CSCI 6350 - Chapter 1

Suspects often corrupt data structures and files that organize data, such as a Windows NT File System (NTFS) volume.

Used to change passwords

A formal document that lists what tests you conducted, what you found, and your conclusions. Also includes your CV

Becoming more common. Use microchips that retain data in non-volatile memory chips and contain no moving parts.

Methods for disposing of data. ie simple-wiping the memory buffers used by a program or complex-overwriting data cluster

Expert reports of 100, 200, or more pages are common. The largest seen was over 1500 pages long.

The data is there, but do you know what it means? Related to your scientific knowledge.

A forensic analyst also examines _, which is data about info, such as disk partition structures and file tables.

The extraction of data from electronic devices in a consistent, scientific manner is

Encrypted email

The term used to emphasize the wide range of different devices that can be included relating to computer forensics

The process of setting up an empty file system on the disk and installing a boot sector; aka a quick format.

Courts deal with five types of evidence: Real, Documentary, Testimonial, Demonstrative, and Progressive

The physical ports operate at OSI Layer _.

Can also be referred to as a computer’s physical address

Goal in computer forensics is to recover, analyze, & present computer-based material that it can be used as evidence in

Computers store discrete sets of related information in _.

With SSDs, a technique called _ used to extend the life of the drive.

An opinion is not objectionable just because it embraces an ultimate issue. expert witness can offer opinion as ult. iss

The first three bytes of a MAC address identify the

Secure communications and file transfer

Sectors are in turn organized by

The appointment of neutral experts used to advise court; working for neither plaintiff/defendant; work for the court

Platters are organized on a _ with a read/write head reading and writing data to and from the platters.

A command that queries a target IP address for information

The process of the file sys keeping record of what file transactions take place so that if a HD crash, files recovered

It is common to have the forensic lab be a locked room access given only to those who must enter. Need-to-know basis

An expert may base an opinion on facts or data that the expert has been made aware of or personally observed.

In completing an analysis, forensic specialists face variations in which of the following:

ROM is

You should make a _ of the system to avoid making undesirable changes while examining. Make a copy and analyze the copy.

Refers to the functional dimensions of a drive in terms of the number of heads, cylinders, and sectors per track.

The process of searching memory in real time, typically for working with compromised hosts or to identify system abuse.

This form is how the instructions in your computer’s basic input/output system (BIOS) are stored.

The min size a file can use is two clusters. If the file is less than size of a cluster, the remaining space is unused.

Used for transferring files between computers. Port _ is for data, and port _ for control.

Evid is rlvnt if it hs tdncy to mke fact +/- prob thn it wld be w/o evidence (b) the fact is of consqe in dtrmng action

Before you can do any forensic analysis or examination, you have to _ the evidence.

Two scenarios in which you will give an expert testimony

Most likely to find today. commonly found in workstations and many servers. Has no jumpers to set the drive.

Not synchronized to the CPU clock.

Journaling file systms are not fault tolerant bc the file sys logs all changes to files, directories, or file structures

One legal principle that is key to forensics and is all too often overlooked in forensics books

Single-cycle carry out cmplte memory transaction in 1 clock cycle. Each sequential RAM access w/in pg tkes 2 clock cycle

This is the most important principle in any forensic effort, digital or nondigital.

Inadmissible facts/data..can be shared helping jury evaluate opinion substantially & outweighs their prejudicial effect

Basic unit of data storage on a hard disk, which is usually 512 bytes.

The actions that perpetrators take to conceal their locations, activities, or identities are generally termed

All the raw information is, in and of itself, evidence.

The second three bytes of a MAC address identify the

Physical ports are physical. You can touch them. Even a wireless physical port can be touched.

On HDDs, magnetic data is stored on

Used to remotely log onto a system. Use a command prompt/shell to execute commands on that sys. Popular w/network admins

When in doubt, err on the side of under-documentation. Its not possible to document too little info abt an investigation

A logical grouping of sectors. Can be 1 to 128 sectors in size.

The process of using scientific knowledge for collecting, analyzing, and presenting evidence to the courts

Once you have finished your investigation, done your analysis, obeyed all rules & guidelines, you still have the _ step.

Process acquiring & analyzing info stored on physical storage media, ie computer HDs, smartphones, GPS, removable media

Also known as malware forensics, is the process of examining malicious computer code.

Default for Apple computers using Mac OS 10.13. APFS supports encryption, snapshots, and other features. SSD is best/HD

Used to retrieve email

SDRAM and, more specifically, DDR3 and DDR4, are the most common forms of RAM found in PCs and laptops.

A MAC address is not supposed to be unique, can be tied to multiple physical ports, & can be duplicated/reused.

RAM is

What was formerly known as BackTrack in 2013?

Linux is a _ clone, developed originally by Linus Torvalds.

may be scrambled by encryption, hidden using steganographic software, compressed, or in a proprietary format.

evidence is information that forensic specialists use to support or interpret real or documentary evidence.

An expert may state an opinion and give the reasons for it without first testifying to the underlying facts or data.

The issue is that SSDs use flash memory (and related technology) with individual segments (as opposed to sectors).

As a forensic specialist, you will testify as an expert witness on the basis of scientific/technical knwldge you have

This is an extension/enhancement of IDE.

Testimony taken from a witness/party to a case before a trial, is less formal, & typically held in an attorney’s office

In the Linux world, work done from the _ , called the _ in Linux, is far more important than it is in Windows.

IP addresses, sometimes called logical addresses, are assigned to a computer and can be easily changed.

This means that many forensic techniques you can use on Linux can also be used on Mac OS, from the shell prompt.

evidence is a physical object that someone can touch, hold, or directly observe.

Investigators must carefully show an unbroken _ to demonstrate that evidence has been protected from tampering.

Email protocol

Ex. testimonial evid show fingerprints found on kybrd are those of a spec indiv/sys access ctrls sh who put photos dsktp

US-CERT, FBI, U.S. Secret Service, & Cornell University Law School are not reputable sources that can support findings

USFR702 “A witness who is qualified as an expert by knowledge, skill, experience, training, or education may testify..if

First step in determining your system’s network configuration; to get information about your own system

What is the heart of Windows OS?

Encrypted HTTP

A witness who is qualf'd as an expert by knwldge, skill, experie, training, or ed. may testify in the form of an opinion

Suspects may process info in a way that disguises its meaning. ie: use encryption to scramble a msg or steganography

The process of searching the contents of cell phones.

Evidence that included memory-resident data and computer files.

Data has to be first & foremost relevant to a case, to be evidence.

Encrypted LDAP

A forensic specialist must not adhere to stringent guidelines and avoid taking shortcuts.

File headers start at the last byte of a file.

Displays web pages

With sector, newer systems often use a _ sector size.

The space btwn the end of a file & end of cluster. This is space that can be used to hide data.

The units of information transfer are 1 and 0 bits grouped into fixed-length units called Layer _ frames.

If you know the computer hardware and OS, you should also understand the basics of

Used to send a test/echo packet to a machine to find out if the machine is reachable & how long the packet transit takes

Forensic tools such as AccessData’s Forensic Toolkit, Guidance Software’s EnCase, or PassMark’s OSForensics can make

Older standard, was common on PCs for many years. Dealing with it if you encounter a 40-pin connector on the drive.

evidence is data stored as written matter, on paper, or in electronic files.

Any device that can store data is potentially the subject of computer forensics.

Translates URLs into web addresses

Older system; popular w/ Microsoft operating systems for many years. First used in Microsoft Standalone Disk BASIC.

Old email protocol

HDDs record data by _ _ material directionally to represent either a 0 or a 1 binary digit.

For many years, _ was a complete OS. But with OS X, system is based on FreeBSD, a UNIX clone very similar to Linux.

“the use of science and technology to investigate and establish facts in criminal or civil courts of law.”

How you collect the evidence determines if that evidence is admissible in a court.

Introduced by Microsoft in 1993 as a new file system to replace FAT.

Two types of journaling:

Data is not lost when power is removed. A technique for storing instructions on chips.

UDP-based file transfer

A MAC address is a 6-byte (or 48-bit) address used to identify a network interface card.

The process of examining network traffic, including transaction logs and real-time monitoring using sniffers and tracing

Defines what an expert is and what expert testimony is

Easy to write to and read from. Very volatile; as soon as power is discontinued, the data is gone.

Authentication in environments using Kerberos authentication

Used in chat rooms

US-CERT, defines computer forensics as

Use of analytical and investig techniques to identify, collect, examine, & preserve magnetically stored/encoded evidence

Clusters can be 1 to 128 sectors in size. Meaning 512 bytes up to _

_ is one of the most time-consuming parts of a forensic investigation, and it can be the most challenging.

SSDs have used NAND-based flash memory (NAND stands for “negated AND gate”), which retains memory even without power.

evidence is information that helps explain other evidence—any other evidence

What are the types of evidence courts deal with?

An example is a chart that explains a technical concept to the judge and jury.

An enhancement of IDE. It uses either a 40-pin (like IDE) or 80-pin connector.

Popular; used primarily with Linux. Was the first file system to be included with the standard Linux kernel, v2.4.1

Useful for some live network troubleshooting; not useful or trustworthy for forensic examination

Known as UNIX file system. Uses a bitmap to track free clusters, showing which clusters are available & which are not.

The system logs a copy of every block about to be written to the storage device before it is written. Includes checksum

The two most basic forms of Presenting are the expert report and expert testimony.

What terms relate to perjury?

Computer forensics begins with a thorough understanding of _. Then you need to understand the _ running on that device

Used for sending email

Replacement for EDO.

An evolution of the EDO, can process four memory addresses in one burst.

All except for SSDs, refer to how the HD connects to the mtherbrd & transfers data, & don't define how info stord on dsk

Lightweight directory access protocol

Ex. laptop w/ suspect’s fingerprints on keyboard, a hard drive, a universal serial bus (USB) drive, & handwritten note

The first file system created specifically for Linux. There have been many versions of EXT; the current version is 4.

The process of piecing together where and when a user has been on the internet.

Ex of DNS issues: changing mapping of website name to IP address permanently/temporarily redirect browsers incorrectly

Any scientific evidence presented in a trial has to have been reviewed and tested by the relevant scientific community

Examples are email messages, logs, databases, photographs, and telephone call- detail records.

Stores the programs and data you currently have open, but only for as long as the computer has power supplied to it

Not volatile; it cannot be changed. used for instructions embe'd in chips & ctrls how cpu, option crds, peri etc operate

Border gateway protocol. Used by gateway routers exchanging routing data.

Used in Windows networks

This is an enhancement of SCSI. It supports up to 65,537 devices and does not require termination.

What makes ReFS or Resilient File System a more resilient file system?

Continuity ctrl of evid that makes it possib to account for all that happ to evid btwn its orig collection & court appea

Has an extensive collection of forensic, security, and hacking tools

Any document, spreadsheet, picture, video, or even program is a file.

Old, est in 1986. Must have a terminator at the end of the chain of devices to work & are limited to 16 chained devices.

In a deposition the other side’s lawyer gets to ask questions, even ?s that would probably be disallowed by trial judge

While IPv6 has been available for awhile, a majority of computers are still using IPv4, which provides a _ address

Places to look for forensic evidence on Windows OS

Data obscured thru encryption, steganography, compression, or proprietary formats can sometimes be converted.

Can be programmed only once. Data is not lost when power is removed.

Creates a structure of sectors, tracks, and clusters.

Each segment has a finite number of erase cycles before the segment is unreliable. Thus wear leveling

Why was DNS created?

Used in Windows networks

Touch the system as little as possible. It is possible to make changes to the system in the process of examining it.

Memory that cannot be changed

Only changes to file metadata are stored in the journal.

Metadata also includes file creation, modification times, who authored a file, and when it was revised or updated.

Information processed & assembled so that it is relevant to an investigation & supports a specific finding/determination

Investigators must _ documentary evidence—that is, demonstrate that it’s genuine and was not created after the fact.

Study of the source and content of email as evidence.

The Windows Registry is NOT essentially a repository of all settings, software, and parameters for Windows.

Suspects often store data where an investigator is unlikely to find it. They may hide data in reserved disk sectors

Later development of SDRAM. DDR2, DDR3, and DDR4 are now available.

In computer forensics, emphasis must be on the _ and _ of evidence

A new file system from Microsoft. Available on Windows Server 2019, but not Windows 10. A more resilient file system.

It is solving a complex puzzle—putting together the data you have and finding out what sort of picture is revealed.

Latent evidence can take many forms ie

Linux can also be used on Mac OS, from the _.

Simple network management protocol

Gives the name of your computer, when your computer obtained its IP address, and more.