1. Technology for Computer Forensics by Alicia Castro

2. Introduction The objective of Computer forensics is to find legal evidence in computers and digital storage mediums. The goal of computer forensics is to explain the current state of a digital artifact. There are many reasons to employ the techniques of computer forensics like legal cases, data recovery, gathering evidence against an employee, debugging, performance optimization, or reverse-engineering Computer scientists can take steps to move computer forensics into a more rigorous position as a science by being able to make well-reasoned and concrete claims about the accuracy and validity of conclusions presented in court

3. Computer Forensics Areas of Law These are the areas of law related to computer security that are important to know about. Anyone concerned with computer forensics must know how these laws affect them: Fourth Amendment of the US Constitution. Wiretap Act (18 U.S.C. 2510-22) Pen Registers and Trap and Trace Devices Statute (18 U.S.C. 3121-27) Stored Wired and Electronic Communications Act (18 U.S.C. 2701-120)

4. Study of cases Devices subject to Forensic examination Digital storage Study of cases that have been prosecuted using computer forensics. Forensic examination of erased or deleted files, slack spaces and steganography Types of evidence

5. Forensic Tool Galleta is an Internet Explorer Cookie Forensic Analysis Tool that may be used to recover critical electronic evidence that is often found in the suspect's web browsing history in the form of received emails, sites visited and attempted Internet searches. Galleta will parse the information in a cookie file Why Galleta? A lot of child pornography cases involves web browsing, so improving this tool can be beneficial to the law enforcement agencies

6. Testing Galleta

7. Galleta Output

8. Galleta Limitations - With Galleta you can only parse one cookie at a time and this only creates one parsed export file per cookie. GUI - No user friendly

9. Galleta Proposed Improvements With the new Galleta you can tell it a cookie directory and it will parse all cookies in the directory and include them all in one file or one file per cookie date. Allow user to enter parameters for search Expand it to work with other browsers GUI – User friendly