traditional-forensics

traditional-forensics - 1 Live Forensics Tutorial Part 1:...

Info iconThis preview shows pages 1–9. Sign up to view the full content.

View Full Document Right Arrow Icon
1 © Copyright 2007 by Frank Adelstein and Golden G. Richard. III USENIX Security 2007 Live Forensics Tutorial Part 1: Traditional Forensics Frank Adelstein, Ph.D. Technical Director, Computer Security, ATC-NY GIAC-certified Digital Forensics Investigator Golden G. Richard III, Ph.D. Professor, Dept. of Computer Science, University of New Orleans GIAC-certified Digital Forensics Investigator Co-Founder, Digital Forensics Solutions, LLC
Background image of page 1

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
2 © Copyright 2007 by Frank Adelstein and Golden G. Richard. III USENIX Security 2007 Course Overview – The Big Picture Introduction Traditional Forensics/Background Simple Network Forensics Main Focus: Live Forensics Demo Wrap-up
Background image of page 2
3 © Copyright 2007 by Frank Adelstein and Golden G. Richard. III USENIX Security 2007 Instructor Background Frank: Forensics researcher, Ph.D. in computer science (OSU), R&D, GCFA certification, vice-chair DFRWS Golden: Professor, Ph.D. in computer science (OSU), teaches forensic courses, GCFA, founder Digital Forensic Solutions, LLC, chair DFRWS
Background image of page 3

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
4 © Copyright 2007 by Frank Adelstein and Golden G. Richard. III USENIX Security 2007 Course Goals and Disclaimer Goals Gain an understanding of what information live forensic analysis can provide as well as its limitations See how live forensics fits into the big picture of other analysis techniques Disclaimers This is not legal advice 6 hours doesn’t make you an expert
Background image of page 4
5 © Copyright 2007 by Frank Adelstein and Golden G. Richard. III USENIX Security 2007 Technical Definition: Digital Forensics “Tools and techniques to recover, preserve, and examine digital evidence on or transmitted by digital devices.” PLUS data recovery
Background image of page 5

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
6 © Copyright 2007 by Frank Adelstein and Golden G. Richard. III USENIX Security 2007 Definition for the Masses “Deleted” information, on almost any kind of digital storage media, is almost never completely “gone”… Digital Forensics is the set of tools and techniques to recover this information in a forensically valid way (i.e., acceptable by a court of law)
Background image of page 6
7 © Copyright 2007 by Frank Adelstein and Golden G. Richard. III USENIX Security 2007 Motivation Deleted files aren’t securely deleted Recover deleted file + when it was deleted! Renaming files to avoid detection is pointless Formatting disks doesn’t delete much data Web-based email can be (partially) recovered directly from a computer Files transferred over a network can be reassembled and used as evidence
Background image of page 7

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
© Copyright 2007 by Frank Adelstein and Golden G. Richard. III USENIX Security 2007 Motivation (2) Uninstalling applications is much more difficult than it might appear… “Volatile” data hangs around for a long time (even across reboots) Remnants from previously executed applications Using encryption properly is difficult, because data isn’t useful unless decrypted Anti-forensics (privacy-enhancing) software is mostly broken “Big” magnets (generally) don’t work
Background image of page 8
Image of page 9
This is the end of the preview. Sign up to access the rest of the document.

This note was uploaded on 04/06/2011 for the course CS 6963 taught by Professor Walterbruehs during the Spring '10 term at NYU Poly.

Page1 / 126

traditional-forensics - 1 Live Forensics Tutorial Part 1:...

This preview shows document pages 1 - 9. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online