Upload File

intro to computer forensics forensics services intro… · extraction, documentation and...

  • Home
  • Documents
  • Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any
27
Copyright Computer Forensic Services, LLC Warren G. Kruse II, CISSP, CFCE Warren G. Kruse II, CISSP, CFCE wgkruse@computer wgkruse@computer - - forensic.com forensic.com http://www.computer-forensic.com 732-695-0530 Copy on www.computer-forensic.com/presentations/) Intro to Computer Forensics

Upload: others

Post on 18-Oct-2020

2 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Warren G. Kruse II, CISSP, CFCE Warren G. Kruse II, CISSP, CFCE wgkruse@[email protected]

http://www.computer-forensic.com732-695-0530

Copy on www.computer-forensic.com/presentations/)

Intro to Computer Forensics

Page 2: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Topics

• Intro to Computer Forensics• What may be available

Page 3: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

What Is Computer Forensics?

“Computer forensics involves the preservation, identification, extraction, documentation and interpretation of computerdata. It is often more of an art than a science, but as in any discipline, computer forensic specialists follow clear, well-defined methodologies and procedures, and flexibility is expected and encouraged when encountering the unusual.”

From: “Computer Forensics: Incident Response Essentials”

• Finding key pieces of evidence - even if someone has tried to hide, discard, or destroy them.

Page 4: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Software Recommendations– Guidancesoftware’s Encase: www.encase.com– Acessdata’s Forensic Toolkit:

www.accessdata.com– AccessData Password Recovery Toolkit– AccessData’s Distributed Network Attack– Prodiscover (DFT or IR), www.techpathways.com– Safeback, www.forensics-intl.com– Quick View Plus, http://www.jasc.com/– Thumbs Plus (Shareware), www.cerious.com– Irfanview (freeware for non commercial use)

• www.irfanview.com

Page 5: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

What Computer Forensics is used for:• High Tech Investigations• Incident Response• E-mail recovery and analysis• Document & File Discovery

– Locating and recovering previously inaccessible files.

• Data Collection– Collecting data while preserving vital date and time stamps,

temporary files and other volatile information.

Page 6: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

What Computer Forensics is used for:• Preservation of Evidence

– Adherence to carefully developed set of procedures that address security, authenticity, and chain-of-custody.

• Analysis of User Activity– Reporting of all user activity on computer and company

network including, but not limited to,e-mail, Internet and Intranet files accessed, files created and deleted, and user access times.

• Password Recovery– Accessing and recovering data from password protected

files.

Page 7: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Investigative Methods• Common sense• Physical surveillance• Victim\witness interview• Undercover approach• Electronic surveillance

(network monitoring-sniffers, NIDs, etc.)

• Informants• Sting operation• IMAGE!

Does this sound any different then other types of investigations?

Page 8: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Keys to Success• Documentation of all action• Preservation of evidence• Swift action to collect electronic audit trails • Resources• Time – hard drives are getting HUGE!

Page 9: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Tools of our trade

Page 10: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Terminology

• Image: exact copy of a hard drive including deleted files and areas of the hard drive that a normal backup would not copy

• Slack, Swap and Unallocated space

Page 11: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Show Me Something!

• Password Protected files• Deleted Files Demo's

Page 12: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Password Protection

Page 13: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Show Me Something Else!

• Once Upon a Time There Was a File Named PatentSubmission.Doc

Page 14: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

A File Is Born

Page 15: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

The File Dies…or Does It?

Page 16: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Encase Doesn’t Think So

Page 17: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

How About Now?

Page 18: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Let’s See Shall We?

Page 19: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

It’s ALLLLLLLIVE!

5 HITS

Page 20: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

How About Now?

Page 21: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Let’s See

Page 22: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

It’s STILL ALLLLLLLIVE!

5 HITS

Page 23: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

The Resurrection(“Deleted” File Before and After Format and Defrag)

Page 24: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Trace Information May Exist From:• Email• PDA/Blackberry• Temp Files• Recycle Bin• Info File Fragments• Recent Link Files• Spool (printed) files• Internet History (index.dat)• Registry• Unallocated Space• File Slack

Page 25: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

The File Lives On…

• This was made possible only through the forensic practice of treating the entire physical disk as evidence (rather than just files) and handling it as evidence.

• Demos anyone?

Page 26: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Where to go from here• www.virtuallibrarian.com/legal/• www.htcia.org• Shameless Plug Warning:

– Computer Forensics:Incident Response Essentials– Paperback: 416 pages– Publisher: Addison-Wesley Pub Co – ISBN: 0201707195

Page 27: Intro to Computer Forensics Forensics Services intro… · extraction, documentation and interpretation of computer data. It is often more of an art than a science, but as in any

Copyright Computer Forensic Services, LLC

Computer Forensic Services, LLC

Warren Kruse20-22 Industrial WayEatontown, New JerseyToll Free: (732) 695-0530Email: [email protected]

Copy on www.computer-forensic.com/presentations/)


Digital forensics intro 20151123

Defining computer forensics Computer Forensics ......Computer Forensics Computer forensics is a fascinating field. As enterprises become more com-plex and exchange more information

Intro to Comp Forensics

Xinwen Fu Anonymous Communication & Computer Forensics 91.580.203 Computer & Network Forensics

Computer forensics - Jordan University of Science and ...tawalbeh/aabfs/presentations/computer_forensics.pdf · 29.08.2006 Computer forensics 2 Computer forensics Definitions: Forensics

COMPUTER FORENSICS - Boise Chapter€¦ · 3 Mobile device forensics 4 Other 5 References Computer forensics Main article: computer forensics ... 1.19 Computer Forensics Solution

Computer Forensics. Definition What is Computer Forensics?? –Computer forensics involves the preservation, identification, extraction, documentation,

Central Texas CIS 3361-110 Intro to Computer Forensics ......Bill Nelson, Amelia Phillips, Christopher Steuart, Guide to Computer Forensics and Investigations Fifth Edition. Cengage

COMPUTER FORENSICS & CAREER DR. JOE CICCONE CJ317: Computer Forensics

Computer Forensics: Basics Lecture 1 The Context of Computer Forensics

Digital Evidence and Computer Forensics Oct 7-8 2013/Tab 02 Oct 7-8... · Digital Evidence and Computer Forensics COMPUTER FORENSICS FORENSICS FORENSICS

Intro to MIS – MGS351 Computer Crime and Forensics Extended Learning Module H

Digital Evidence Locations and Intro to Computer Forensics Dakota... · Online Email Accounts (Gmail and Yahoo) Internet Shopping Accounts ... “Triage” forensics Mobile device

Computer Forensics

Live Forensics Investigations Computer Forensics 2013

Computer forensics

Cloud Storage Forensics - SANS Computer Forensics

Intro to Forensics Science

COS/PSA 413 and 413L Computer Forensics Day 1. Agenda Roll Call Introductions Blackboard Syllabus Classroom Contract Intro to Computer Forensics Questions

Computer)Forensics - Computing Science and Mathematics ... · Computer)Security)&)Forensics Autumn)2014 Computer)Forensics! Computer)Forensics)is)the)process)of)analysing)digital)media)to)determine)if)

Computer +forensics

Computer Forensics An Intro to Computer Crime. Computer Forensics BTK The BTK Killer ( B lind, T orture, K ill) Dennis Rader - Feb 2005 Charged with

4482 Intro - York UniversityEECS 3482 Intro to Com. Sec. EECS 4481 Com. Sec. Lab EECS 4480 Capstone Project Network Security & Forensics Computer Forensics EECS 4482 - Network Security

Forensics Intro

intro to forensics

COMPUTER FORENSICS · 2019-08-24 · 1.0 Computer Forensics In Today’s World 1.0 Intro To Computer Forensics 2.0 Need For Computer Forensics 3.0 What is Cyber Crime 4.0 Forensics

CSCI 4623: Intro to Digital Forensics - 123seminarsonly.com · CSCI 4623: Intro to Digital Forensics Dept. of Computer Science University of New Orleans Slide Set # 2 Spring 2006