91.580.203 Computer Network Forensics

Nov 14, 2012

250 likes | 391 Views

2. Outline. IntroductionRelated work (previous work)Tribble: hardware based memory imagingConclusions. 3. Why are the memory contents useful?. Code-Red worm

Share Presentation

Embed Code

Link

lulu

Download Presentation

91.580.203 Computer Network Forensics

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

Chapter 13: Computer and Network Forensics

Chapter 13: Computer and Network Forensics Computer Network Security Computer Forensics Computer forensics involves the preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and/or root cause analysis.

788 views • 16 slides

91.580.203 Computer Network Forensics

2. Outline. More on recovering secret dataRename files/directoriesDelete files/directoriesCopy files/directoriesPrint filesFormat a diskFAT file systemWindows registryNTFS file system. 3. Renaming Files. Rename files and/or file extensionsExample:Rename extortion_letter.doc to fuzzy_bunny.jpgPeople looking for incriminating evidence probably won't check a picture file called fuzzy_bunny.jpg.

1.06k views • 69 slides

Computer Forensics

Computer Forensics. Hard Drive Format. Hard Drive Partitioning. Boot process starts in ROM. Eventually, loads master boot record from booting device. MBR located at well-known location. Hard Drive Partitioning (Windows Only). MBR located always in the first sector of booting device.

842 views • 49 slides

Computer Forensics

Computer Forensics. DOS Partitioning. Partitioning Practices. We separate partition practices into those used by Personal Computers: DOS Apple Servers Free BSD Sun Solaris GPT. DOS Partitions.

760 views • 33 slides

Computer Forensics

Computer Forensics. Chapter 23. Objectives. Explore the basics of digital forensics. Identify the rules and types of evidence. Collect evidence and preserve evidence. Maintain a viable chain of custody. Investigate a computer crime or policy violation. Examine system artifacts.

883 views • 71 slides

Computer Forensics

Computer Forensics. What is Computer Forensics?. Scientific process of preserving, identifying, extracting, documenting, and interpreting data on a computer Used to obtain potential legal evidence. Computer Forensics Minor.

205 views • 0 slides

91.580.203 Computer & Network Forensics

91.580.203 Computer & Network Forensics . Xinwen Fu. Chapter 1 Computer Forensics and Investigations as a Profession. Outline. Understand computer forensics Prepare for computer investigations Understand enforcement agency investigations Understand corporate investigations

641 views • 41 slides

Network forensics

Network forensics. We’ve got what it takes to take what you got!. Introduction and Course overview. What is network forensics Sources of Network Data and Evidence Forensically Sound Evidence Acquisition Techniques Packet Analysis Statistical Analysis

639 views • 14 slides

Computer Forensics

630 views • 22 slides

Computer Forensics

Computer Forensics. CS 407 MW 10:30 – 12:30 Texts: File System Forensic Analysis , Brian Carrier Windows Forensics Analysis , 2 nd editiion , Harlan Carvey Supplementary Texts: Digital Evidence and Computer Crime , Eoghan Casey

668 views • 37 slides

COMPUTER FORENSICS

COMPUTER FORENSICS. Chapter 18. Introduction. Computers have permeated society and are used in countless ways with innumerable applications. Similarly, the role of electronic data in investigative work has realized exponential growth in the last decade.

652 views • 43 slides

Computer Forensics

Computer Forensics. Email Tracing Examples.

151 views • 5 slides

Computer Forensics

Computer Forensics. Chapter 3. Understanding the Windows Registry. *. Understanding the Windows Registry. Registry A database that stores hardware and software configuration information, network connections, user preferences, and setup information

1.16k views • 87 slides

Computer Forensics

Computer Forensics. Internet Investigation E-mail Investigations. Exploring the Role of E-mail in Investigations. Exploring the Role of E-mail in Investigations. With the increase in e-mail scams and fraud attempts with phishing or spoofing

706 views • 39 slides

Computer Forensics

Computer Forensics. Presented by: Marcus Lawson J.D . President Josiah Roloff ENCE Vice President Global CompuSearch LLC Spokane WA (main office) 509-443-9293 Portland OR 503-542-7448 Sacramento CA 916-760-7362 Palm Springs (San Diego) 760-459-2122. Overview :. Digital evidence is…

398 views • 29 slides

Chapter 14: Computer and Network Forensics

Chapter 14: Computer and Network Forensics. Guide to Computer Network Security. Computer Forensics. Computer forensics involves the preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and/or root cause analysis.

348 views • 16 slides

Computer Forensics

Computer Forensics. NTFS File System. MBR and GPT Disks. MBR disks for 32b 86x-compatibles GPT disks for 64b Itanium processors Start with a MBR in order to maintain compatibility MBR has a single partition with a partition table entry of 0xEE. NTFS Architecture. NTFS Partition Layout.

474 views • 42 slides

Chapter 14: Computer and Network Forensics

229 views • 16 slides

Computer Forensics

Computer Forensics. Network Protocols Overview for Network Forensics. Focus of this presentation. Protocols With a few anecdotes, how-to-dos and previews thrown in. Network Protocols: Layering. Complexity of networking leads to layered architectures. TCP/IP stack has four levels.

1.69k views • 165 slides

More Related

91.580.203 Computer Network Forensics

91.580.203 Computer Network Forensics

Presentation Transcript

Chapter 13: Computer and Network Forensics

91.580.203 Computer Network Forensics

Computer Forensics

Computer Forensics

Computer Forensics

Computer Forensics

91.580.203 Computer &amp; Network Forensics

Network forensics

Computer Forensics

Computer Forensics

COMPUTER FORENSICS

Computer Forensics

Computer Forensics

Computer Forensics

Computer Forensics

Chapter 14: Computer and Network Forensics

Computer Forensics

Chapter 14: Computer and Network Forensics

Computer Forensics

91.580.203 Computer & Network Forensics