Intro to Computer Forensics Forensics Services intro… · extraction, documentation and...

Copyright Computer Forensic Services, LLC

Warren G. Kruse II, CISSP, CFCE Warren G. Kruse II, CISSP, CFCE wgkruse@computerwgkruse@computer--forensic.comforensic.com

http://www.computer-forensic.com732-695-0530

Copy on www.computer-forensic.com/presentations/)

Intro to Computer Forensics

Topics

• Intro to Computer Forensics• What may be available

What Is Computer Forensics?

“Computer forensics involves the preservation, identification, extraction, documentation and interpretation of computerdata. It is often more of an art than a science, but as in any discipline, computer forensic specialists follow clear, well-defined methodologies and procedures, and flexibility is expected and encouraged when encountering the unusual.”

From: “Computer Forensics: Incident Response Essentials”

• Finding key pieces of evidence - even if someone has tried to hide, discard, or destroy them.

Software Recommendations– Guidancesoftware’s Encase: www.encase.com– Acessdata’s Forensic Toolkit:

www.accessdata.com– AccessData Password Recovery Toolkit– AccessData’s Distributed Network Attack– Prodiscover (DFT or IR), www.techpathways.com– Safeback, www.forensics-intl.com– Quick View Plus, http://www.jasc.com/– Thumbs Plus (Shareware), www.cerious.com– Irfanview (freeware for non commercial use)

• www.irfanview.com

What Computer Forensics is used for:• High Tech Investigations• Incident Response• E-mail recovery and analysis• Document & File Discovery

– Locating and recovering previously inaccessible files.

• Data Collection– Collecting data while preserving vital date and time stamps,

temporary files and other volatile information.

What Computer Forensics is used for:• Preservation of Evidence

– Adherence to carefully developed set of procedures that address security, authenticity, and chain-of-custody.

• Analysis of User Activity– Reporting of all user activity on computer and company

network including, but not limited to,e-mail, Internet and Intranet files accessed, files created and deleted, and user access times.

• Password Recovery– Accessing and recovering data from password protected

files.

Investigative Methods• Common sense• Physical surveillance• Victim\witness interview• Undercover approach• Electronic surveillance

(network monitoring-sniffers, NIDs, etc.)

• Informants• Sting operation• IMAGE!

Does this sound any different then other types of investigations?

Keys to Success• Documentation of all action• Preservation of evidence• Swift action to collect electronic audit trails • Resources• Time – hard drives are getting HUGE!

Tools of our trade

Terminology

• Image: exact copy of a hard drive including deleted files and areas of the hard drive that a normal backup would not copy

• Slack, Swap and Unallocated space

Show Me Something!

• Password Protected files• Deleted Files Demo's

Password Protection

Show Me Something Else!

• Once Upon a Time There Was a File Named PatentSubmission.Doc

A File Is Born

The File Dies…or Does It?

Encase Doesn’t Think So

How About Now?

Let’s See Shall We?

It’s ALLLLLLLIVE!

5 HITS

How About Now?

Let’s See

It’s STILL ALLLLLLLIVE!

5 HITS

The Resurrection(“Deleted” File Before and After Format and Defrag)

Trace Information May Exist From:• Email• PDA/Blackberry• Temp Files• Recycle Bin• Info File Fragments• Recent Link Files• Spool (printed) files• Internet History (index.dat)• Registry• Unallocated Space• File Slack

The File Lives On…

• This was made possible only through the forensic practice of treating the entire physical disk as evidence (rather than just files) and handling it as evidence.

• Demos anyone?

Where to go from here• www.virtuallibrarian.com/legal/• www.htcia.org• Shameless Plug Warning:

– Computer Forensics:Incident Response Essentials– Paperback: 416 pages– Publisher: Addison-Wesley Pub Co – ISBN: 0201707195

Computer Forensic Services, LLC

Warren Kruse20-22 Industrial WayEatontown, New JerseyToll Free: (732) 695-0530Email: wgkruse@computer-forensic.com

Copy on www.computer-forensic.com/presentations/)

Intro to Computer Forensics Forensics Services intro… · extraction, documentation and...

Documents

CSCI 4623: Intro to Digital Forensics - 123seminarsonly.com · CSCI 4623: Intro to Digital Forensics Dept. of Computer Science University of New Orleans Slide Set # 2 Spring 2006

COS/PSA 413 and 413L Computer Forensics Day 1. Agenda Roll Call Introductions Blackboard Syllabus Classroom Contract Intro to Computer Forensics Questions

Intro to Comp Forensics

intro to forensics

Computer forensics

Central Texas CIS 3361-110 Intro to Computer Forensics ......Bill Nelson, Amelia Phillips, Christopher Steuart, Guide to Computer Forensics and Investigations Fifth Edition. Cengage

Computer Forensics. Definition What is Computer Forensics?? –Computer forensics involves the preservation, identification, extraction, documentation,

Digital Evidence and Computer Forensics Oct 7-8 2013/Tab 02 Oct 7-8... · Digital Evidence and Computer Forensics COMPUTER FORENSICS FORENSICS FORENSICS

COMPUTER FORENSICS & CAREER DR. JOE CICCONE CJ317: Computer Forensics

Intro to MIS – MGS351 Computer Crime and Forensics Extended Learning Module H

Digital forensics intro 20151123

Computer)Forensics - Computing Science and Mathematics ... · Computer)Security)&)Forensics Autumn)2014 Computer)Forensics! Computer)Forensics)is)the)process)of)analysing)digital)media)to)determine)if)

Forensics Intro

COMPUTER FORENSICS · 2019-08-24 · 1.0 Computer Forensics In Today’s World 1.0 Intro To Computer Forensics 2.0 Need For Computer Forensics 3.0 What is Cyber Crime 4.0 Forensics

Intro to Forensics Science

COMPUTER FORENSICS - Boise Chapter€¦ · 3 Mobile device forensics 4 Other 5 References Computer forensics Main article: computer forensics ... 1.19 Computer Forensics Solution

Computer Forensics

Defining computer forensics Computer Forensics ......Computer Forensics Computer forensics is a fascinating field. As enterprises become more com-plex and exchange more information

Computer forensics - Jordan University of Science and ...tawalbeh/aabfs/presentations/computer_forensics.pdf · 29.08.2006 Computer forensics 2 Computer forensics Definitions: Forensics

Computer Forensics An Intro to Computer Crime. Computer Forensics BTK The BTK Killer ( B lind, T orture, K ill) Dennis Rader - Feb 2005 Charged with