Digital Forensics

1
Digital Forensics

• Dr. Bhavani Thuraisingham
• The University of Texas at Dallas
• Review for the Final Exam
• December 8, 2008

2
How are you doing in class so far?

• Based on mid-term exams and the assignments
  everyone is doing very well in class please see
  your mid-term grade
• Please keep up with good work until the final
  grade

3
Overview of Course Work

• Two exams each worth 16 points
• Mid-term (done) and Final exams (December 12)
• Programming project worth 16 points
• Due date December 12th
• Four homework assignments worth 10 points each
• All assignments completed by December 8th
• Term paper (12 points by December 8th)
• Total 100 points
• Extra credit Encase project 10 points

4
Final Exam Tips

• Answer 6 out of 9 questions (maybe 7 out of 10)
• Network Forensics 2 questions
• Based on the lectures and the book chapter
• Email, application Forensics 1 question, based
  on lectures and book chapter
• Military Forensics 1 question, lecture notes
• Expert witness and report writing 1 question
  based on book chapters and lectures
• Rest of the questions (4-5
• questions) on the papers we have discussed in
  class
• Papers will be listed in the next page
• Extra credit question, from the additional papers
  listed in page after next

5
Key Papers to Read for the Final Exam

• Iowa State Paper
• https//www.dfrws.org/2005/proceedings/wang_eviden
  cegraphs.pdf
• FORZA Digital forensics investigation framework
  that incorporate legal issues
• http//dfrws.org/2006/proceedings/4-Ieong.pdf
• A cyber forensics ontology Creating a new
  approach to studying cyber forensics
• http//dfrws.org/2006/proceedings/5-Brinson.pdf
• Arriving at an anti-forensics consensus
  Examining how to define and control the
  anti-forensics problem
• http//dfrws.org/2006/proceedings/6-Harris.pdf
• Forensic feature extraction and cross-drive
  analysis
• http//dfrws.org/2006/proceedings/10-Garfinkel.pdf
  
• A correlation method for establishing provenance
  of timestamps in digital evidence
• http//dfrws.org/2006/proceedings/13-20Schatz.pdf
  

6
Following Papers will be included as Extra credit
questions

• Cyber Forensics a Military Perspective
• https//www.utica.edu/academic/institutes/ecii/pub
  lications/articles/A04843F3-99E5-632B-FF420389C063
  3B1B.pdf
• How to Reuse Knowledge about Forensic
  Investigations
• Danilo Bruschi, Mattia Monga, Universita degli
  Studi di Milano
• http//dfrws.org/2004/day3/D3-Martignoni_Knowledge
  _reuse.pdf
• John Lowry, BBN Systems Adversary Modeling to
  Develop Forensic Observables
• http//dfrws.org/2004/day2/Adversary_Modeling_to_D
  evelop_Forensic_Observables.pdf
• Dr. Golden G. Richard III, University of New
  Orleans, New Orleans, LA Breaking the
  Performance Wall The Case for Distributed
  Digital Forensics
• http//dfrws.org/2004/day2/Golden-Perfromance.pdf

7
Project

• Project description
• Software modules (prefer diagram) and description
• Results
• Analysis
• Future improvements
• References

8
My Office Hours before exam

• I will be at work on Tuesday and Friday if I am
  not called for Jury duty
• Tuesday afternoon (3-4pm) and Friday morning
  (10-11am) December 9, 12th
• I will be in my office December 23rd from 11am
  12 noon
• You can send me email