1. Introduction to Computer Forensics
FALL 2007

2. (Sammes and Jenkinson 2000)
The fundamental concern of forensic computing activity is for the accurate extraction of INFORMATION from computer-based systems, such that it may be presented as admissible evidence in court
(Sammes and Jenkinson 2000)

3. What is Information?
Liebenau and Backhouse (1990), Understanding Information:
“Numerous definitions have been proposed for the term ‘information’, and most of them serve well the narrow interests of those defining it.”
“These definitions are all problematic”

4. What is Information?
Liebenau and Backhouse (1990), Understanding Information:
“…information cannot exist independently of the receiving person who gives it meaning and somehow acts upon it. That action usually includes analysis or at least interpretation, and the differences between data and information must be preserved, at least in so far the information is data arranged in meaningful way to some perceived purpose ”

5. Computer system holds data.
Any information that we (the receiving persons) may extract from this data is a result of our analysis or interpretation of it in some meaningful way for some perceived purposes.
We have to have a set of interpretative rules which we apply to the data in order to extract the information. (Sammes and Jenkinson 2000)

6. Computer Electronic device Accepts data - input
Processes it according to a given set of instructions
Produces results - output
input
output
Computer

7. Input, Output, Computer Program
Input – unprocessed data manipulated by the computer
Output – processed information or results produced by the computer
The set of instructions
that the computer follows
is called a computer program

8. Computer System hardware the physical equipment used to process a data
software
computer programs

9. Hardware
CPU
010
111
.....
Main
Memory
Secondary
I/O Devices

10. Hardware
Main
Memory
Input
Devices
Output
Devices
CPU

11. Input/Output Devices Input devices keyboard, mouse
enter data and programs into
the computer
Output devices
printer, monitor
display the results processed
by the computer

12. Memory Bit - Binary Digit Byte = 8 bits
Main Memory
Nonpermanent
Rapid Access
Low Capacity
Secondary Storage
Permanent
Non Rapid
High Capacity
Bit - Binary Digit
Byte = 8 bits
KB = KiloBytes = 1024 bytes =210
MB = MegaBytes = 1,048,576 bytes = 220
GB = GigaBytes = 230 bytes

13. CPU – Central Processing Unit
Control Unit
Directs the processing operations
Coordinates the flow of data to Main Memory and ALU
Arithmetic Logic Unit (ALU)
performs
Arithmetic operations
Logic operations

14. Software Operating Systems Application Software DOS UNIX Windows Word
Power Point
Emacs, Pico

15. References
Liebenau, J. and Backhouse, J. (1990) Understanding information : an introduction. London, Macmillan
Tony Sammes and Brian Jenkinson (2000), Forensic Computing: A Practitioner's Guide, Springer Verlag