270 likes | 516 Views
Computer Forensics Lab Simulation. METCS693 Xianghua Tu Samantha Liang July 26, 2005. Computer Forensics Lab Simulation. The case Simulation Scenario Initial design and assessment for the case Investigation Tools Data Acquisition Data Analysis Report References. The Case.
E N D
Computer Forensics Lab Simulation METCS693 Xianghua Tu Samantha Liang July 26, 2005
Computer Forensics Lab Simulation • The case • Simulation Scenario • Initial design and assessment for the case • Investigation Tools • Data Acquisition • Data Analysis • Report • References
The Case A young girl is missing after having an argument with her parents. They call the police on July 26. A police officer shows up the next day to interview them. The officer finds out that the daughter has spent a lot of time on the internet. The parents agree to let him take her laptop… (from Case Project 2-2, p77)
Simulation Scenario • A girl named Nancy has been communicating with a stranger by email and yahoo messenger, complaining about her parents. She exchanged pictures with the stranger by email. • The stranger offered her an air ticket to fly to his place and sent her the electronic ticket by email • The girl checked the map online for directions • Before she left home, she deleted the picture files from the stranger
Initial design and assessment for the case • The nature of the case: missing person which may involve woman/child abduction • Computer OS: Windows XP Pro • Potential place for evidence: hard drive, email, internet, instant messenger
Investigation Tools • Web Browser Analysis • pasco • Email Analysis • FTK • IM Analysis • Universal IM History Decoder • Hard Drive Analysis • FTK
Data Analysis • Web browsing analysis • Email analysis • Instant Messenger analysis • Hard drive analysis
Report • Nancy’s activities: • Communications with the suspect • Electronic ticket • Mapquest • Information about the suspect: • IP address • Email address • Picture
References • Nelson B. et al. (2005) Guide to Computer Forensics and Investigations, Second Edition. Boston: Thomson. • Pasco Forensic Tool: http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/proddesc/pasco.htm • Universal IM History Decoder 1.3 http://www.zamovsoft.com/ • Web Browser Forensics http://www.securityfocus.com/infocus/1827