CSCI 6350 - Chapter 1

_ is one of the most time-consuming parts of a forensic investigation, and it can be the most challenging.

evidence is information that forensic specialists use to support or interpret real or documentary evidence.

Can be programmed only once. Data is not lost when power is removed.

Process acquiring & analyzing info stored on physical storage media, ie computer HDs, smartphones, GPS, removable media

Suspects may process info in a way that disguises its meaning. ie: use encryption to scramble a msg or steganography

The physical ports operate at OSI Layer _.

The term used to emphasize the wide range of different devices that can be included relating to computer forensics

The process of searching the contents of cell phones.

Replacement for EDO.

The extraction of data from electronic devices in a consistent, scientific manner is

SDRAM and, more specifically, DDR3 and DDR4, are the most common forms of RAM found in PCs and laptops.

Also known as malware forensics, is the process of examining malicious computer code.

Data is not lost when power is removed. A technique for storing instructions on chips.

Most likely to find today. commonly found in workstations and many servers. Has no jumpers to set the drive.

Sectors are in turn organized by

Displays web pages

Stores the programs and data you currently have open, but only for as long as the computer has power supplied to it

Linux is a _ clone, developed originally by Linus Torvalds.

Computers store discrete sets of related information in _.

Once you have finished your investigation, done your analysis, obeyed all rules & guidelines, you still have the _ step.

Refers to the functional dimensions of a drive in terms of the number of heads, cylinders, and sectors per track.

Used to change passwords

The process of setting up an empty file system on the disk and installing a boot sector; aka a quick format.

Why was DNS created?

A MAC address is a 6-byte (or 48-bit) address used to identify a network interface card.

Expert reports of 100, 200, or more pages are common. The largest seen was over 1500 pages long.

“the use of science and technology to investigate and establish facts in criminal or civil courts of law.”

Investigators must _ documentary evidence—that is, demonstrate that it’s genuine and was not created after the fact.

In a deposition the other side’s lawyer gets to ask questions, even ?s that would probably be disallowed by trial judge

What terms relate to perjury?

With SSDs, a technique called _ used to extend the life of the drive.

Used for transferring files between computers. Port _ is for data, and port _ for control.

While IPv6 has been available for awhile, a majority of computers are still using IPv4, which provides a _ address

A command that queries a target IP address for information

An opinion is not objectionable just because it embraces an ultimate issue. expert witness can offer opinion as ult. iss

The appointment of neutral experts used to advise court; working for neither plaintiff/defendant; work for the court

Linux can also be used on Mac OS, from the _.

Information processed & assembled so that it is relevant to an investigation & supports a specific finding/determination

US-CERT, defines computer forensics as

Investigators must carefully show an unbroken _ to demonstrate that evidence has been protected from tampering.

may be scrambled by encryption, hidden using steganographic software, compressed, or in a proprietary format.

Courts deal with five types of evidence: Real, Documentary, Testimonial, Demonstrative, and Progressive

A forensic analyst also examines _, which is data about info, such as disk partition structures and file tables.

ROM is

Two types of journaling:

UDP-based file transfer

Not synchronized to the CPU clock.

The process of searching memory in real time, typically for working with compromised hosts or to identify system abuse.

Testimony taken from a witness/party to a case before a trial, is less formal, & typically held in an attorney’s office

Computer forensics begins with a thorough understanding of _. Then you need to understand the _ running on that device

Authentication in environments using Kerberos authentication

This form is how the instructions in your computer’s basic input/output system (BIOS) are stored.

This means that many forensic techniques you can use on Linux can also be used on Mac OS, from the shell prompt.

Used in chat rooms

Used in Windows networks

File headers start at the last byte of a file.

The second three bytes of a MAC address identify the

Any scientific evidence presented in a trial has to have been reviewed and tested by the relevant scientific community

SSDs have used NAND-based flash memory (NAND stands for “negated AND gate”), which retains memory even without power.

The issue is that SSDs use flash memory (and related technology) with individual segments (as opposed to sectors).

The first file system created specifically for Linux. There have been many versions of EXT; the current version is 4.

On HDDs, magnetic data is stored on

What was formerly known as BackTrack in 2013?

An enhancement of IDE. It uses either a 40-pin (like IDE) or 80-pin connector.

HDDs record data by _ _ material directionally to represent either a 0 or a 1 binary digit.

Use of analytical and investig techniques to identify, collect, examine, & preserve magnetically stored/encoded evidence

For many years, _ was a complete OS. But with OS X, system is based on FreeBSD, a UNIX clone very similar to Linux.

How you collect the evidence determines if that evidence is admissible in a court.

Platters are organized on a _ with a read/write head reading and writing data to and from the platters.

Old email protocol

A new file system from Microsoft. Available on Windows Server 2019, but not Windows 10. A more resilient file system.

Ex of DNS issues: changing mapping of website name to IP address permanently/temporarily redirect browsers incorrectly

RAM is

Encrypted email

Border gateway protocol. Used by gateway routers exchanging routing data.

Before you can do any forensic analysis or examination, you have to _ the evidence.

The process of examining network traffic, including transaction logs and real-time monitoring using sniffers and tracing

A formal document that lists what tests you conducted, what you found, and your conclusions. Also includes your CV

The data is there, but do you know what it means? Related to your scientific knowledge.

IP addresses, sometimes called logical addresses, are assigned to a computer and can be easily changed.

First step in determining your system’s network configuration; to get information about your own system

An evolution of the EDO, can process four memory addresses in one burst.

Physical ports are physical. You can touch them. Even a wireless physical port can be touched.

The system logs a copy of every block about to be written to the storage device before it is written. Includes checksum

Known as UNIX file system. Uses a bitmap to track free clusters, showing which clusters are available & which are not.

The min size a file can use is two clusters. If the file is less than size of a cluster, the remaining space is unused.

Metadata also includes file creation, modification times, who authored a file, and when it was revised or updated.

Email protocol

Suspects often corrupt data structures and files that organize data, such as a Windows NT File System (NTFS) volume.

Gives the name of your computer, when your computer obtained its IP address, and more.

Older system; popular w/ Microsoft operating systems for many years. First used in Microsoft Standalone Disk BASIC.

Places to look for forensic evidence on Windows OS

The process of using scientific knowledge for collecting, analyzing, and presenting evidence to the courts

An expert may state an opinion and give the reasons for it without first testifying to the underlying facts or data.

It is solving a complex puzzle—putting together the data you have and finding out what sort of picture is revealed.

Latent evidence can take many forms ie

Data obscured thru encryption, steganography, compression, or proprietary formats can sometimes be converted.

In completing an analysis, forensic specialists face variations in which of the following:

Older standard, was common on PCs for many years. Dealing with it if you encounter a 40-pin connector on the drive.

Ex. laptop w/ suspect’s fingerprints on keyboard, a hard drive, a universal serial bus (USB) drive, & handwritten note

Evid is rlvnt if it hs tdncy to mke fact +/- prob thn it wld be w/o evidence (b) the fact is of consqe in dtrmng action

Memory that cannot be changed

USFR702 “A witness who is qualified as an expert by knowledge, skill, experience, training, or education may testify..if

Easy to write to and read from. Very volatile; as soon as power is discontinued, the data is gone.

Each segment has a finite number of erase cycles before the segment is unreliable. Thus wear leveling

This is an enhancement of SCSI. It supports up to 65,537 devices and does not require termination.

When in doubt, err on the side of under-documentation. Its not possible to document too little info abt an investigation

Goal in computer forensics is to recover, analyze, & present computer-based material that it can be used as evidence in

Becoming more common. Use microchips that retain data in non-volatile memory chips and contain no moving parts.

What are the types of evidence courts deal with?

In the Linux world, work done from the _ , called the _ in Linux, is far more important than it is in Windows.

One legal principle that is key to forensics and is all too often overlooked in forensics books

Any document, spreadsheet, picture, video, or even program is a file.

Any device that can store data is potentially the subject of computer forensics.

Simple network management protocol

Introduced by Microsoft in 1993 as a new file system to replace FAT.

Has an extensive collection of forensic, security, and hacking tools

Used for sending email

Journaling file systms are not fault tolerant bc the file sys logs all changes to files, directories, or file structures

Study of the source and content of email as evidence.

Data has to be first & foremost relevant to a case, to be evidence.

All except for SSDs, refer to how the HD connects to the mtherbrd & transfers data, & don't define how info stord on dsk

Used to retrieve email

An example is a chart that explains a technical concept to the judge and jury.

Used to send a test/echo packet to a machine to find out if the machine is reachable & how long the packet transit takes

A forensic specialist must not adhere to stringent guidelines and avoid taking shortcuts.

Encrypted LDAP

The units of information transfer are 1 and 0 bits grouped into fixed-length units called Layer _ frames.

Suspects often store data where an investigator is unlikely to find it. They may hide data in reserved disk sectors

Used to remotely log onto a system. Use a command prompt/shell to execute commands on that sys. Popular w/network admins

US-CERT, FBI, U.S. Secret Service, & Cornell University Law School are not reputable sources that can support findings

Touch the system as little as possible. It is possible to make changes to the system in the process of examining it.

The process of the file sys keeping record of what file transactions take place so that if a HD crash, files recovered

Examples are email messages, logs, databases, photographs, and telephone call- detail records.

Clusters can be 1 to 128 sectors in size. Meaning 512 bytes up to _

This is the most important principle in any forensic effort, digital or nondigital.

Later development of SDRAM. DDR2, DDR3, and DDR4 are now available.

An expert may base an opinion on facts or data that the expert has been made aware of or personally observed.

The Windows Registry is NOT essentially a repository of all settings, software, and parameters for Windows.

In computer forensics, emphasis must be on the _ and _ of evidence

All the raw information is, in and of itself, evidence.

Evidence that included memory-resident data and computer files.

Useful for some live network troubleshooting; not useful or trustworthy for forensic examination

Not volatile; it cannot be changed. used for instructions embe'd in chips & ctrls how cpu, option crds, peri etc operate

It is common to have the forensic lab be a locked room access given only to those who must enter. Need-to-know basis

What makes ReFS or Resilient File System a more resilient file system?

The first three bytes of a MAC address identify the

Basic unit of data storage on a hard disk, which is usually 512 bytes.

This is an extension/enhancement of IDE.

Encrypted HTTP

Old, est in 1986. Must have a terminator at the end of the chain of devices to work & are limited to 16 chained devices.

If you know the computer hardware and OS, you should also understand the basics of

Single-cycle carry out cmplte memory transaction in 1 clock cycle. Each sequential RAM access w/in pg tkes 2 clock cycle

A logical grouping of sectors. Can be 1 to 128 sectors in size.

Defines what an expert is and what expert testimony is

As a forensic specialist, you will testify as an expert witness on the basis of scientific/technical knwldge you have

Translates URLs into web addresses

Ex. testimonial evid show fingerprints found on kybrd are those of a spec indiv/sys access ctrls sh who put photos dsktp

evidence is a physical object that someone can touch, hold, or directly observe.

Secure communications and file transfer

Popular; used primarily with Linux. Was the first file system to be included with the standard Linux kernel, v2.4.1

Used in Windows networks

Lightweight directory access protocol

Only changes to file metadata are stored in the journal.

Methods for disposing of data. ie simple-wiping the memory buffers used by a program or complex-overwriting data cluster

Can also be referred to as a computer’s physical address

Creates a structure of sectors, tracks, and clusters.

evidence is information that helps explain other evidence—any other evidence

The process of piecing together where and when a user has been on the internet.

Two scenarios in which you will give an expert testimony

With sector, newer systems often use a _ sector size.

You should make a _ of the system to avoid making undesirable changes while examining. Make a copy and analyze the copy.

A witness who is qualf'd as an expert by knwldge, skill, experie, training, or ed. may testify in the form of an opinion

What is the heart of Windows OS?

Forensic tools such as AccessData’s Forensic Toolkit, Guidance Software’s EnCase, or PassMark’s OSForensics can make

The space btwn the end of a file & end of cluster. This is space that can be used to hide data.

evidence is data stored as written matter, on paper, or in electronic files.

The actions that perpetrators take to conceal their locations, activities, or identities are generally termed

A MAC address is not supposed to be unique, can be tied to multiple physical ports, & can be duplicated/reused.

Continuity ctrl of evid that makes it possib to account for all that happ to evid btwn its orig collection & court appea

The two most basic forms of Presenting are the expert report and expert testimony.

Inadmissible facts/data..can be shared helping jury evaluate opinion substantially & outweighs their prejudicial effect

Default for Apple computers using Mac OS 10.13. APFS supports encryption, snapshots, and other features. SSD is best/HD