...Assignment 4 Computer Forensic Tools Derek Jackson Computer Crime Investigation Professor: Dr. Jessica Chisholm 03/06/2016 When purchasing computer forensics tools and resources for a company, you always want to make sure you are doing the necessary research and determining which of these programs are the best options for the company. This is very important job in any company as you are in charge of not only protecting the company’s data with these tools, but also recovering any information that may have been lost or deleted. There are many programs that are available that can be used to recover deleted files. Two of the programs that you could use are the MiniTool Partition Recovery and PC Inspector File Recovery. The MiniTool Partition Recovery is a free program that has a wizard-based interface which makes it very easy and straightforward to use and understand. You can point the MiniTool Partition Recovery at the problem drive, specify the area to be searched, and it will scan for the missing partition. Then a report will generate that will let you know what the program has found, and you can then recover that partition in a few seconds typically. The only downfall is that you won’t get a bootable recovery disk, so if the partition is damaged then the MiniTool Recovery program won’t be able to recover the deleted partition. The PC Inspector File Recovery allows you to be able to recover a full set of missing files on both FAT and NTFS drives. They are clearly...
Words: 1005 - Pages: 5
...growing danger from crimes committed against computers, or against information on computers, is beginning to claim attention in the India. The digital age has dramatically changed the scope of a crime by adding the electronic component and it comes a new form of science ≴Computer Forensic Science≵. Computer Forensic allows for the evidence of cyber crime to be admissible in court when prosecuting the cyber criminal. In most countries, existing laws are likely to be unenforceable against such crime. Cyber laws, as it stand today, gives rise to both positive & negative consequences. The main negative consequences is the digital soup so vague that many refer to it as the dark sides of technology and that cyber criminal currently have upper hand. The applicability and effectiveness of our existing laws need to be constantly reviewed to face the risk coming from the cyber world. In this paper we are going to firstly describe the computer forensic, cyber crimes, cyber laws of nation & technology challenges. Aim of this paper is to act as a catalyst to raise awareness regarding computer forensic which continues to grow as one of the most important branch of science and help in investigation of cyber crime which continues to grow as one of the most potent threats to the Internet and computer users of the cyber society of 21st century in India Introduction The rapid change occurring in the present era of Information Technology and the computer has gained popularity in every aspect of...
Words: 2686 - Pages: 11
...Assessment Worksheet Documenting a Workstation Configuration Using Common Forensic Tools Course Name and Number: _____________________________________________________ Student Name: ________________________________________________________________ Instructor Name: ______________________________________________________________ Lab Due Date: ________________________________________________________________ Overview In this lab, you performed a forensic analysis of a Windows 2012 machine using three commonly available tools: WinAudit, DevManView, and Frhed. You reviewed the forensic capabilities of each tool, using the sample files provided, to determine any clandestine threats or vulnerabilities such as viruses and malicious software. You also recovered a file that was altered to hide its native file format. You documented your findings in a forensics report. Lab Assessment Questions & Answers 1. What is the main purpose of a software tool like WinAudit in computer forensics? 2. Which item(s) generated by WinAudit would be of critical importance in a computer forensic investigation? 3. Could you run WinAudit from a flash drive or any other external media? If so, why is this important during a computer forensic investigation? 4. Why would you use a tool like DevManView while performing a computer forensic investigation? Copyright © 2014 by Jones & Bartlett Learning, LLC, an Ascend Learning Company. All rights reserved. www.jblearning.com Student Lab Manual ...
Words: 295 - Pages: 2
...1. What was the user account name of the FTP client on the FTP server and which was its IP address? The FTP account name is: Badguy. FTP server’s IP:172.16.177.157 2. How many emails did the alleged offender sent to his partner before downloading the implicated file? Which are the two email addresses involved? The alleged offender sent 3 emails before downloading the file. The email address involved were: badguy11111@gawab.com and b603358@borthew.com 3. As a forensics investigator, would you be able to playback an entire TCP session if it is requested under trial? Yes, Netwitness investigator allows a forensics investigator to playback an entire TCP session previously capture. 4. What time did the alleged offender choose to perform the actions? Why do you think this is particularly important? Where did you get this information from? After reviewing the entire packet capture we notice that download occurred around 4:00am. This is particularly important since directly to “system usage” outside regular hours of operations. 5. What is the name of the “local user” account involved in the alleged actions? Which was the IP address of the alleged offender workstation? The local administrator account was the one involved. The IP address of the client FTP client was: 172.16.177.132 6. How many attempts to access the FTP server did you find during the packet capture analysis? Why is this important for your case? Two attempts to access the FTP server were found...
Words: 498 - Pages: 2
...Computer Forensics I (FOR 240-81A) Project #3 Case Background The Suni Munshani v. Signal Lake Venture Fund II, LP, et al suit is about email tampering, perjury, and fraud. On December 18, 2000, Suni Munshani (Plaintiff) filed a suit against Signal Lake Venture Fund. Mr. Munshani claimed that he was entitled to warrants in excess of $25 million dollars from Signal Lake. In February 2001, Signal Lake Venture Fund II, LP, et al. (Defendant) became privy to the court filings in this case. Within the filings there was an email provided by Mr. Munshani from Hemant Trivedi, CEO of one of the portfolio companies, stating he was indeed entitled to the warrants. Mr. Trivedi denied any knowledge of the email, or any such communication with Mr. Munshani. In an effort to prove their innocence, Signal Lake hired a computer forensic group to conduct a private investigation. The investigation did not show any evidence of the supposed email provided to the court by Mr. Munshani. Mr. Trivedi filed an affidavit stating that the email was forged, while Mr. Munshani filed an affidavit stating the email was real. In March 2001, a computer forensics expert, Kenneth R. Shear, was appointed by the court to perform a forensic examination on the questioned message (the message provided by Mr. Munshani) and the comparative message (a second message from Mr. Trivedi found on Mr. Munshani’s computer). Mr. Shear worked for a company called Electronic Evidence Discovery, Inc. (EED). Mr. Shear’s forensic...
Words: 799 - Pages: 4
...Guide to Computer Forensics and Investigations Fourth Edition Chapter 7 Current Computer Forensics Tools Objectives • Explain how to evaluate needs for computer forensics tools • Describe available computer forensics software tools • List some considerations for computer forensics hardware tools • Describe methods for validating and testing computer forensics tools Guide to Computer Forensics and Investigations 2 Evaluating Computer Forensics Tool Needs • Look for versatility, flexibility, and robustness – – – – – OS File system Script capabilities Automated features Vendor’s reputation • Keep in mind what application files you will be analyzing Guide to Computer Forensics and Investigations 3 Types of Computer Forensics Tools • Hardware forensic tools – Range from single-purpose components to complete computer systems and servers • Software forensic tools – Types • Command-line applications • GUI applications – Commonly used to copy data from a suspect’s disk drive to an image file Guide to Computer Forensics and Investigations 4 Tasks Performed by Computer Forensics Tools • Five major categories: – – – – – Acquisition Validation and discrimination Extraction Reconstruction Reporting Guide to Computer Forensics and Investigations 5 Tasks Performed by Computer Forensics Tools (continued) • Acquisition – Making a copy of the original drive • Acquisition subfunctions: – – – – – – – Physical data copy Logical data copy...
Words: 2076 - Pages: 9
...International Journal of Digital Evidence Fall 2007, Volume 6, Issue 2 Computer Forensic Analysis in a Virtual Environment Derek Bem Ewa Huebner University of Western Sydney, Australia Abstract In this paper we discuss the potential role of virtual environments in the analysis phase of computer forensics investigations. General concepts of virtual environments and software tools are presented and discussed. Further we identify the limitations of virtual environments leading to the conclusion that this method can not be considered to be a replacement for conventional techniques of computer evidence collection and analysis. We propose a new approach where two environments, conventional and virtual, are used independently. Further we demonstrate that this approach can considerably shorten the time of the computer forensics investigation analysis phase and it also allows for better utilisation of less qualified personnel. Keywords: Computer Forensics, Virtual Machine, computer evidence. Introduction In this paper we examine the application of the VMWare (VMWare, 2007) virtual environment in the analysis phase of a computer forensics investigation. We show that the environment created by VMWare differs considerably from the original computer system, and because of that VMWare by itself is very unlikely to produce court admissible evidence. We propose a new approach when two environments, conventional and virtual, are used concurrently and independently. After the images...
Words: 3983 - Pages: 16
...Digital Forensics is an important aspect to computer systems security. I mean we are talking about Identifying, Collecting, Preserving, Analyzing, and Presenting evidence digitally. Therefore, preserving electronic evidence is important. Investigating Data Theft is a malice act towards a company/ organization (Kruse, 2001). Such theft is made by an employee that is either terminated or resigning. Motives for data theft include setting up a competing business, using the information at a new job, sense of ownership of what was created, and revenge against the employer, among other things. Common Theft include, customer information, financial records, software code, email lists, strategic plans, process documents, secret formulas, databases, research and development materials, and employee records. Now, with such theft around, we often wonder how is such theft achieved. Knowing how technology is always advancing each year, the millennium era grows with fascinating knowledge on the know how to working a computer, hard drives, etc. Tools like flash drive, which can hold thousands of documents that can be copied to the flash drive, and taken anywhere. Then you have Dropbox, remote desktop connections, personal email accounts, smart phones, CD’s/DVD’s, and FTP ( File Transfer Protocol ) (Kruse, 2001) There is always this saying, that personnel who steal data often leave a trail of digital evidence that proves invaluable when investigating data theft. We as the forensic specialists...
Words: 1774 - Pages: 8
...software tool like WinAudit in computer forensics? it is to be able to find out all the information that you would need about the system that you are trying to hack. it also also allows you to be to examine all the software that is on the computer to see if there is anything that does not look right and to be able to see if there is software on the system that is not suppose to be there 2. Which item(s) within WinAudit’s initial report would you consider to be of critical importance in a computer forensic investigation? Computer Name, OS, Security Settings for Windows Firewall, Drives, Running Programs, and Installed Programs and Versions. 3. Could you run Win Audit from a flash drive or any other external media? If so, why is this important during a computer forensic investigation? yes you because that way you are not installing anything on the hard drive that would alter the state of the drive. 4. Why would you use a tool like DevManView while performing a computer forensic investigation? It allows you to see all the the things that are installed on your system from the operating system to the drivers and what version is on there. Determining times and dates, what flash/jump drives might be plugged in, and any CDs, DVDs, or Blu-Ray disks are in the disk drives. 5. Which item(s) within DevManView’s list would you consider to be of critical importance in a computer forensic investigation? Optical Drive(s), USB Mass Storage Devices 6. What tool similar to...
Words: 366 - Pages: 2
...Computer Forensics The world of crime has expanded right along with the explosion of the internet. The modern cyber criminal has veritable global playground in which to steal money and information from unsuspecting victims. Computer forensics is a quickly emerging science against the increasingly difficult battle to bring criminals to justice who perpetrates crimes on others. The computer forensics field is a relatively new investigative tool but enjoys continual advances in procedures, standards, and methodology which is making the identification, preservation, and analyzing of digital evidence a powerful law enforcement apparatus. The job of the cyber forensic professional is to look for clues the attacker left behind on web sites, servers, and even the e-mail message itself that will unravel their sometimes carefully woven veil of secrecy. Attackers come in all forms and from a variety of different circumstances. For instance, an attacker can begin a phishing scam with only a web server they control with very little programming experience and a way to send a lot of e-mail messages. (Jones 4) In order to combat the waves of cyber-attackers, we must utilize Open Source Community applications to combat the continual onslaught of infections, exploitations, and trickery employed everyday against our systems and networks. Today's attacker uses a variety of technologies to employ their methods and understanding those abilities is integral to preparing for an investigation...
Words: 2742 - Pages: 11
...Assignment 1: Computer Forensics Overview CIS 417 Computer Forensics Computer forensics is the process of investigating and analyzing techniques to gather and preserve information and evidence from a particular computing device in a way it can be presented in a court of law. The main role of computer analyst is to recover data including photos, files/documents, and e-mails from computer storage devices that were deleted, damaged and otherwise manipulated. The forensics expert’s work on cases involving crimes associated with internet based concerns and the investigations of other potential possibilities on other computer systems that may have been related or involved in the crime to find enough evidence of illegal activities. Computer experts can also use their professional knowledge to protect corporate computers/servers from infiltration, determine how the computer was broken into, and recover lost files in the company. Processes are used to obtain this information and some of the processes are as follows; * Investigation process: Computer forensics investigations will typically be done as part of a crime that allegedly occurred. The first step of the investigation should be to verify that a crime took place. Understand what occurred of the incident, assess the case, and see if the crime leads back to the individual. * System Description: Next step, once you verified the crime did occur, you then begin gathering as much information and data about the specific...
Words: 1397 - Pages: 6
...responders need to recognize is that the computer was on when the suspect was arrested and there may be evidence that they need to collect right away. If data of apparent evidentiary value is in plain view onscreen. The first responder should seek out personnel who have experience and training in capturing and preserving volatile data before proceeding. First responders should also be alert to the crime scene environment. They should look out for pieces of paper with handwritten notes, passwords, usernames, and software and hardware manuals. These forms of evidence also should be documented and preserved in compliance with departmental policies. In this case the computer should also be checked for DNA so investigators can match the suspects DNA to the arson crime scenes. Also TimeFrame Analysis can be used to link any files of interest to the timeframes of the investigation. All these things can help link the suspect to the crimes, and in doing so can help tell the insurance company whether the claims are valid. 2. Case 4-4 (bomb threat) A list of what items should be included in an initial response field kit to ensure preservation if digital evidence. The initial response field kit should be lightweight and easy to transport. With this kit, you can arrive at a scene, acquire the data you need, and return to the lab as quickly as possible. * Small computer toolkit * Large-capacity drive * IDE ribbon cable * SATA cables * Forensic boot media containing an acquisition...
Words: 1243 - Pages: 5
...Abstract The study of computer forensics has quickly emerged and technology used in theis type of forensics is being developed quite rapidly. As swiftly as the field and its importance are growing, many practitioners still remain unaware of computer forensics and its role in the technological world. A paper provides an overview of the relatively new field of computer forensics. The paper also illustrates why, in the wake of 9-11 and other terrorist acts, the research and development of computer forensics is of international importance. (A) I chose to write my article on computer forensics mainly because I have been involved with computer forensics numerous times in my life. The most recent experience I’ve had with computer forensics was last year. I was informed by my wife that her best friend had received a visit from DHS after their daughters had mentioned that their dad had been touching them and asking them to do things that they were uncomfortable with. DHS determined that they needed to investigate the situation and began to gather the necessary information. During the investigation my wife’s friend had noticed that her husband was starting to be very secretive and was locking up his computer anytime she walked into the room and had been using a 128 bit encrypted flash drive that he never let leave his person. He started being verbally abusive and physically abusive to both her and their 2 young daughters and she locked him out of the house. I received...
Words: 716 - Pages: 3
...000/Yr Title: Forensics Managing Specialist –Security JOB DESCRIPTION All Forensics Candidates are encouraged to apply. Jr. to Sr. level positions are available from 2 years to 10+ years experience. Salary based on experience. A Bachelor's Degree in Forensics or related is a plus. This is a full time perm position. Must be willing to travel nationwide. Our client’s computer forensics team is a comprehensive solution for global data collections and forensic analysis. They offer best-in-class security. From small to large matters, they provide easy to understand interpretations of findings and a single point of contact. The Managing Consultant utilizes state of the art techniques that enable the recovery and use of critical electronic evidence for litigation, investigations and other fact-finding exercises. The Computer Forensics Managing Consultant establishes whether evidence has been erased or modified; analyzes electronic content and patterns of Internet and e-mail usage; recovers deleted data; and assesses and explains metadata within recovered files. RESPONSIBILITIES Manage day to day activities for projects involving computer forensics, information security or rapid response data breach matters. Manage large data preservation and collection activities to ensure that accepted forensic protocols; create and maintain Chain of Custody; document the handling of evidence. Analyze log files from firewalls, web servers and computers. Conduct forensic analysis and write...
Words: 585 - Pages: 3
...Running head: FORENSIC CASES Forensic Cases Stephanie Rudolph Kaplan University IT 550 Computer Forensic and Investigation Prof: Bhanu Kapoor November 26, 2013 Abstract People are the most difficult creatures on earth to understand. Some have the mind set of doing some the off the wall and unacceptable things using technology. In this paper I have discussed location and the type of data you will find in in the case of a financial fraud and a child pornography case. Later in the paper discusses the procedures that and investigator might take to collect data from a suspect system. I will also provide a simple tool that can be used to collect all type of data from different location, making the investigator job much easier and help maintain the integrity of the evidence collected to be presented in court. . Forensic Cases There are many location that and investigator search to obtain data using computer forensic tools in a case on financial fraud and child pornography cases. In the case of a financial fraud emails can provide investigators with information not only the text but also the headers. The email headers can provide investigators with the information of who created the email, what software they used and the IP addressed that sent it. The email header also provide a date and time was sent. Credit card data shows the activity of charges. It show the...
Words: 1093 - Pages: 5
