Note-12 - CSE 494/598 Forensic Computing Computer and...

Info icon This preview shows pages 1–6. Sign up to view the full content.

View Full Document Right Arrow Icon
CSE 494/598 Forensic Computing: Computer and Network Forensics Prof. Gail-Joon Ahn Cyber Gazette ! Cyber Robots (Cybots) patrol government networks ! CNET News ! From Darin Tupper ! CODEGATE 2009 ! Hacking Protection Contest
Image of page 1

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full Document Right Arrow Icon
IMPORTANT DATES ! Exam #1: Feb 19, 2009 ! Assignment #1: Mar 3, 2009 ! Spring Break: Mar 10 & 12, 2009 ! Exam #2: Mar 31, 2009 ! Class Project Due: Apr 23, 2009 ! Paper Report Due: Apr 28, 2009 ! Class Presentation: Apr 28 & 30, 2009 May 5, 2009 ! Exam #3 (Final): May 7, 2009 (12:10PM – 2:00PM) 3 Paper Presentation ! April 28 th ! Group : Ho An and FengzeXie ! Group : Terrance Cuny and FarooqKhera ! April 30th ! Group : Fei Hong and SanketSheth ! Group : PradeepSekar and Deepak Barge ! May 5th ! Group : Joseph Schneider and Darin Tupper
Image of page 2
Papers and Project/Assignment #2 ! Will be posted by tomorrow morning (March 6) ! Total 5 papers ! Each paper will be assigned to four groups including the group who would present the paper ! Project/Assignment #2 will be discussed on Tuesday, March 17 ! Guest lecture (Mr. Scott Banks, March 26) 6 Outline ! File Forensics ! Storage Media Analysis ! Volume Analysis ! File System Analysis ! Heuristic and Systematic ! Microsoft File Structures " FAT and NTFS
Image of page 3

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full Document Right Arrow Icon
File System Analysis: File Allocation Table F1 F2 F3 File.txt Cluster 34 Cluster 35 Clusters FAT Structure 35 36 EOF Reserved area FAT area Data area Physical Layout of a FAT file system 33 34 35 36 37 F1 F2 F3 34 35 36 37 File System Analysis: FAT Structure ! Need to discover the allocation status of a cluster and find the next allocated cluster in a file or directory 0000288: 4900 0000 4a00 0000 4c00 0000 0000 0000 0000304: 4d00 0000 ffffff 0 f 4f00 0000 ffffff 0 f 0000320: 5100 0000 5200 0000 ffffff 0 fffffff 0 f 0000336: ffffff 0 f 0000 0000 0000 0000 0000 0000 0000352: 0000 0000 0000 0000 0000 0000 0000 0000 FAT Offset 16 bytes of the data in hexadecimal Examining FAT 32 structure of a sample image--first sector following the reserved area:
Image of page 4
File System Analysis: FAT Structure – Directory Entry ! Extract the unallocated space ! Search for the signature for a directory “ . ” ! In other words, ASCII values for “.[][][]” (0x2e202020 four bytes only ) directory entry that starts a directory 0000000: 2e20 2020 2020 2020 2020 2010 0037 5daf . ..
Image of page 5

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full Document Right Arrow Icon
Image of page 6
This is the end of the preview. Sign up to access the rest of the document.

{[ snackBarMessage ]}

What students are saying

  • Left Quote Icon

    As a current student on this bumpy collegiate pathway, I stumbled upon Course Hero, where I can find study resources for nearly all my courses, get online help from tutors 24/7, and even share my old projects, papers, and lecture notes with other students.

    Student Picture

    Kiran Temple University Fox School of Business ‘17, Course Hero Intern

  • Left Quote Icon

    I cannot even describe how much Course Hero helped me this summer. It’s truly become something I can always rely on and help me. In the end, I was not only able to survive summer classes, but I was able to thrive thanks to Course Hero.

    Student Picture

    Dana University of Pennsylvania ‘17, Course Hero Intern

  • Left Quote Icon

    The ability to access any university’s resources through Course Hero proved invaluable in my case. I was behind on Tulane coursework and actually used UCLA’s materials to help me move forward and get everything together on time.

    Student Picture

    Jill Tulane University ‘16, Course Hero Intern