DOCSLIB.ORG

COMPUTER VIRUSES: the Technology and Evolution of an Artificial Life Form

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
COMPUTER VIRUSES: the Technology and Evolution of an Artificial Life Form COMPUTER VIRUSES: The Technology and Evolution of an Artificial Life Form Written by: Karsten Johansson, 1994 NOTE: This document was written before the advent of Internet worms and trojans. It probably contains more information about the pre-commercial internet virus scene than any other singular source, and thus I have opted to make it available to the Internet as a historical reference. There are a couple of unfinished sections, but maybe if there is enough interest, I may be convinced to finish this and update it to reflect the current state of the malware industry, and update the Artificial Life stuff since so much has happened there since 1994. Permission is granted to use this information in any legitimate manner as long as (1) my copyright is maintained, (2) you give me credit for all material used, and (3) you send an email to [email protected] so I know where and how my research and writing is being used. There is no copy restriction on this document for reading or distribution, but (4) under no circumstances is sale or profit directly from my work permitted without my implicit authorization. (5) If distributed, this document must remain in its entirety, and shall not be altered from the original PDF file distributed at http://www.penetrationtest.com. Publishers interested in this manuscript or any of my other works may contact me at the same email address. Table of Contents COMPUTER VIRUSES: The Technology and Evolution of an Artificial Life Form............................................................................... 1 Table of Contents ........................................................................... 1 COMPUTER VIRUSES: The Technology and Evolution of an Artificial Life Form............................................................................... 7 Introduction......................................................................................... 8 What is a Computer Virus? .............................................................. 15 The Birds and the Bees ................................................................ 18 Trojan Horses ............................................................................... 20 Worms .......................................................................................... 21 Comparative Study: Biological vs. Computer Viruses ...................... 24 Viruses Do Not Autogenerate ....................................................... 25 Viruses Are Choosy ...................................................................... 26 Viruses Modify Their Hosts, and "Borrow" Resources.................. 27 Most Viruses Do Not Re-Infect ..................................................... 28 Viruses Can Delay Their Symptoms............................................. 29 Viruses Can Mutate ...................................................................... 30 Ignorance Is Bliss ......................................................................... 31 Look Before You Leap .................................................................. 32 A Historical Look at the Computer Virus, Artificial Life, and Synthetic Psychology ....................................................................................... 33 The Virus in the Media ..................................................................... 39 The Michelangelo Virus ................................................................ 41 Just the Fax, Please... .................................................................. 44 Man: The Gullible Monkey ............................................................ 51 The Virus in the Underground .......................................................... 57 RABID........................................................................................... 57 The Bulgarian Virus Factory ......................................................... 60 Anarkick Systems ......................................................................... 61 Soltan Griss .................................................................................. 63 Phalcon/SKISM............................................................................. 63 Keeping Your Computer Clean......................................................... 64 Safe Hex ....................................................................................... 64 Use a Virus Detection Program................................................. 65 Create an Emergency Boot Diskette......................................... 65 Back Up Your System ............................................................... 67 Test New Software for Viruses or Damaging Code................... 68 Never Boot From Someone Else's Floppy Diskette .................. 70 Write Protect ALL Boot Diskettes.............................................. 71 Cleaning an Infected System ........................................................... 72 Executable Files ........................................................................... 73 Boot Sector/Master Boot Record .................................................. 74 Anti-Virus Software........................................................................... 78 Scan Strings.............................................................................. 78 Filters ........................................................................................ 80 Change Checkers ..................................................................... 82 Heuristic Scanning .................................................................... 84 Virus Cleaning Strategies................................................................. 87 Simple Erasure.......................................................................... 87 Database Cleaning.................................................................... 88 Integrity Checker Cleaning........................................................ 89 Virus Simulation Cleaning ......................................................... 90 Forgotten Functions: The System and DOS Programmers............. 94 The Master Boot Record............................................................... 97 PC Scavenger Source Code....................................................... 101 Anti-Virus Product Comparison ...................................................... 106 Science Says.................................................................................. 107 Artificial Life .................................................................................... 108 How "Alive" is a Computer Virus?............................................... 119 Life is a pattern in space and time rather than a specific material object....................................................................................... 119 Self-reproduction, in itself or in a related organism................. 119 Information storage of a self-representation. .......................... 120 A metabolism that converts matter/energy.............................. 120 Functional interactions with the environment. ......................... 120 Interdependence of Parts........................................................ 121 Stability under perturbations of the environment..................... 121 The ability to evolve ................................................................ 122 Growth or expansion ............................................................... 122 Other Behavior ........................................................................ 123 Synthetic Psychology ..................................................................... 125 The Basic Vehicle ................................................................... 126 Giving the Vehicle a Sense of Direction.................................. 126 Endowment of Several Senses ............................................... 128 Variable Sensitivity.................................................................. 129 Adding Thresholds .................................................................. 132 Adding Advanced Life-like Properties ..................................... 133 Artificial Life vs. Synthetic Psychology: A Comparison .......... 134 ...But is it Life?................................................................................ 136 Computer Virus Programming........................................................ 139 Reproduction .............................................................................. 140 Overwriting Viruses ................................................................. 140 Companion Viruses................................................................. 144 Appending Viruses .................................................................. 148 Appending .COM Viruses........................................................ 148 Appending .EXE Viruses......................................................... 150 Prepending .COM Viruses....................................................... 153 Boot Sector/MBR Viruses........................................................ 155 File Allocation Viruses............................................................. 157 Simbiotic Relationships............................................................... 157 Advanced Coding Techniques ....................................................... 158 Encryption ............................................................................... 158 Stealth Techniques: Advanced Hide-and-go-Seek ................ 159 Anti-Hack Routines ................................................................
Load more

Recommended publications
  • Paradise Lost , Book III, Line 18
    _Paradise Lost_, book III, line 18 %%%%%%%%%%%%%%%%%%%%%%%% ++++++++++Hacker's Encyclopedia++++++++ ===========by Logik Bomb (FOA)======== <http://www.xmission.com/~ryder/hack.html> ---------------(1997- Revised Second Edition)-------- ##################V2.5################## %%%%%%%%%%%%%%%%%%%%%%%% "[W]atch where you go once you have entered here, and to whom you turn! Do not be misled by that wide and easy passage!" And my Guide [said] to him: "That is not your concern; it is his fate to enter every door. This has been willed where what is willed must be, and is not yours to question. Say no more." -Dante Alighieri _The Inferno_, 1321 Translated by John Ciardi Acknowledgments ---------------------------- Dedicated to all those who disseminate information, forbidden or otherwise. Also, I should note that a few of these entries are taken from "A Complete List of Hacker Slang and Other Things," Version 1C, by Casual, Bloodwing and Crusader; this doc started out as an unofficial update. However, I've updated, altered, expanded, re-written and otherwise torn apart the original document, so I'd be surprised if you could find any vestiges of the original file left. I think the list is very informative; it came out in 1990, though, which makes it somewhat outdated. I also got a lot of information from the works listed in my bibliography, (it's at the end, after all the quotes) as well as many miscellaneous back issues of such e-zines as _Cheap Truth _, _40Hex_, the _LOD/H Technical Journals_ and _Phrack Magazine_; and print magazines such as _Internet Underground_, _Macworld_, _Mondo 2000_, _Newsweek_, _2600: The Hacker Quarterly_, _U.S. News & World Report_, _Time_, and _Wired_; in addition to various people I've consulted.
    [Show full text]
  • Dictionary of Health Information Technology and Security
    DICTIONARY OF HEALTH INFORMATION TECHNOLOGY AND SECURITY Dr. David Edward Marcinko, MBA , CFP© Certifi ed Medical Planner© Editor-in-Chief Hope Rachel Hetico, RN, MSHA, CPHQ Certifi ed Medical Planner© Managing Editor NEW YORK 33021009_FM1.indd021009_FM1.indd i 003/17/20073/17/2007 116:48:506:48:50 Copyright © 2007 Springer Publishing Company, LLC All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmit- ted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior permission of Springer Publishing Company, LLC. Springer Publishing Company, LLC 11 West 42nd Street New York, NY 10036 www.springerpub.com Acquisitions Editor: Sheri W. Sussman Production Editor: Carol Cain Cover design: Mimi Flow Composition: Apex Publishing, LLC 07 08 09 10/ 5 4 3 2 1 Library of Congress Cataloging-in-Publication Data Dictionary of health information technology and security / David Edward Marcinko, editor-in-chief, Hope Rachel Hetico, managing editor. p. ; cm. Includes bibliographical references. ISBN-13: 978-0-8261-4995-4 (alk. paper) ISBN-10: 0-8261-4995-2 (alk. paper) 1. Medical informatics—Dictionaries. 2. Medicine—Information technology—Dictionaries. 3. Medical informatics—Security measures— Dictionaries. I. Marcinko, David E. (David Edward) II. Hetico, Hope R. [DNLM: 1. Informatics—Dictionary—English. 2. Medical Informatics— Dictionary—English. 3. Computer Communication Networks—Dictionary— English. 4. Computer Security—Dictionary—English. W 13 D557165 2007] R858.D53 2007 610.3—dc22 2007005879 Printed in the United States of America by RR Donnelley. 33021009_FM1.indd021009_FM1.indd iiii 003/17/20073/17/2007 116:48:516:48:51 Th e Dictionary of Health Information Technology and Security is dedicated to Edward Anthony Marcinko Sr., and Edward Anthony Marcinko Jr., of Fell’s Point, Maryland.
    [Show full text]
  • Flexible Infections: Computer Viruses, Human Bodies, Nation-States, Evolutionary Capitalism
    Science,Helmreich Technology, / Flexible Infections& Human Values Flexible Infections: Computer Viruses, Human Bodies, Nation-States, Evolutionary Capitalism Stefan Helmreich New York University This article analyzes computer security rhetoric, particularly in the United States, argu- ing that dominant cultural understandings of immunology, sexuality, legality, citizen- ship, and capitalism powerfully shape the way computer viruses are construed and com- bated. Drawing on popular and technical handbooks, articles, and Web sites, as well as on e-mail interviews with security professionals, the author explores how discussions of computer viruses lean on analogies from immunology and in the process often encode popular anxieties about AIDS. Computer security rhetoric about compromised networks also uses language reminiscent of that used to describe the “bodies” of nation-states under military threat from without and within. Such language portrays viruses using images of foreignness, illegality, and otherness. The security response to viruses advo- cates the virtues of the flexible and adaptive response—a rhetoric that depends on evolu- tionary language but also on the ideological idiom of advanced capitalism. As networked computing becomes increasingly essential to the operations of corporations, banks, government, the military, and academia, worries about computer security and about computer viruses are intensifying among the people who manage and use these networks. The end of the 1990s saw the emergence of a small industry dedicated to antivirus protection software, and one can now find on the World Wide Web a great deal of information about how viruses work, how they can be combated, and how computer users might keep up with ever-changing inventories and taxonomies of the latest viruses.
    [Show full text]
  • IBM X-Force Threat Insight Quarterly 2 X-Force Threat Insight Quarterly IBM Security Solutions
    IBM Security Solutions May 2011 IBM X-Force Threat Insight Quarterly 2 X-Force Threat Insight Quarterly IBM Security Solutions Contents About the report 2 About the Report The IBM X-Force® Threat Insight Quarterly is designed to highlight some of the most significant threats and challenges 3 Evolution: From Nuisance to Weapon facing security professionals today. This report is a product of IBM Managed Security Services and the IBM X-Force 8 Prolific and Impacting Issues of Q1 2011 research and development team. Each issue focuses on specific challenges and provides a recap of the most significant recent 16 References online threats. IBM Managed Security Services are designed to help an organization improve its information security, by outsourcing security operations or supplementing your existing security teams. The IBM protection on-demand platform helps deliver Managed Security Services and the expertise, knowledge and infrastructure an organization needs to secure its information assets from Internet attacks. The X-Force team provides the foundation for a preemptive approach to Internet security. The X-Force team is one of the best-known commercial security research groups in the world. This group of security experts researches and evaluates vulnerabilities and security issues, develops assessment and countermeasure technology for IBM security products, and educates the public about emerging Internet threats. We welcome your feedback. Questions or comments regarding the content of this report should be addressed to [email protected]. 3 X-Force Threat Insight Quarterly IBM Security Solutions Evolution: From Nuisance to Weapon One of the more notable examples here is Brain3, a boot sector infector which originated in Pakistan and released in 1986, was Creeper, Wabbit, Animal, Elk Cloner, Brain, Vienna, Lehigh, one of the first examples of malware that infected PC’s running Stoned, Jerusalem.
    [Show full text]
  • Virus Bulletin, July 91
    July 1991 ISSN 0956-9979 THE AUTHORITATIVE INTERNATIONAL PUBLICATION ON COMPUTER VIRUS PREVENTION, RECOGNITION AND REMOVAL Editor: Edward Wilding Technical Editor: Fridrik Skulason, University of Iceland Editorial Advisors: Jim Bates, Bates Associates, UK, Phil Crewe, Fingerprint, UK, David Ferbrache, ISIS Ltd., UK, Ray Glath, RG Software Inc., USA, Hans Gliss, Datenschutz Berater, West Germany, Ross M. Greenberg, Software Concepts Design, USA, Dr. Harold Joseph Highland, Compulit Microcomputer Security Evaluation Laboratory, USA, Dr. Jan Hruska, Sophos, UK, Dr. Keith Jackson, Walsham Contracts, UK, Owen Keane, Barrister, UK, John Laws, RSRE, UK, David T. Lindsay, Digital Equipment Corporation, UK, Yisrael Radai, Hebrew University of Jerusalem, Israel, Martin Samociuk, Network Security Management, UK, John Sherwood, Sherwood Associates, UK, Prof. Eugene Spafford, Purdue University, USA, Dr. Peter Tippett, Certus International Corporation, USA, Dr. Ken Wong, PA Consulting Group, UK, Ken van Wyk, CERT, USA. CONTENTS SCANNER UPDATE IBM Triumphs Amidst the ‘Vapourware’ 34 EDITORIAL 2 Results Table 35 TECHNICAL NOTES 3 TUTORIAL PRODUCT REVIEWS Fixed Disk Boot Sectors and 1. SafeWord Virus-Safe 36 Post-Attack Recovery 5 2. Knoxcard: Anti-Virus Hardware 38 Virus Bulletin Education, Training & Awareness Presentations 9 3. Trend Micro Devices’ PC-cillin 40 LETTERS SHAREWARE REVIEW VB Signatures With IBM’s Virscan 10 PC Virus Index 42 Vetting Procedure 10 KNOWN IBM PC VIRUSES 12 END-NOTES & NEWS 44 VIRUS BULLETIN ©1991 Virus Bulletin Ltd, 21 The Quadrant, Abingdon Science Park, Oxon, OX14 3YS, England. Tel (+44) 235 555139. /90/$0.00+2.50 This bulletin is available only to qualified subscribers. No part of this publication may be reproduced, stored in a retrieval system, or transmitted by any form or by any means, electronic, magnetic, optical or photocopying, without the prior written permission of the publishers.
    [Show full text]
  • LIBRARIES Building a Global Information Assurance Program.Pdf
    Building a Global Information Assurance Program OTHER AUERBACH PUBLICATIONS The ABCs of IP Addressing Information Security Management Gilbert Held Handbook, 4th Edition, Volume 4 ISBN: 0-8493-1144-6 Harold F. Tipton and Micki Krause, Editors The ABCs of TCP/IP ISBN: 0-8493-1518-2 Gilbert Held Information Security Policies, ISBN: 0-8493-1463-1 Procedures, and Standards: Building an Information Security Guidelines for Effective Information Awareness Program Security Management Mark B. Desman Thomas R. Peltier ISBN: 0-8493-0116-5 ISBN: 0-8493-1137-3 Building a Wireless Office Information Security Risk Analysis Gilbert Held Thomas R. Peltier ISBN: 0-8493-1271-X ISBN: 0-8493-0880-1 The Complete Book of Middleware A Practical Guide to Security Engineering Judith Myerson and Information Assurance ISBN: 0-8493-1272-8 Debra Herrmann ISBN: 0-8493-1163-2 Computer Telephony Integration, 2nd Edition The Privacy Papers: William A. Yarberry, Jr. Managing Technology and Consumers, ISBN: 0-8493-1438-0 Employee, and Legislative Action Rebecca Herold Cyber Crime Investigator’s Field Guide ISBN: 0-8493-1248-5 Bruce Middleton ISBN: 0-8493-1192-6 Secure Internet Practices: Best Practices for Securing Systems in Cyber Forensics: A Field Manual for the Internet and e-Business Age Collecting, Examining, and Preserving Patrick McBride, Jody Patilla, Evidence of Computer Crimes Craig Robinson, Peter Thermos, Albert J. Marcella and Robert S. Greenfield, and Edward P. Moser Editors ISBN: 0-8493-1239-6 ISBN: 0-8493-0955-7 Securing and Controlling Cisco Routers Global Information Warfare: Peter T. Davis How Businesses, Governments, and ISBN: 0-8493-1290-6 Others Achieve Objectives and Attain Competitive Advantages Securing E-Business Applications and Andy Jones, Gerald L.
    [Show full text]
  • The European Inter-University Association on Society, Science and DEVELOPING MALWARE
    ESST The European Inter-University Association on Society, Science and Technology DEVELOPING MALWARE - A SCOT ANALYSIS OF THE SUCCESS OF MALWARE Globalization, Innovation and Policy Erlend Flesjø First Semester University: University of Oslo Second Semester University: University of Oslo Word count: 21.309 2 2 3 Abstract Computer malware has drastically increased over the last 20 years and it shows no sign of slowing down. On the contrary, malware spreads like ever before causing more critical situations as well as threatening the entire online economy in the process. Despite of the critical threat malware represents governments and the anti-virus communities have not yet managed to get the upper hand in the fight against malware and their creators. This thesis analyzes the development of malware using the theory and methodology of Social Construction of Technology set forward by Bijker and Pinch. My empirical data is from relevant companies and organizations around Oslo and has been gathered from interviews. (Watchcom Security Group, Symantec Norway, international hackers and The National Criminal Investigation Service) My thesis traces the development of computer malware, looking at factors that have influenced the process and the power play between relevant social groups who wants to shape the development. It also highlights social and structural reasons why the government and the anti-virus industry have failed to contain malware. Keywords: SCOT, STS, malware, computer virus, botnet 3 4 4 5 Acknowledgements: I would like to thank the following persons for their help while writing this thesis. First and foremost, my supervisor Post. Doc. Beate Elvebakk, for her constructive feedback, good ideas and general helpful suggestions.
    [Show full text]
  • Virus Bulletin, August 1993
    August 1993 ISSN 0956-9979 THE AUTHORITATIVE INTERNATIONAL PUBLICATION ON COMPUTER VIRUS PREVENTION, RECOGNITION AND REMOVAL Editor: Richard Ford Technical Editor: Fridrik Skulason Consulting Editor: Edward Wilding, Network Security Management, UK Advisory Board: Jim Bates, Bates Associates, UK, David M. Chess, IBM Research, USA, Phil Crewe, Ziff-Davis, UK, David Ferbrache, Defence Research Agency, UK, Ray Glath, RG Software Inc., USA, Hans Gliss, Datenschutz Berater, West Germany, Igor Grebert, McAfee Associates, USA, Ross M. Greenberg, Software Concepts Design, USA, Dr. Harold Joseph Highland, Compulit Microcomputer Security Evaluation Laboratory, USA, Dr. Jan Hruska, Sophos, UK, Dr. Keith Jackson, Walsham Contracts, UK, Owen Keane, Barrister, UK, John Laws, Defence Research Agency, UK, Dr. Tony Pitt, Digital Equipment Corporation, UK, Yisrael Radai, Hebrew University of Jerusalem, Israel, Roger Riordan, Cybec Pty, Australia, Martin Samociuk, Network Security Management, UK, John Sherwood, Sherwood Associates, UK, Prof. Eugene Spafford, Purdue University, USA, Dr. Peter Tippett, Symantec Corporation, USA, Steve R. White, IBM Research, USA, Joseph Wells, Symantec Corporation, USA, Dr. Ken Wong, PA Consulting Group, UK, Ken van Wyk, CERT, USA. CONTENTS VIRUS ANALYSES 1. Daemaen: Multi-multipartism 9 EDITORIAL 2. 8888 - The Poor Man’s Commander Bomber 12 Crime and Punishment 2 ROGUES’ GALLERY VIRUS PREVALENCE TABLE 3 Keep It To Yourself 14 NEWS Storing Up Trouble 3 PRODUCT REVIEW 40Hex Print DAME Source code... 3 Better CPAV than CPAV? 16 Crown Wins Logic Bomb Case 3 COMPARATIVE REVIEW IBM PC VIRUSES (UPDATE) 4 OS/2 Virus Protection 20 INSIGHT Getting to the Point 7 END NOTES & NEWS 24 VIRUS BULLETIN ©1993 Virus Bulletin Ltd, 21 The Quadrant, Abingdon Science Park, Oxon, OX14 3YS, England.
    [Show full text]
  • COMPUTER VIRUS] 130 Questions Collections
    SEE COMPUTER SCIENCE 2074 [COMPUTER VIRUS] 130 Questions Collections Computer Virus Practice Questions Collections 2074 1 Computer Virus 130 Questions Collections Deepak Shrestha 74 1 | P a g e https://seeqbasicomputer.blogspot.com/ SEE COMPUTER SCIENCE 2074 [COMPUTER VIRUS] 130 Questions Collections 15 Theory Questions 1. What is computer virus? 2. List the types of computer virus? 3. What is boot sector virus? How can a boot sector virus harm the computer? 4. What is file infector virus? 5. What is multipartite virus? 6. What is stealth virus? 7. What is macro virus? 8. List any four symptoms of computer virus. 9. Give any four important points to keep our computer safe form virus. 10. List four ways how virus spread into the computer. 11. What is antivirus software? Give any four examples of antivirus software. 12. Who developed C-Brain Virus? What was the purpose of developing it? 13. List any four reasons for creating computer viruses. 14. Define computer worm and Trojan horse. 15. What is script virus? 1) What is computer virus? Ans: Computer virus is a program written by the programmer with the intention of destroying and damaging the data and programs residing in the computer system. 2) Write down the purpose of creating computer virus. Ans: The purpose of creating computer virus are: i) To stop computer piracy ii) To entertain user by displaying interesting message and pictures iii) To destroy data, information and files iv) To expose the programmers ability v) To earn money 3) How does a computer virus spread from one computer to another? Ans: A virus spreads from one computer to another by: i) Sharing infected internal portable disk like floppy disk, pen drive, CDs, etc.
    [Show full text]
  • Evolution of Cyber Security Invotra
    Evolution of cyber security Invotra Digital Workplace, Intranet and Extranet 700 bc Scytale used by Greece and Rome to send messages And kids ever since.. Image Source: https://commons.wikimedia.org/wiki/File:Skytale.png 1467 Alberti Cipher was impossible to break without knowledge of the method. This was because the frequency distribution of the letters was masked and frequency analysis - the only known technique for attacking ciphers at that time was no help. Image Source: https://commons.wikimedia.org/wiki/File:Alberti_cipher_disk.JPG 1797 The Jefferson disk, or wheel cypher as Thomas Jefferson named it, also known as the Bazeries Cylinder. It is a cipher system using a set of wheels or disks, each with the 26 letters of the alphabet arranged around their edge. Image Source: https://en.wikipedia.org/wiki/Jefferson_disk#/media/File:Jefferson%27s_disk_cipher.jpg 1833 Augusta Ada King-Noel, Countess of Lovelace was an English mathematician and writer, chiefly known for her work on Charles Babbage's proposed mechanical general-purpose computer, the Analytical Engine. She is widely seen as the world's first programmer Image Source: https://commons.wikimedia.org/wiki/File:Ada_Lovelace_portrait.jpg 1903 Magician and inventor Nevil Maskelyne interrupted John Ambrose Fleming's public demonstration of Marconi's purportedly secure wireless telegraphy technology. He sent insulting Morse code messages through the auditorium's projector. Image Source: https://en.wikipedia.org/wiki/Nevil_Maskelyne_(magician)#/media/File:Nevil_Maskelyne_circa_190 3.jpg 1918 The Enigma Machine. It was developed by Arthur Scherbius in 1918 and adopted by the German government and the nazi party Image Source: https://commons.wikimedia.org/wiki/File:Kriegsmarine_Enigma.png 1932 Polish cryptologists Marian Rejewski, Henryk Zygalski and Jerzy Różycki broke the Enigma machine code.
    [Show full text]
  • Guide to Computer Forensics and Investigations Fourth Edition
    Guide to Computer Forensics and Investigations Fourth Edition Chapter 6 Working with Windows and DOS Systems Objectives • Explain the purpose and structure of file systems • Describe Microsoft file structures • Explain the structure of New Technology File System (NTFS) disks • List some options for decrypting drives encrypted with whole disk encryption Guide to Computer Forensics and Investigations 2 Objectives (continued) • Explain how the Windows Registry works • Describe Microsoft startup tasks • Describe MS-DOS startup tasks • Explain the purpose of a virtual machine Guide to Computer Forensics and Investigations 3 Understanding File Systems • File system – Gives OS a road map to data on a disk • Type of file system an OS uses determines how data is stored on the disk • A file system is usually directly related to an OS • When you need to access a suspect’s computer to acquire or inspect data – You should be familiar with the computer’s platform Guide to Computer Forensics and Investigations 4 Understanding the Boot Sequence • Complementary Metal Oxide Semiconductor (CMOS) – Computer stores system configuration and date and time information in the CMOS • When power to the system is off • Basic Input/Output System (BIOS) – Contains programs that perform input and output at the hardware level Guide to Computer Forensics and Investigations 5 Understanding the Boot Sequence (continued) • Bootstrap process – Contained in ROM, tells the computer how to proceed – Displays the key or keys you press to open the CMOS setup screen • CMOS should
    [Show full text]
  • The Changing Face of INFOSEC Network World May-June 2001 M
    News from the Front 1 News from the Front: The Changing Face of INFOSEC Network World May-June 2001 M. E. Kabay, PhD, CISSP <[email protected]> Copyright 2001 M. E. Kabay. All rights reserved. Copyright © 2001 M. E. Kabay. All rights reserved. Network World: Changing Security Paradigms May-June 2001 M. E. Kabay, PhD, CISSP was at the time this talk was presented Security Leader, INFOSEC Group AtomicTangerine, Inc. Menlo Park, CA http://www.atomictangerine.com and is currently Associate Professor of Computer Information Systems Norwich University, Northfield, VT He can be reached by mail at 255 Flood Road Barre, VT 05641-4060 Telephone and voice mail: 802-479-7937 Copyright 8 2001 M. E. Kabay. Page 1 All rights reserved. News from the Front 2 Objectives z Review fundamental goals of INFOSEC z Raise awareness of key challenges z Examine defensive strategies z Review practical recommendations z Set common ground for vendor presentations Copyright © 2001 M. E. Kabay. All rights reserved. About Michel E. Kabay M. E. Kabay began learning assembler at age 15 and had learned FORTRAN IV G at McGill University by 1966. In 1976, he received his PhD from Dartmouth College in applied statistics and invertebrate zoology. Until 1979, he was a university professor in applied statistics. In 1979, he joined a compiler team for a new 4GL and RDBMS in the U.S., being responsible for developing the statistical syntax, writing the parser, error traps and code generation for statistical functions in the command language. Kabay joined Hewlett_Packard in 1980 and became a performance specialist, winning the Systems Engineer of the Year Award in 1982.
    [Show full text]