Column: The Physics Of Digital Information-Part 2,
2012
CEO, Fred Cohen & Associates President, California Sciences Institute
Column: The Physics Of Digital Information-Part 2, Fred Cohen
Journal of Digital Forensics, Security and Law
In part 1 of this series (Cohen, 2011a), we discussed some of the basics of building a physics of digital information. Assuming, as we have, that science is about causality and that a scientific theory should require that cause(C) produces effect (E) via mechanism M (written C→ME), we explore that general theory of digital systems from the perspective of attributing effects (i.e., traces of activities in digital systems) to their causes. Full details of the current version of this physics are available online2 , and in this article, we explore a few more of them.
Comparing Android Applications To Find Copying,
2012
Virtual System Platform Cadence Design Systems
Comparing Android Applications To Find Copying, Larry Melling, Bob Zeidman
Journal of Digital Forensics, Security and Law
The Android smartphone operating system includes a Java virtual machine that enables rapid development and deployment of a wide variety of applications. The open nature of the platform means that reverse engineering of applications is relatively easy, and many developers are concerned as applications similar to their own show up in the Android marketplace and want to know if these applications are pirated. Fortunately, the same characteristics that make an Android application easy to reverse engineer and copy also provide opportunities for Android developers to compare downloaded applications to their own. This paper describes the process for comparing a developer’s …
An Overview Of The Jumplist Configuration File In Windows 7,
2012
University of Warwick, Coventry
An Overview Of The Jumplist Configuration File In Windows 7, Harjinder S. Lallie, Parmjit S. Bains
Journal of Digital Forensics, Security and Law
The introduction of Jumplists in Windows 7 was an important feature from a forensic examiners viewpoint. Jumplist configuration files can provide the examiner with a wealth of information relating to file access and in particular: dates/times, Volume GUIDs and unique file object IDs relating to those files. Some of the information in the Jumplist could be used to build a more precise timeline relating to system and file usage. In this article, we analyse the structure of a Jumplist configuration file and in particular a record from a Jumplist configuration file and highlight some of the important entries therein.
Pandora’S Email Box? An Exploratory Study Of Web-Based Email Forgery Detection And Validation.,
2012
Murdoch University
Pandora’S Email Box? An Exploratory Study Of Web-Based Email Forgery Detection And Validation., Richard Boddington, Grant Boxall, Jeremy Ardley
Journal of Digital Forensics, Security and Law
Web based email systems may be a source of pristine digital evidence because of the perceived difficulty of client tampering with messages stored inside the email account. We demonstrate that such assumption is wrong in the case of Windows Live Hotmail®1 . Windows Live Mail®1 synchronises message on client-side computers with the Hotmail® server, benefiting users wishing to synchronise their email accounts and personal devices. However, this synchronisation opens an exploit for wrongdoers to tamper with existing email messages and attachments as well as facilitating the insertion of fabricated messages. The exploit process enables persistent storage of tampered and fabricated …
Book Review: The Software Ip Detective's Handbook: Measurement, Comparison, And Infringement Detections,
2012
American Military University
Book Review: The Software Ip Detective's Handbook: Measurement, Comparison, And Infringement Detections, Diane Barrett
Journal of Digital Forensics, Security and Law
Do not the book title fool you into thinking that the book is only for those looking to detect software infringement detection. It is a comprehensive look at software intellectual property. The book covers a wide range of topics and has something to offer for just about everyone from lawyers to programmers.
Technology Corner: Dating Of Electronic Hardware For Prior Art Investigations,
2012
VintageTech
Technology Corner: Dating Of Electronic Hardware For Prior Art Investigations, Sellam Ismail
Journal of Digital Forensics, Security and Law
In many legal matters, specifically patent litigation, determining and authenticating the date of computer hardware or other electronic products or components is often key to establishing the item as legitimate evidence of prior art. Such evidence can be used to buttress claims of technologies available or of events transpiring by or at a particular date.
Applying The Acpo Principles In Public Cloud Forensic Investigations,
2012
University of Warwick, Coventry
Applying The Acpo Principles In Public Cloud Forensic Investigations, Harjinder S. Lallie, Lee Pimlott
Journal of Digital Forensics, Security and Law
The numerous advantages offered by cloud computing has fuelled its growth and has made it one of the most significant of current computing trends. The same advantages have created complex issues for those conducting digital forensic investigations. Digital forensic investigators rely on the ACPO (Association of Chief Police Officers) or similar guidelines when conducting an investigation, however the guidelines make no reference to some of the issues presented by cloud investigations. This study investigates the impact of cloud computing on ACPO’s core principles and asks whether these principles can still be applied in a cloud investigation and the challenges presented …
Column: Factors Affecting Data Decay,
2012
Johns Hopkins University
Column: Factors Affecting Data Decay, Kevin Fairbanks, Simson Garfinkel
Journal of Digital Forensics, Security and Law
In nuclear physics, the phrase decay rate is used to denote the rate that atoms and other particles spontaneously decompose. Uranium-235 famously decays into a variety of daughter isotopes including Thorium and Neptunium, which themselves decay to others. Decay rates are widely observed and wildly different depending on many factors, both internal and external. U-235 has a half-life of 703,800,000 years, for example, while free neutrons have a half-life of 611 seconds and neutrons in an atomic nucleus are stable.
Automated Identification And Reconstruction Of Youtube Video Access,
2012
Centre for Forensic Computing
Automated Identification And Reconstruction Of Youtube Video Access, Jonathan Patterson, Christopher Hargreaves
Journal of Digital Forensics, Security and Law
YouTube is one of the most popular video-sharing websites on the Internet, allowing users to upload, view and share videos with other users all over the world. YouTube contains many different types of videos, from homemade sketches to instructional and educational tutorials, and therefore attracts a wide variety of users with different interests. The majority of YouTube visits are perfectly innocent, but there may be circumstances where YouTube video access is related to a digital investigation, e.g. viewing instructional videos on how to perform potentially unlawful actions or how to make unlawful articles. When a user accesses a YouTube video …
Dns In Computer Forensics,
2012
University of Westminster
Dns In Computer Forensics, Neil F. Wright
Journal of Digital Forensics, Security and Law
The Domain Name Service (DNS) is a critical core component of the global Internet and integral to the majority of corporate intranets. It provides resolution services between the human-readable name-based system addresses and the machine operable Internet Protocol (IP) based addresses required for creating network level connections. Whilst structured as a globally dispersed resilient tree data structure, from the Global and Country Code Top Level Domains (gTLD/ccTLD) down to the individual site and system leaf nodes, it is highly resilient although vulnerable to various attacks, exploits and systematic failures.
Digital Evidence Education In Schools Of Law,
2012
University of Washington
Digital Evidence Education In Schools Of Law, Aaron Alva, Barbara Endicott-Popovsky
Journal of Digital Forensics, Security and Law
An examination of State of Connecticut v. Julie Amero provides insight into how a general lack of understanding of digital evidence can cause an innocent defendant to be wrongfully convicted. By contrast, the 101-page opinion in Lorraine v. Markel American Insurance Co. provides legal precedence and a detailed consideration for the admission of digital evidence. An analysis of both cases leads the authors to recommend additions to Law School curricula designed to raise the awareness of the legal community to ensure such travesties of justice, as in the Amero case, don’t occur in the future. Work underway at the University …
Identifying Trace Evidence From Target-Specific Data Wiping Application Software,
2012
California State Polytechnic University
Identifying Trace Evidence From Target-Specific Data Wiping Application Software, Gregory H. Carlton, Gary C. Kessler
Journal of Digital Forensics, Security and Law
One area of particular concern for computer forensics examiners involves situations in which someone utilized software applications to destroy evidence. There are products available in the marketplace that are relatively inexpensive and advertised as being able to destroy targeted portions of data stored within a computer system. This study was undertaken to analyze a subset of these tools in order to identify trace evidence, if any, left behind on disk media after executing these applications. We evaluated five Windows 7 compatible software products whose advertised features include the ability for users to wipe targeted files, folders, or evidence of selected …
Technology Corner Automated Data Extraction Using Facebook,
2012
Technology Corner Automated Data Extraction Using Facebook
Technology Corner Automated Data Extraction Using Facebook, Nick V. Flor
Journal of Digital Forensics, Security and Law
Because of Facebook’s popularity, law enforcement agents often use it as a key source of evidence. But like many user digital trails, there can be a large amount of data to extract for analysis. In this paper, we explore the basics of extracting data programmatically from a user’s Facebook via a Web app. A data extraction app requests data using the Facebook Graph API, and Facebook returns a JSON object containing the data. Before an app can access a user’s Facebook data, the user must log into Facebook and give permission. Thus, this approach is limited to situations where users …
Table Of Contents,
2012
Embry-Riddle Aeronautical University
Table Of Contents
Journal of Digital Forensics, Security and Law
No abstract provided.
Book Review: System Forensics, Investigation, And Response,
2012
Book Review: System Forensics, Investigation, and Response
Book Review: System Forensics, Investigation, And Response, Nate Keith
Journal of Digital Forensics, Security and Law
I recently expressed an interest to a respected colleague in finding a way to “give back” to the forensic community. He suggested writing a review for a text he recently received and provide feedback to the community. It is my intent to present an objective analysis of System Forensics, Investigation, and Response.
Column: Analysis Of Digital Traces,
2012
Fred Cohen & Associates
Column: Analysis Of Digital Traces, Fred Cohen
Journal of Digital Forensics, Security and Law
In part 1 of this series (Cohen, 2011a), Analysis of digital traces is a foundational process by which the examiner, typically using computer software tools, comes to understand and answer basic questions regarding digital traces.
Automatic Crash Recovery: Internet Explorer's Black Box,
2012
County of Cumberland
Automatic Crash Recovery: Internet Explorer's Black Box, John Moran, Douglas Orr
Journal of Digital Forensics, Security and Law
A good portion of today's investigations include, at least in part, an examination of the user's web history. Although it has lost ground over the past several years, Microsoft's Internet Explorer still accounts for a large portion of the web browser market share. Most users are now aware that Internet Explorer will save browsing history, user names, passwords and form history. Consequently some users seek to eliminate these artifacts, leaving behind less evidence for examiners to discover during investigations. However, most users, and probably a good portion of examiners are unaware Automatic Crash Recovery can leave a gold mine of …
To License Or Not To License Updated: An Examination Of State Statutes Regarding Private Investigators And Digital Examiners,
2012
Roger Williams University
To License Or Not To License Updated: An Examination Of State Statutes Regarding Private Investigators And Digital Examiners, Thomas Lonardo, Doug White, Alan Rea
Journal of Digital Forensics, Security and Law
In this update to the 2009 year's study, the authors examine statutes that regulate, license, and enforce investigative functions in each US state. After identification and review of Private Investigator licensing requirements, the authors find that very few state statutes explicitly differentiate between Private Investigators and Digital Examiners, but do see a trend of more states making some distinction. The authors contacted all state regulatory agencies where statutory language was not explicit, and as a result, set forth the various state approaches to professional Digital Examiner licensing. As was the case in the previous two iterations of this research, the …
Book Review: Dispute Resolution And E-Discovery,
2012
Metropolitan State University
Book Review: Dispute Resolution And E-Discovery, Milton Luoma
Journal of Digital Forensics, Security and Law
As is apparent from its title, this book tackles two very current and difficult legal issues – electronic discovery and dispute resolution. The authors tie the two legal concepts together in an effort to provide litigants and practitioners a less expensive and less time consuming alternative than is typically the case with traditional litigation and court proceedings. By including electronic discovery in the discussions, the authors recognize the importance and significance of electronic discovery in mediation and arbitration as it is in traditional litigation.
Table Of Contents,
2012
Embry-Riddle Aeronautical University
Table Of Contents
Journal of Digital Forensics, Security and Law
No abstract provided.
