1. Digital Forensics
Chris Rozic

2. Direction Definition of digital forensics Areas of required expertise
Collection of digital evidence
Actual investigation
Examples of forensic software
Digital Forensics example

3. Definition
A scientific, systematic inspection of a computer system and its contents for evidence or supportive evidence of a crime or other illegitimate computer use.
Must be techno-legal in nature

4. General Process

5. Must knows of Forensics Investigator
Must be highly knowledgeable in many areas
Computer forensics protocols
Network infrastructures
Evidence control
E-discovery tools

6. Collection of evidence
Done in three parts
Workstation of the offender
Server accessed by offender
The connecting network
Must take extreme caution while handling the captured information
Consider the organization

7. Actual Investigation Analyze the surrounding Photograph
Power down machine and inspect
Documentation

8. Duplicate Hard Drive Duplicate entire hard drive at sector level
Use hardware to write block
Create image
Completeness
Accuracy
Create MD5 hash

9. Forensics tools Encase nGenius Flow Recorder Guidance software
Allows for a digital snapshot of the storage medium under investigation
nGenius Flow Recorder
Security-hardened, Linux-based appliance that continuously captures, stores, and analyzes large volumes of network traffic

10. Encase Most popular Specifically designed for law enforcement
Creates mirrored images
User friendly interface

11. Creation of MD5 with Encase
File Integrity:
Completely Verified, 0 Errors.
Acquisition Hash: 340C8B5EF96DCCEE4B552CE084CCF941
Verification Hash: 340C8B5EF96DCCEE4B552CE084CCF941

12. nGenius Flow Recorder Available in two appliances
Enterprise appliance platform
Workgroup appliance platform
Allows for 24x7 recording and diagnosis

13. Advantages of nGenius Deep traffic stream capture
Provide packet-level visibility
Application reconstruction/playback
Complete post-event analysis
Automatic notification
Network forensics analysis

14. Digital Forensics Example
Chandra Levy
Missing April 30, 2001
Used and the internet prior to disappearance
Ultimately led to her whereabouts a year later

15. Conclusion There are many areas where digital forensics is applicable
One of the largest growing fields requiring knowledge across different spectrums
Allows for numerous job opportunities in specialized areas

16. Questions ?

17. References www.protiviti.com www.nGeniusflowrecorder.com
Personal notes