By: Jeremy Henry. Road Map  What is a cybercrime?  Statistics.  Tools used by an investigator.  Techniques and procedures used.  Specific case.

Slides:

Advertisements

Similar presentations

Gathering digital evidence by the EU Commission in inspections

Advertisements

Albrecht, Albrecht, Albrecht, Zimbelman © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except.

Computer Forensics By: Stephanie DeRoche Benjamin K. Ertley.

Chapter Extension 24 Computer Crime and Forensics © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke.

An Introduction to Computer Forensics James L. Antonakos Professor Computer Science Department.

Guide to Computer Forensics and Investigations, Second Edition

Teaching Computer Forensics Using Student Developed Evidence Files Anna Carlin Cal Poly Pomona.

MD5 Summary and Computer Examination Process Introduction to Computer Forensics.

Computer Forensics 101 Essential Knowledge for 21 st Century Investigators with Case Studies Presented by Steve Abrams, M.S. Abrams Computer Forensics.

Guide to Computer Forensics and Investigations Fourth Edition

Guide to Computer Forensics and Investigations Fourth Edition

Computer Forensics Principles and Practices

COS/PSA 413 Day 3. Agenda Questions? Blackboard access? Assignment 1 due September 3:35PM –Hands-On Project 1-2 and 2-2 on page 26 of the text Finish.

COS/PSA 413 Day 5. Agenda Questions? Assignment 2 Redo –Due September 3:35 PM Assignment 3 posted –Due September 3:35 PM Quiz 1 on September.

Computer Forensics What is Computer Forensics? What is the importance of Computer Forensics? What do Computer Forensics specialists do? Applications of.

COEN 252 Computer Forensics Forensic Duplication of Hard Drives.

COEN 252 Computer Forensics

Guide to Computer Forensics and Investigations, Second Edition

Passwords, Encryption Forensic Tools

CYBER FORENSICS PRESENTER: JACO VENTER. CYBER FORENSICS - AGENDA Dealing with electronic evidence – Non or Cyber Experts Forensic Imaging / Forensic Application.

Image Source: thecomputerforensics.info.  DAY ONE (Monday) › Lecture and TWO activities  Activity One : Who are you?  Activity Two : Digital Forensic.

Digital Forensics Survey of Information Assurance.

Guide to Computer Forensics and Investigations, Second Edition Chapter 2 Understanding Computer Investigation.

Teaching Digital Forensics w/Virtuals By Amelia Phillips.

1. Introduction.

Chapter 9 Computer Forensics Analysis and Validation Guide to Computer Forensics and Investigations Fourth Edition.

Preserving Evidence ● Number one priority ● Must also find incriminating evidence ● Must search the contents of the hard drive ● Can not change the hard.

Data Recovery Techniques Florida State University CIS 4360 – Computer Security Fall 2006 December 6, 2006 Matthew Alberti Horacesio Carmichael.

Computer Forensics Principles and Practices

An Introduction to Computer Forensics Jim Lindsey Western Kentucky University.

© 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. System Forensics, Investigation, and Response.

1 IT Investigative Tools Tools and Services for the Forensic Auditor.

Guide to Computer Forensics and Investigations Fourth Edition

Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #4 Data Acquisition September 8, 2008.

Forensic Procedures 1. Assess the situation and understand what type of incident or crime is to be investigated. 2. Obtain senior management approval to.

Computers Computer & Internet Security How Computer Forensics Works What is the Year 2038 problem? Could hackers devastate the U.S. economy?

Evidence Handling If the evidence is there the case is yours to lose.

An Introduction to Computer Forensics Jim Lindsey Western Kentucky University September 28, 2007.

MD5 Summary and Computer Examination Process Introduction to Computer Forensics.

Chapter 2 Understanding Computer Investigations Guide to Computer Forensics and Investigations Fourth Edition.

Chapter 5 Processing Crime and Incident Scenes Guide to Computer Forensics and Investigations Fourth Edition.

CJ 317 – Computer Forensics

 Forensics  Application of scientific knowledge to a problem  Computer Forensics  Application of the scientific method in reconstructing a sequence.

Computer Forensics Presented By:  Anam Sattar  Anum Ijaz  Tayyaba Shaffqat  Daniyal Qadeer Butt  Usman Rashid.

Forensics Jeff Wang Code Mentor: John Zhu (IT Support)

COEN 252 Computer Forensics Forensic Duplication of Hard Drives.

Computer Forensics Kelsey Bretz. Overview Introduction What happens when a file is deleted Typical Computer Forensic Investigations Who uses Computer.

Computer Forensics By Chris Brown. Computer Forensics Defined Applying computer science to aid in the legal process Utilization of predefined set of procedures.

Computer Forensics Troy Blough Harrison Andrus-Edens.

Chapter 11 Analysis Methodology Spring Incident Response & Computer Forensics.

By: Tom Maloney. Overview What is ProDiscover What it can be used for A few quick tools A real example ProDiscover vs. ENCASE ProDiscover IR Applications.

Case Brief Gregory Morton William Campbell Dave Wildner.

Computer Forensics. OVERVIEW OF SEMINAR Introduction Introduction Defining Cyber Crime Defining Cyber Crime Cyber Crime Cyber Crime Cyber Crime As Global.

By Jason Swoyer.  Computer forensics is a branch of forensic science pertaining to legal evidence found in computers and digital storage mediums.  Computer.

Digital Forensics Ryan Lord. Road Map - What is Digital Forensics? - Types of computer crimes - Tools - Procedures - Cases - Problems.

Digital Forensics and Hand Held Devices Robert Trimble COSC

Introduction to Computer Forensics Fall Computer Crime Computer crime is any criminal offense, activity or issue that involves computers (

By: Tom Maloney. Overview What is ProDiscover What it can be used for A few quick tools A real example ProDiscover vs. ENCASE ProDiscover IR Applications.

Internet Vulnerabilities & Criminal Activity Internet Forensics 12.1 April 26, 2010 Internet Forensics 12.1 April 26, 2010.

Creighton Barrett Dalhousie University Archives

Computer Forensics By: Chris Rozic.

Presented by Steve Abrams, M.S. Charleston, SC / Long Island, NY

Guide to Computer Forensics and Investigations Fifth Edition

CHFI & Digital Forensics [Part.1] - Basics & FTK Imager

Digital Forensics Ryan Lord.

Tuesday April 17, 2018 (Discussion – Dennis Rader; Input to Output – How Does the Computer Work?)

Digital Forensics Chris Rozic.

Fourth Amendment: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall.

Guide to Computer Forensics and Investigations Fourth Edition

Ad Hoc Phase Structured Phase Enterprise Phase

Presentation transcript:

By: Jeremy Henry

Road Map  What is a cybercrime?  Statistics.  Tools used by an investigator.  Techniques and procedures used.  Specific case.

What is a cybercrime? Includes: ○ Illegally downloading software. ○ Identity theft. ○ Creating and distributing viruses. ○ Many more…  In general, a cybercrime is any criminal activity done with the aid of computers and/or the internet.

Statistics  FBI’s survey of 2,066 organizations over a 12 month period. 64% suffered financial loss. Average cost per company was $24,000. Computer-related crimes cost U.S. businesses around $67 billion a year.  Records, chronologically, all “reported” data breaches in the U.S. since April 20, ,234,229 records breached - Feb. 24, 2013.

Procedures and Techniques  Investigations are performed on static data, disk images, rather than the “live” systems. Early investigators lacked the specific tools to create the images and were forced to work with the live data.  Before an image is made of the system, a write blocker must be used.

Procedures and Techniques cont.  Legally seizing computer evidence: Computer evidence is like any other evidence in that it must follow certain rules to be admissible in court and therefore must be legally obtained.  To pull the plug or not? Classic forensics teaches to pull it.  The desktop or laptop computers are not the only form of evidence these days.

Tools: EnCase  Designed for forensic use and e-discovery.  Creates forensic images of the media which is stored in EnCase Evidence File Format.  The compressed file is prefixed with the case data information and consists of a bit-by-bit copy of the media.  The MD5 hash can be used to verify that the meta data has not been altered in any way.  EnCase has been used successfully in various court systems around the world, including the case of the BTK Killer.

Tools: Forensic Toolkit (FTK)  FTK is a computer forensic software which scans a hard drive for data such as deleted s.  It can scan the disk for text strings and use them as a dictionary to crack encryption that may be used.  Includes a standalone disk imaging program, FTK Imager, which creates an image of a disk that can be reconstructed. The FTK Imager uses MD5 hash values which confirms the integrity of the data.

Specific Case: BTK Killer( )  BTK (Bind, Torture, Kill) was his infamous signature.  Sent letters describing, in detail, his murders to the police.  Sent a floppy disk with details about a murder.  Police found meta data embedded in a deleted MS Word document which contained “Christ Lutheran Church” and was created by a “Dennis”.  After a quick internet search for “Lutheran Church Wichita Dennis”, police found he belonged to the church.  The forensic software, EnCase was used to recover and analyze the meta data.

Conclusion  Defined cybercrime as any criminal act done with the aid of a computer.  What some of the techniques and procedures are of digital forensics and how they may have changed from previous techniques.  Two tools used by digital examiners. EnCase and FTK.  The BTK Killer.

References  billion,-FBI-says/ _ html billion,-FBI-says/ _ html   advancesdf-5 advancesdf-5  _as_evidence _as_evidence   html html  hardware-vs-software/ hardware-vs-software/