The Forensic Process Analysis of Mobile Device
Total Page:16
File Type:pdf, Size:1020Kb

Load more
Recommended publications
-
Part 1 Digital Forensics Module Jaap Van Ginkel Silvio Oertli
Part 1 Digital Forensics Module Jaap van Ginkel Silvio Oertli July 2016 Agenda • Part 1: Introduction – Definitions / Processes • Part 2: Theory in Practice – From planning to presentation • Part 3: Live Forensics – How to acquire a memory image – Investigate the image • Part 4: Advanced Topics – Tools – Where to go from here – And more 2 Disclaimer§ • A one or two-day course on forensics will not make you a forensics expert. – Professionals spend most of their working time performing forensic analysis and thus become an expert. • All we can offer is to shed some light on a quickly developing and broad field and a chance to look at some tools. • We will mostly cover Open Source Forensic Tools. 3 Introduction Forensics in History 4 Forensics – History 2000 BC 1200 BC 5 Introduction Definitions / Processes 6 Forensics – The Field digital forensics Computer Forensics Disk Forensics Mobil Forensics Memory Forensics Datenbase Forensics Live Forensics Network Forensics 7 Forensics - Definition • Digital Forensics [1]: – Digital forensics (sometimes known as digital forensic science) is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime. • Computer Forensics [2]: – Computer forensics (sometimes known as computer forensic science) is a branch of digital forensic science pertaining to legal evidence found in computers and digital storage media. The goal of computer forensics is to examine digital media in a forensically sound manner with the aim of identifying, preserving, recovering, analyzing and presenting facts and opinions about the information. 8 Forensics - Definitions • Network Forensics [3]: – Network forensics is a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection.[1] Unlike other areas of digital forensics, network investigations deal with volatile and dynamic information. -
Guidelines on Mobile Device Forensics
NIST Special Publication 800-101 Revision 1 Guidelines on Mobile Device Forensics Rick Ayers Sam Brothers Wayne Jansen http://dx.doi.org/10.6028/NIST.SP.800-101r1 NIST Special Publication 800-101 Revision 1 Guidelines on Mobile Device Forensics Rick Ayers Software and Systems Division Information Technology Laboratory Sam Brothers U.S. Customs and Border Protection Department of Homeland Security Springfield, VA Wayne Jansen Booz-Allen-Hamilton McLean, VA http://dx.doi.org/10.6028/NIST.SP. 800-101r1 May 2014 U.S. Department of Commerce Penny Pritzker, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. § 3541 et seq., Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in Circular A- 130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in Circular A- 130, Appendix III, Security of Federal Automated Information Resources. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority. -
Guidelines on Mobile Device Forensics
NIST Special Publication 800-101 Revision 1 Guidelines on Mobile Device Forensics Rick Ayers Sam Brothers Wayne Jansen http://dx.doi.org/10.6028/NIST.SP.800-101r1 NIST Special Publication 800-101 Revision 1 Guidelines on Mobile Device Forensics Rick Ayers Software and Systems Division Information Technology Laboratory Sam Brothers U.S. Customs and Border Protection Department of Homeland Security Springfield, VA Wayne Jansen Booz Allen Hamilton McLean, VA http://dx.doi.org/10.6028/NIST.SP. 800-101r1 May 2014 U.S. Department of Commerce Penny Pritzker, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. § 3541 et seq., Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in Circular A- 130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in Circular A- 130, Appendix III, Security of Federal Automated Information Resources. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority. -
Digital Forensics Based Analysis of Mobile Phones
Journal of Android and IOS Applications and Testing Volume 4 Issue 3 Digital Forensics Based Analysis of Mobile Phones Pooja V Chavan PG Student, Department of Computer Engineering, K. J. Somaiya College of Engineering, Mumbai, Maharashtra, India Email: [email protected] DOI: Abstract Now-a-day’s ratio of mobile phone is increasing day by day. Digital forensics methodology is use to recover and investigate data that found in a digital devices. Mobile phone usage is more that’s why not only judicial events occurred but also mobile forensics and subdivision of digital forensics are emerged. Some hardware and software are used for mobile phone investigations. Keywords: Digital forensics, digital devices, mobile phone INTRODUCTION because electronic device have a variety of Forensic science’s subdivision is a digital different operating system, technology, forensic, is a one type of process. The storage structure, Features. First identify main objective of this process to find the crime after that digital forensic work evidence in digital devices [1]. Digital on four important steps (Figure 1): forensics are used for the analysis of data, such as audio, video, pictures, etc. After • Collection: The collected of evidence the analysis of electronic devices data that like fingerprints, broken fingernails help for legal process. The usage of blood and body fluids. advanced technology is increasing rapidly. • Examination: The examination of Electronic device have a variety of product process is depending on evidence. like tablet, flash memory, memory card, • Analysis: The crime scenes obtain SD card, etc. When forensic analysis is different digital evidence, analysis is performed at that time data should be done on storage evidence this secure. -
Hacking Exposed Computer Forensics, Second Edition, Delivers the Most Valuable Insight on the Market
HACKING EXPOSED™ COMPUTER FORENSICS SECOND EDITION REVIEWS “This book provides the right mix of practical how-to knowledge in a straightforward, informative fashion that ties all the complex pieces together with real-world case studies. With so many books on the topic of computer forensics, Hacking Exposed Computer Forensics, Second Edition, delivers the most valuable insight on the market. The authors cut to the chase of what people must understand to effectively perform computer forensic investigations.” —Brian H. Karney, COO, AccessData Corporation “Hacking Exposed Computer Forensics is a ‘must-read’ for information security professionals who want to develop their knowledge of computer forensics.” —Jason Fruge, Director of Consulting Services, Fishnet Security 00-FM.indd i 8/23/2009 3:54:42 AM “Computer forensics has become increasingly important to modern incident responders attempting to defend our digital castles. Hacking Exposed Computer Forensics, Second Edition, picks up where the first edition left off and provides a valuable reference, useful to both beginning and seasoned forensic professionals. I picked up several new tricks from this book, which I am already putting to use.” —Monty McDougal, Raytheon Information Security Solutions, and author of the Windows Forensic Toolchest (WFT) (www.foolmoon.net) “Hacking Exposed Computer Forensics, Second Edition, is an essential reference for both new and seasoned investigators. The second edition continues to provide valuable information in a format that is easy to understand and reference.” —Sean Conover, CISSP, CCE, EnCE “This book is an outstanding point of reference for computer forensics and certainly a must-have addition to your forensic arsenal.” —Brandon Foley, Manager of Enterprise IT Security, Harrah’s Operating Co. -
About the AAFS
American Academy of Forensic Sciences 410 North 21st Street Colorado Springs, Colorado 80904 Phone: (719) 636-1100 Email: [email protected] Website: www.aafs.org @ AAFS Publication 20-2 Copyright © 2020 American Academy of Forensic Sciences Printed in the United States of America Publication Printers, Inc., Denver, CO Typography by Kathy Howard Cover Art by My Creative Condition, Colorado Springs, CO WELCOME LETTER Dear Attendees, It is my high honor and distinct privilege to welcome you to the 72nd AAFS Annual Scientific Meeting in Anaheim, California. I would like to thank the AAFS staff, the many volunteers, and everyone else who have worked together to create an excellent program for this meeting with the theme Crossing Borders. You will have many opportunities to meet your colleagues and discuss new challenges in the field. There are many workshops and special sessions that will be presented. The Interdisciplinary and Plenary Sessions will provide different views in forensic science—past, present, and future. The Young Forensic Scientists Forum will celebrate its 25th Anniversary and is conducting a workshop related to the meeting theme. More than 1,000 presentations are scheduled that will provide you with more insight into the developments in forensic science. The exhibit hall, always interesting to explore, is where you will see the latest forensic science equipment, technology, and literature. The theme Crossing Borders was chosen by me and my colleagues at the Netherlands Forensic Institute (NFI). We see many definitions of crossing borders in forensic science today. For the 2020 meeting, six words starting with the letters “IN” are included in the theme. -
Purpose of Computer and Network Forensics
Purpose of Computer and Network Forensics Table of Contents Purpose of Computer and Network Forensics ................................................................................ 2 What Is Digital Forensics? ............................................................................................................... 3 Need for Digital Forensics -1 ........................................................................................................... 4 Need for Digital Forensics -2 ........................................................................................................... 6 Purpose of Digital Forensics ............................................................................................................ 8 Notices .......................................................................................................................................... 12 Page 1 of 12 Purpose of Computer and Network Forensics Purpose of Computer and Network Forensics 4 **004 Okay. So we'll start out with the purpose of computer and network forensics. Page 2 of 12 What Is Digital Forensics? What Is Digital Forensics? As defined in NIST Guide to Integrating Forensic Techniques into Incident Response: “Application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data” Also known as or called computer forensics and network forensics, and includes mobile device forensics All better called one term: Digital -
Winter 2016 E-Newsletter
WINTER 2016 E-NEWSLETTER At Digital Mountain we assist our clients with their e-discovery, computer forensics and cybersecurity needs. With increasing encryption usage and the recent news of the government requesting Apple to provide "backdoor" access to iPhones, we chose to theme this E-Newsletter on the impact data encryption has on attorneys, litigation support professionals and investigators. THE SHIFTING LANDSCAPE OF DATA ENCRYPTION TrueCrypt, a free on-the-fly full disk encryption product, was the primary cross-platform solution for practitioners in the electronic discovery and computer forensics sector. Trusted and widely adopted, TrueCrypt’s flexibility to perform either full disk encryption or encrypt a volume on a hard drive was an attractive feature. When TrueCrypt encrypted a volume, a container was created to add files for encryption. As soon as the drive was unmounted, the data was protected. The ability to add a volume to the original container, where any files or the folder structure could be hidden within an encrypted volume, provided an additional benefit to TrueCrypt users. However, that all changed in May 2014 when the anonymous team that developed TrueCrypt decided to retire support for TrueCrypt. The timing of TrueCrypt’s retirement is most often credited to Microsoft’s ending support of Windows XP. The TrueCrypt team warned users that without support for Windows XP, TrueCrypt was vulnerable. Once support for TrueCrypt stopped, trust continued to erode as independent security audits uncovered specific security flaws. In the wake of TrueCrypt’s demise, people were forced to look for other encryption solutions. TrueCrypt’s website offered instructions for users to migrate to BitLocker, a full disk encryption program available in certain editions of Microsoft operating systems beginning with Windows Vista. -
Truecrypt Containers Is No Longer Hidden As Passware Kit Now Detects Hard Disk Images
Contact: Nataly Koukoushkina Passware Inc. +1 (650) 472-3716 ext. 101 [email protected] Data Inside TrueCrypt Containers is No Longer Hidden as Passware Kit Now Detects Hard Disk Images The new Passware Kit scans computers and finds all encrypted containers and hard disk images, such as TrueCrypt, BitLocker, and PGP Mountain View, Calif. (May 20, 2013) – Passware, Inc., a provider of password recovery, decryption, and electronic evidence discovery software for computer forensics, law enforcement organizations, government agencies, and private investigators, announces that Passware Kit Forensic v.12.5 can now recognize hard disk images and containers, such as TrueCrypt, BitLocker, PGP, etc. during a computer scan. For a computer forensic professional this means that no evidence is hidden inside a volume. During a computer scan, which typically takes less than an hour, Passware Kit Forensic displays all encrypted files and hard disk partition images. Previously, there was no way to identify quickly an encrypted container on a file system where important data could be hidden. “One of the major obstacles in any digital investigation is the ability to examine the contents of password-protected files and hard disks,” said Dmitry Sumin, CEO of Passware, Inc. “Today more than ever, digital evidence plays an important role in many criminal investigations and Passware is often the password recovery and decryption software of choice. We allow computer forensic professionals to conduct a thorough investigation by easily identifying, detecting, and decrypting hidden files. The latest version of Passware Kit Forensic extends the success of such investigations with the ability to find all encrypted volumes on a suspect’s computer.” The latest release of Passware Kit Forensic now ensures that no evidence is hidden, as it provides users with a list of all encrypted containers, hard disk partition images, and files that look similar to containers. -
Computer Forensics: Is It the Next Hot IT Subject? Victor G
Proceedings of the 2005 ASCUE Conference, www.ascue.org June 12-16, 2005, Myrtle Beach, South Carolina Computer Forensics: Is it the Next Hot IT Subject? Victor G. Williams School of Information Technology American InterContinental University [email protected] Ken Revels Department Chair (Information Technology) School of Continuing Studies Mercer University 1400 Coleman Ave Macon, GA 31207 Introduction Digital Forensics is not just the recovery of data or information from computer systems and their networks. It is not a procedure that can be accomplished by software alone, and most important, it is not something that can be accomplished by other than a trained IT forensic professional. Digital Forensics is an emerging science and was developed by U.S. federal law enforcement agency during the mid to late 1980s. It is also the art of detecting, processing, and examining digital fingerprints. A Formal Definition of Computer Forensics: · The gathering and analysis of digital information in an authentic, accurate and complete form for presentation as evidence in a civil proceeding or a court of law. · The term digital evidence encompasses any and all digital data that can establish that a crime has been committed or can provide a link between a crime and its victim or a crime and its perpetrator Computer Forensics Overview Computer Forensics is the application of computer examination and analysis techniques in the interests of determining potential legal evidence. Evidence might be sought in a wide range of computer crimes or misuse, including but not limited to theft of trade secrets, theft of or destruc- tion of intellectual property, and fraud, child pornography, disputes of ownership, prevention of destruction of evidence, etc. -
Graduate Prospectus2014 Institute of Space Technology
Graduate Prospectus2014 Institute of Space Technology we HELP YOU ACHIEVE YOUR AMBITIONS P R O S P E C T U S 2 141 INSTITUTE OF SPACE TECHNOLOGY w w w . i s t . e d u . p k To foster intellectual and economic vitality through teaching, research and outreach in the field of Space Science & Technology with a view to improve quality of life. www.ist.edu.pk 2 141 P R O S P E C T U S INSTITUTE OF SPACE TECHNOLOGY CONTENTS Welcome 03 Location 04 Introduction 08 The Institute 09 Facilities 11 Extra Curricular Activities 11 Academic Programs 15 Department of Aeronautics and Astronautics 20 Local MS Programs 22 Linked Programs with Beihang University 31 Linked Programs with Northwestern Polytechnic University 49 Department of Electrical Engineering 51 Local MS Programs 53 Linked Programs with University of Surrey 55 Department of Materials Science & Engineering 72 Department of Mechanical Engineering 81 Department of Remote Sensing & Geo-information Science 100 w w w . i s t . e d u . p k Department of Space Science 106 ORIC 123 Admissions 125 Fee Structure 127 Academic Regulations 130 Faculty 133 Administration 143 Location Map 145 1 20 P R O S P E C T U S 2 141 INSTITUTE OF SPACE TECHNOLOGY w w w . i s t . e d u . p k 2 141 P R O S P E C T U S INSTITUTE OF SPACE TECHNOLOGY Welcome Message Vice Chancellor The Institute of Space Technology welcomes all the students who aspire to enhance their knowledge and specialize in cutting edge technologies. -
Comparing Two Tools for Mobile-Device Forensics
NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS COMPARING TWO TOOLS FOR MOBILE-DEVICE FORENSICS by Casandra M. Martin September 2016 Thesis Advisor: Neil C. Rowe Second Reader: Approved for public release. Distribution is unlimited. THIS PAGE INTENTIONALLY LEFT BLANK REPORT DOCUMENTATION PAGE Form Approved OMB No. 0704–0188 Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202–4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington DC 20503. 1. AGENCY USE ONLY (Leave Blank) 2. REPORT DATE 3. REPORT TYPE AND DATES COVERED September 2016 Master’s Thesis 09-20-2015 to 09-23-2016 4. TITLE AND SUBTITLE 5. FUNDING NUMBERS COMPARING TWO TOOLS FOR MOBILE-DEVICE FORENSICS 6. AUTHOR(S) Casandra M. Martin 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION REPORT NUMBER Naval Postgraduate School Monterey, CA 93943 9. SPONSORING / MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING / MONITORING AGENCY REPORT NUMBER N/A 11. SUPPLEMENTARY NOTES The views expressed in this document are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. Government.