Overview of Computer Forensics

1
Overview of Computer Forensics
Highline Community College Seattle University
University of Washington in conjunction
with the National Science Foundation
2
Computer Forensics

• The application of forensic science techniques to
  the discovery, collection and analysis of digital
  evidence.

3
Data Recovery

• Digital recovery of data
• Not connected with an investigation typically
• Have a good idea of what you are looking for
• Can involve
• file repair
• email repair
• Physical damage to drives

4
Disaster Recovery

• Natural Disaster
• Power outages
• Mechanical failures
• Productivity

5
Suspect / Victim Drive

• corporate investigation
• fraud
• embezzlement
• corporate espionage
• policy violations
• criminal investigation
• kidnapping
• murder
• drugs

6
Suspect / Victim Drive

• civil investigations
• divorce
• harassment
• stalking

7
Host Based Forensics

• External or internal attack
• Known OS
• Known vulnerabilities
• isolate what harm was done
• determine method
• notify Network Admin

8
Network Based Forensics

• External and Internal attacks
• determines how someone got in
• what they did
• what ports were used
• tries to determine source

9
Course Topics

• Review OSs
• file structure
• boot up issues
• Review hardware and storage media
• Available software
• Evaluation of new software
• Windows Registry
• Email

10
Course Topics

• RAID devices
• PDAs
• Cell phones
• Combos
• Compressed drives
• Multiple drives
• Sparse collection

11
Course Topics

• Linux and computer forensics
• Knoppix STD
• The Auditor and Helix
• Database Investigations