1. Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Review for the Final Exam December 8, 2008

2. How are you doing in class so far? l Based on mid-term exams and the assignments everyone is doing very well in class – please see your mid-term grade l Please keep up with good work until the final grade

3. Overview of Course Work l Two exams each worth 16 points - Mid-term (done) and Final exams (December 12) l Programming project worth 16 points - Due date; December 12th l Four homework assignments worth 10 points each - All assignments completed by December 8th l Term paper (12 points – by December 8 th ) l Total 100 points l Extra credit – Encase project – 10 points

4. Final Exam Tips l Answer 6 out of 9 questions (maybe 7 out of 10) l Network Forensics – 2 questions - Based on the lectures and the book chapter l Email, application Forensics – 1 question, based on lectures and book chapter l Military Forensics – 1 question, lecture notes l Expert witness and report writing – 1 question – based on book chapters and lectures l Rest of the questions (4-5 l questions) on the papers we have discussed in class - Papers will be listed in the next page l Extra credit question, from the additional papers listed in page after next

5. Key Papers to Read for the Final Exam l Iowa State Paper - https://www.dfrws.org/2005/proceedings/wang_evidencegraphs.pdf https://www.dfrws.org/2005/proceedings/wang_evidencegraphs.pdf l FORZA – Digital forensics investigation framework that incorporate legal issues - http://dfrws.org/2006/proceedings/4-Ieong.pdf http://dfrws.org/2006/proceedings/4-Ieong.pdf l A cyber forensics ontology: Creating a new approach to studying cyber forensics - http://dfrws.org/2006/proceedings/5-Brinson.pdf http://dfrws.org/2006/proceedings/5-Brinson.pdf l Arriving at an anti-forensics consensus: Examining how to define and control the anti-forensics problem - http://dfrws.org/2006/proceedings/6-Harris.pdf http://dfrws.org/2006/proceedings/6-Harris.pdf l Forensic feature extraction and cross-drive analysis - http://dfrws.org/2006/proceedings/10-Garfinkel.pdf http://dfrws.org/2006/proceedings/10-Garfinkel.pdf l A correlation method for establishing provenance of timestamps in digital evidence - http://dfrws.org/2006/proceedings/13-%20Schatz.pdf http://dfrws.org/2006/proceedings/13-%20Schatz.pdf

6. Following Papers will be included as Extra credit questions Cyber Forensics: a Military Perspective https://www.utica.edu/academic/institutes/ecii/publications/articles/A04843F3- 99E5-632B-FF420389C0633B1B.pdf How to Reuse Knowledge about Forensic Investigations Danilo Bruschi, Mattia Monga, Universit`a degli Studi di Milano http://dfrws.org/2004/day3/D3-Martignoni_Knowledge_reuse.pdf John Lowry, BBN Systems: Adversary Modeling to Develop Forensic Observables http://dfrws.org/2004/day2/Adversary_Modeling_to_Develop_Forensic_Observa bles.pdf Dr. Golden G. Richard III, University of New Orleans, New Orleans, LA: Breaking the Performance Wall: The Case for Distributed Digital Forensics http://dfrws.org/2004/day2/Golden-Perfromance.pdf

7. Project l Project description l Software modules (prefer diagram) and description l Results l Analysis l Future improvements l References

8. My Office Hours before exam l I will be at work on Tuesday and Friday if I am not called for Jury duty l Tuesday afternoon (3-4pm) and Friday morning (10-11am) – December 9, 12 th l I will be in my office December 23 rd from 11am – 12 noon l You can send me email