Upgrade to remove ads
Only $2.99/month

ITP 475

Terms in this set (29)

Golden Rule of Forensics
Always assume it will go to court, so take notes accordingly
3 ways a computer can be involved in a crime
Contraband: the computer was stolen
Tool of the Crime: the computer was used to commit the crime
Incidental: the computer is storing information pertaining to the crime
*note: they are not mutually exclusive!
3 types of case
Internal: determining whether or not an employee of a company broke the confidentiality agreement; fast/covert because you know what you're looking for, don't get hired unless there is suspicion
Civil: similar to internal, files lawsuit for internal investigations, opposing company/person owns the systems, dependent on the judge and attorneys, your forensic process can be called into question
Criminal:normally handled by someone with a career in criminal forensics, complete authority to do anything, the highest stakes, can take a lot of time
6 A's
assessment, acquisition, authentication, analysis, articulation, archival
How many time stamps for each file in a Windows system?
either 8 or 12
Tell me about evidence
Either helps prove or disprove a fact in the case
Any document, media, files, printouts, or devices obtained during Assessment and Acquisition must be treated as evidence
US federal rules of evidence: "make the existence of any fact...more probable or less probable than it would without the information"
Best evidence rule
Original of a writing or recording must be admitted in court in order to prove its contents
Any printout or other output readable by sight that reflects the data is an original
Any forensic images can be an original
When handling evidence...
make sure to authenticate it through photos, hashes, and documentation (chain of custody)
Central Processing Unit
The CPU is the arithmetic logic unit, the control unit. Its registers are 64 bits in size, which is as big as the CPU can handle. Registers in the CPU are measured in BITS
Memory Hierarchy (smallest to largest)
Processor registers (small size, small capacity. Very fast and expensive)
Processor cache (small size, small capacity. Very fast and expensive)
Random Access Memory (RAM, measured in GB, fast and affordable. Medium size and capacity)
Flash/USB memory (slower, cheap, small size and large capacity)
Hard drive (slow, very cheap, large size and very large capacity)
Tape backup (very slow, affordable, large size and very large capacity)
What is a computer?
Programmable device that can perform a series of computations based on a series of instructions
How is data held in registers read
left to right
Big Endian
most significant byte goes first
Little Endian
mirror of big endian, least significant byte goes first/most significant byte goes last. All microprocessors that are Intel x86 are in LITTLE ENDIAN.
File systems
logical grouping of related bytes, stored as binary on media but displayed as hex, processed and then displayed as text
File anatomy
data: actual file content in binary hex form
metadata: data about data, info that is useful or necessary for the filesystem to organize data , completely independent of the stored data for the file, and dependent on the type of file system used
What is a partition?
a set of consecutive sectors on a disk
Optical media
reflective surface for storing data, includes CDs (red laser), DVDs, Blu-ray (blue laser)
pit=0, no pit=1
inherently read-only, don't need a write blocker
File Allocation Table
FAT, old windows file system
New technology file system
NTFS, newer file system for windows
Volume
partition with a single file system (ex. C or D)
Common forensic techniques
partition recovery, signature analysis, hash analysis, keyword and GREP searches, unallocated space and pagefile, printer spool, link files, recycle bin, USB device tracking, internet and email, timestamps (FAT and NTFS), and user activity tracking
FAT file system
separates the locations and metadata, whereas NTFS stores them in one file structure. Originally designed for floppy disks
cluster size range?
from 1 sector per cluster to 64
what are the 3 different types of FAT? and why are the numbers significant?
12,16, and 32. The numbers are significant because it determines how many bits are used for addressing clusters
File Slack
Suppose your file is 3500 bytes in size and cluster are 4096 bytes.
Remaining 596 bytes are called file slack
Fragmentation occurs when clusters for a sector are left over
Storage of Floppy Disks
1 sector per cluster=512 byte per cluster
4084 clusters * 512 bytes per cluster=2091008 bytes
Approx. 2 MB maximum volume size for floppy disk
Most "high density" floppy disks are 1.4 MB in size
Storage for Hard Drives
Typically 8 sectors per cluster=4096 bytes per cluster
4084 clusters * 4096 bytes per cluster= approx. 16MB
Where is the Volume Boot Sector located?
Sector offset 0
YOU MIGHT ALSO LIKE...