1 / 17

An Introduction to Computer Forensics

An Introduction to Computer Forensics. Jim Lindsey Western Kentucky University. What are we talking about?. Forensic …. What are we talking about?. Forensic Science is the use of science to investigate and establish facts in criminal and civil cases. What are we talking about?.

barney
Download Presentation

An Introduction to Computer Forensics

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. An Introduction to Computer Forensics Jim Lindsey Western Kentucky University

  2. What are we talking about? • Forensic …

  3. What are we talking about? • Forensic Science is the use of science to investigate and establish facts in criminal and civil cases.

  4. What are we talking about? • Computer Forensics is the discovery, collection, and analysis of evidence found on computers and networks.

  5. Many Hats Computer Forensics

  6. An Exam May Explain … • Hidden data • Most recently used applications • Origin of documents • Evidence of “wiping” • Visited Internet sites

  7. An Exam May Require … • Cloning • Write Blocker • MD-5 & SHA-1 • Cataloging • Recovery of Deleted Files • Search for hidden, disguised or encrypted files • Viewing files • Analysis of time/date stamps

  8. Deleted Files

  9. Deleted Files

  10. An Examiner Should … • Possess requisite training and equipment • Be able to provide training • Be knowledgeable of data relevant to computer-related crimes • Be able to effectively testify as an expert in a court of law

  11. What to do? • If the computer is off, do not turn on. • If the computer is on, do not shut down normally – call for instructions. • Do not “browse” the files!

  12. What to do? • Document, document, document - W H Y ? • Records chain of custody: • Where the evidence came from • When it was obtained • Who obtained it • Who secured it • Who has had control of it • Where it is stored

  13. Final Notes • Forensic Examinations • Normally 1-2 hours to forensically image a hard drive • Exams can take 4-40 hours, depending on requests • Helpful if “keywords” provided • Know what you want to search for…..

  14. Final Notes • Average HD Volume 590 GB* • Gigabyte 1,073,741,824 bytes • Subtotal 633,507,676,160 bytes • Page size 3000 bytes • Pages 211,169,225 • Ream 500 pages • Reams 422,338 Reams • Ream height 2” • Total height 844,676” • Height in feet 70,389 feet • Height of Mt Everest 29,029 feet** • Note these figures are conservative! * http://www.tomshardware.com/news/seagate-hdd-gigabyte-terabyte-quarter-result,13118.html ** http://www.teameverest03.org/everest_info/index.html

  15. Explain what the 'Chain of Custody' is in computer forensics. Furthermore, explain why it is important for forensic examiners to establish 'Chain of Custody' as soon as they arrive on a scene and maintain it throughout the life of a case. • We spent a day discussing computer forensics. How could knowledge of this topic help a human resources manager do their job? How could knowledge of this topic help a police officer do their job?

  16. Are there any questions?

More Related