequate training to students of digital forensics.  An architecture for the creation, deployment, and evaluation of laboratory exercises to support education.  Future -To improve the education in digital forensics. -To improve the education in digital forensics. -To get feedback from the students. -To get feedback from the students.

2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA 5. References  [1]Sleuthkit and Autopsy,  [2]Encase forensics software,  [3]ForensicsToolkit(FTK),  [4]iLook Investigator forensic software,  [5]SMART forensics software,  [6]F. Adelstein, “MFP: The Mobile Forensics Platform,” Proceedings of the 2002 Digital Forensics Research Workshop,  [7]F. Adelstein, “MFP: The Mobile Forensic Platform,” International Journal of Digital Evidence, 2(1),  [8]E. Casey,Digital Evidence and Computer Crime, Academic Press, 2nd Edition, March  [9]E. Casey, Handbook of Computer Crime Investigation: Forensic Tools & Technology, Academic Press, October 2001, pp  [10]E. Casey, “Network traffic as a source of evidence: tool strengths, weak- nesses, and future needs,” Digital Investiga- tion, 1(1), Elsevier, 2004, pp  [11]P. Sealey, “Remote forensics,” Digi- tal Investigation, 1(4), Elsevier, 2004, pp