An Introduction to Computer Forensics

1. An Introduction to Computer Forensics Jim Lindsey Western Kentucky University September 28, 2007

2. What are we talking about? • Forensic …

3. What are we talking about? • Forensic Science is the use of science to investigate and establish facts in criminal and civil cases.

4. What are we talking about? • Computer Forensics is the discovery, collection, and analysis of evidence found on computers and networks.

5. Interdisciplinary Field Computer Professional Investigator Computer Forensics • Forensic Examiners have to know about computers, how to perform an investigation and about the law. • Your job is to simply find the facts! Legal Professional

6. Why should I care? • Computers and the Internet are the fastest growing technologies used in crime (criminal and civil). • BTK and Scott Peterson Murder Cases • Enron and Worldcom Cases • Human Resource Matters • ID Theft and Divorce Matters

7. Deleted Files

8. The Computer Forensic Process • Gather the materials to be analyzed. • Must be done legally! • Establish the chain of custody. • Get all needed devices. • Preserve the media. • Write blockers • Bit for bit images • Extract the evidence. • What is relevant to the case? • Again, must be done legally!

9. The Computer Forensic Process • Analyze computer media. • Forensic HW • Forensic SW • Document the results. • Report your findings! • Consider the audience that will read the report!

10. Computer Forensics At Work • Deleted Files • Tracking Packet Routes • Analyzing Network Traffic • Analyzing Mobile Devices • Analyzing ISP Logs • Analyzing Chat Logs • Analyzing a Packet Trace

11. Summary • Defined computer forensics • Established why it is important for you to know about the topic • Described the computer forensic process • Looked at examples of tasks performed by computer forensic examiners