1. Overview of Computer Forensics Highline Community College Seattle University University of Washington in conjunction with the National Science Foundation

2. Computer Forensics The application of forensic science techniques to the discovery, collection and analysis of digital evidence.

3. Data Recovery Digital recovery of data Digital recovery of data Not connected with an investigation typically Not connected with an investigation typically Have a good idea of what you are looking for Have a good idea of what you are looking for Can involve Can involve file repairfile repair email repairemail repair Physical damage to drives Physical damage to drives

4. Disaster Recovery Natural Disaster Natural Disaster Power outages Power outages Mechanical failures Mechanical failures Productivity Productivity

5. Suspect / Victim Drive corporate investigation corporate investigation fraudfraud embezzlementembezzlement corporate espionagecorporate espionage policy violationspolicy violations criminal investigation criminal investigation kidnappingkidnapping murdermurder drugsdrugs

6. Suspect / Victim Drive civil investigations civil investigations divorcedivorce harassmentharassment stalkingstalking

7. Host Based Forensics External or internal attack External or internal attack Known OS Known OS Known vulnerabilities Known vulnerabilities isolate what harm was done isolate what harm was done determine method determine method notify Network Admin notify Network Admin

8. Network Based Forensics External and Internal attacks External and Internal attacks determines how someone got in determines how someone got in what they did what they did what ports were used what ports were used tries to determine source tries to determine source

9. Course Topics Review OSs Review OSs file structurefile structure boot up issuesboot up issues Review hardware and storage media Review hardware and storage media Available software Available software Evaluation of new software Evaluation of new software Windows Registry Windows Registry Email Email

10. Course Topics RAID devices RAID devices PDAs PDAs Cell phones Cell phones Combos Combos Compressed drives Compressed drives Multiple drives Multiple drives Sparse collection Sparse collection

11. Course Topics Linux and computer forensics Linux and computer forensics Knoppix STD Knoppix STD The Auditor and Helix The Auditor and Helix Database Investigations Database Investigations