Upload File

comp ter forensics it’s notcomputer forensics: it’s … ter forensics it’s notcomputer...

  • Home
  • Documents
  • Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file
23
Comp ter Forensics It’s Not Computer Forensics: It’s Not Just for Computers Anymore Shauna Woody-Coussens Shauna Woody Coussens CFE, AVA Lanny Morrow EnCE

Upload: dinhcong

Post on 10-Jun-2018

280 views

Category:

Documents


2 download

Report

TRANSCRIPT

Page 1: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Comp ter Forensics It’s NotComputer Forensics: It’s Not Just for Computers Anymore

Shauna Woody-Coussens

y

Shauna Woody CoussensCFE, AVA

Lanny MorrowEnCE

Page 2: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

It is estimated over 85% of all infractions & crimes committed today contain a digital signaturetoday contain a digital signature

- CSI/FBI survey

BKD Forensics Institute

Page 3: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Digital Signatures Can Be… Email & instant message conversations Websites visited & files downloaded Listing of recent documents opened Installed software (Yes, even if it has been uninstalled) Contents of documents recently printed Every time the computer is started or shut down List of applications recently run When computer was put into service

Wh CD /DVD b d When CDs/DVDs were burned Record of every device ever plugged into computer

BKD Forensics Institute

Page 4: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Computer Forensics Can be Useful with Regard toRegard to… Computers Cell phonesCe p o es Copiers/scanners/printers Fax machines iPods/MP3 players iPads Video surveillance tapes Video surveillance tapes Medical robotics Construction cranes Railroad crossing arms GPS devices

BKD Forensics Institute

Page 5: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Computers

Active filesD l d fil Deleted files

Registry information Metadata Metadata Email Chat logs Chat logs Internet history, cache, URLs temporary

internet files

BKD Forensics Institute

Page 6: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Cell Phones No longer merely telephones Taken on computer capabilitiesa e o co pu e capab es

• Large data storage capacity• Internet connection

Document creation review revision &• Document creation, review, revision & storage in multiple formats

• File encryption• Photo, audio & video creation, editing &

storage

BKD Forensics Institute

Page 7: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Cell Phones

Data extraction of logical & deleted data, such as:• Call logs (incoming/outgoing missed)• Call logs (incoming/outgoing, missed)• Calendar entries• Contact lists• Text messages• Emails• Locations of use with Wi-Fi & cell towers• Internet use files (history/cookies/bookmarks)• Skype use files (contacts/calls/chat)• Facebook use files (contacts/chat)• Facebook use files (contacts/chat)

BKD Forensics Institute

Page 8: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Cell Phone Camera

BKD Forensics Institute

Page 9: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Copiers-Scanners-Printers-Fax Machines

Many models have hard drives just like computersdrives just like computers

Data generally not encrypted & easily recoverable

Few people know data is il bl f thavailable from these

machines

BKD Forensics Institute

Page 10: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Copiers-Scanners-Printers-Fax Machines

http://www.cbsnews.com/video/watch/?id=6412572n&tag=contentMain;contentBody

BKD Forensics Institute

Page 11: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

iPods-MP3 Players

iPod/mp3 devices can store audio, video & photo-based filesbased files • Portable & inconspicuous devices capable of storing large

amounts of dataWhil d t i t dil i bl th d i it i dil• While data is not readily viewable on the device, it is readily accessible when attached via a USB cable to a computer

BKD Forensics Institute

Page 12: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

iPads

With large storage capabilities of 16GB to 64GB & Wi-Fi capabilities recovery of data is plentifulWi-Fi capabilities, recovery of data is plentiful• Pictures, video & audio files• Calendar entries• Contact lists• Emails• Chat files• Locations of use with Wi-Fi &

cell towers• Internet use files (history/cookies/bookmarks)Internet use files (history/cookies/bookmarks)• Facebook use files (contacts/chat)

BKD Forensics Institute

Page 13: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Video Surveillance Common mistake is forgetting proper preservation Date/time stamps will changea e/ e s a ps c a ge Very tight window for recovery of deleted video, if any Many types of systems, all

handled differently

BKD Forensics Institute

Page 14: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Medical Robotics

Track logins & all commands issued by surgeonby surgeon

Takes video & screen captures Resident hard drive just like aResident hard drive just like a

computer hard drive Deleted data is recoverable

BKD Forensics Institute

Page 15: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Construction Cranes

“Black Box” records every vital statistic of operationvital statistic of operation

Data of critical importance to OSHA & other parties

Requires specialized tools & software to extract & interpret d tdata

BKD Forensics Institute

Page 16: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Railroad Crossing

Date/time arms & lights were operating Data kept relative to train proximity Data kept relative to train proximity

when arms/lights activated

BKD Forensics Institute

Page 17: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

GPS Navigation Devices

GPS device information includes both logical & deleted datalogical & deleted data• User-entered home location• BlueTooth paired devices• Device stored route data• User-entered Points-of-Interest (POI) data• User-defined favorite locations• Stored user data files such as

pictures, videos, audio & text• Route data can beRoute data can be

extracted & imported into Google Maps/Google Earth

BKD Forensics Institute

Page 18: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

GPS

Most common brands have standard USB ports to pull datadata

Forensic software used to extract data & present in useful format

Software can work with Google Earth to display location & date/time data

BKD Forensics Institute

Page 19: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

GPS

BKD Forensics Institute

Page 20: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

GPS

The handheld MX300 uses telematics & wireless communications to offer the user more than just acommunications to offer the user more than just a personal navigation device (PND). It’s also an entertainment device capable of serving as an ebook reader, storage for photos & graphics, voice recorder, digital video or music player, online TV viewer & a way to surf the Internet & read emails. It even has VoIPsurf the Internet & read emails. It even has VoIP capabilities & can send SMS messages in case of emergency.htt // 24 7 l / l / d i t j t f d i ihttp://www.24-7pressrelease.com/press-release/gps-devices-not-just-for-driving-directions-anymore-148309.php

BKD Forensics Institute

Page 21: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Challenges Faced

Increasing size of digital media Wide availability of encryption Wide availability of encryption Growing variety of operating systems & file formats Individuals owning multiple devices Individuals owning multiple devices Clouds-off-site management of data 4G cellular technology4G cellular technology Virtual machines Solid state drives & deleted file recoveryy

BKD Forensics Institute

Page 22: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Recent Happenings

8th Circuit Court deems cell phone a computer (United States v. Neil Scott Kramer, 10-1983)States v. Neil Scott Kramer, 10 1983)

BKD Forensics Institute

Page 23: Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Questions?Questions?

Shauna [email protected]

816.701.0250

bkd / i /F i /i tit twww.bkd.com/service/Forensics/institute

BKD Forensics Institute


Forensics & Anti- Forensics - Power Of Communitypowerofcommunity.net/poc2007/casper.pdf · Anti-Forensics • Wipe can reply all Host Forensics Tools • Counterfeit Evidence •

Is Mobile Device Forensics Really Forensics?

Anti-Forensics and Anti-Anti-Forensics

Digital Forensics or Cyber Forensics My Contribution

January FOCUS ON 2017 FORENSICS - Pathtech · January FOCUS ON 2017 FORENSICS An update from Pathtech It’s a wrap. Pathtech at ANZFSS ... human DNA in sufficient levels to be of

Computer forensics - Jordan University of Science and ...tawalbeh/aabfs/presentations/computer_forensics.pdf · 29.08.2006 Computer forensics 2 Computer forensics Definitions: Forensics

DefCon 2012 - Anti-Forensics and Anti-Anti-Forensics

Subject: Forensics Course Title: Forensics Unit: Criminalistics and

WildPackets Confidential Security It’s more than Forensics January 2007 Sales Kick-off Jay Botelho, Senior Product Manager

Implementation of Forensic Analysis Procedures for ...Android Forensics, Instant Messenger Forensics, Viber Forensics, WhatsApp Forensics. 1. INTRODUCTION ... communication medium

Cloud Storage Forensics - SANS Computer Forensics

OleDetection Forensics and Anti-forensics of Steganography ...users.cs.fiu.edu/~fortega/df/research/infohiding/Erbacher-Ole... · OleDetection—Forensics and Anti-Forensics of Steganography

Network Forensics PPrinciples of Network Forensics

Introduction to IT Forensics and Forensics Process 1

History of Forensics CHS. Define Forensics Forensics is the application of science to law

Professionisti a tutela della verità - P&P Investigazioni...Digital & Mobile Forensics Digital Forensics Network Forensics Embedded & Software Forensics Metodologia d’Intervento

Arrowhead Forensics - The Gold Standard in Forensics Crime

iPhone Forensics Methodology and Tools · Forensics methodologies, iPhone forensics, forensics tools, digital forensics evidence handling, INTRODUCTION iPhone mobile phone is becoming

SCHOOL OF GRADUATE AND PROFESSIONAL STUDIES · and cyber forensics. It’s not unusual to ask one of our forensics students what he or she wants to do when they graduate and get the

FORENSICS & SECURITY - Elsevierscitechconnect.elsevier.com/.../forensics-security... · SEP 2014 • ISBN: 9780124052130 FORENSIC SCIENCE Introduction to Environmental Forensics,

Forensics & Anti- Forensics

Computer Forensics Network Protocols Overview for Network Forensics

Introduction to Forensics. It’s All About the Connections Physics Engineering Biology Mathematics Forensic Science Law Technology Chemistry Anatomy/ Physiology

COMPUTER FORENSICS - Boise Chapter€¦ · 3 Mobile device forensics 4 Other 5 References Computer forensics Main article: computer forensics ... 1.19 Computer Forensics Solution

Digital Evidence and Computer Forensics Oct 7-8 2013/Tab 02 Oct 7-8... · Digital Evidence and Computer Forensics COMPUTER FORENSICS FORENSICS FORENSICS

SANS Forensics 2009 - Memory Forensics and Registry Analysis

Forensics · Disk Forensics Mobile Forensics E-mail investigations Questioned document Cryptography, examination Steganography Live Forensics and Network Forensics Audio/video authentication

Computer Forensics - Dipartimento Di Informaticaads/ads/Sicurezza_files/Presenta... · 2017-05-09 · Computer Forensics 3 Dalla digital forensics alla computer forensics Digital

HEX DUMPING PRIMER - Mobile Device Forensics · PDF file1 HEX DUMPING PRIMER Part I Michael Harrington, CFCE, EnCE Cell (or Mobile as it’s known outside the US) Phone Forensics has

Preventive Digital Forensics: Creating Preventive Digital Forensics

Acquisizione Laboratorio Disk forensics Network forensics

SQL SERVER Anti-Forensics - Black Hat · • Anti-Forensics techniques help to make forensics investigations difficult • Anti-Forensics can be a never ending game • Forensics

Computer Forensics – Tracking the Cyber vandals Forensics

FORENSICS JOURNAL - Stevenson Universitystevenson.edu/online/publications/forensics/documents/...FORENSICS JOURNAL 1 Welcome to the third edition of the Stevenson University Forensics

Digital forensics track schroader-rob when forensics collide