Legal Studies Commons^™

Developing Voip Honeypots: A Preliminary Investigation Into Malfeasant Activity, Craig Valli

Journal of Digital Forensics, Security and Law

30 years ago PABX systems were compromised by hackers wanting to make long distance calls at some other entities expense. This activity faded as telephony became cheaper and PABX systems had countermeasures installed to overcome attacks. Now the world has moved onto the provision of telephony via broadband enabled Voice over Internet Protocol (VoIP) with this service now being provided as a replacement for conventional fixed wire telephony by major telecommunication providers worldwide. Due to increasing bandwidth it is possible for systems to support multiple voice connections simultaneously. The networked nature of the Internet allows for attackers of these VoIP …

Adaptation Of Pyflag To Efficient Analysis Of Seized Computer Data Storage, Aleksander Byrski, Wojciech Stryjewski, Bartłomiej Czechowicz

Journal of Digital Forensics, Security and Law

Based on existing software aimed at investigation support in the analysis of computer data storage seized during investigation (PyFlag), an extension is proposed involving the introduction of dedicated components for data identification and filtering. Hash codes for popular software contained in NIST/NSRL database are considered in order to avoid unwanted files while searching and to classify them into several categories. The extension allows for further analysis, e.g. using artificial intelligence methods. The considerations are illustrated by the overview of the system's design.

Avoiding Sanctions At The E-Discovery Meet-And-Confer In Common Law Countries, Milton Luoma, Vicki Luoma

Journal of Digital Forensics, Security and Law

The rules of civil procedure in common law countries have been amended to better deal with the requirements of electronic discovery. One of the key changes in case management is the scheduling of a meet-and-confer session where the parties to litigation must meet early in the case before any discovery procedures have begun to exchange information regarding the nature, location, formats, and pertinent facts regarding custody and control of a party’s electronically stored information (ESI). Failure to abide by the rules and participate in good faith at the meet-and-confer session can have dire consequences for the parties and lawyers involved. …

Malware Forensics: Discovery Of The Intent Of Deception, Murray Brand, Craig Valli, Andrew Woodward

Journal of Digital Forensics, Security and Law

Malicious software (malware) has a wide variety of analysis avoidance techniques that it can employ to hinder forensic analysis. Although legitimate software can incorporate the same analysis avoidance techniques to provide a measure of protection against reverse engineering and to protect intellectual property, malware invariably makes much greater use of such techniques to make detailed analysis labour intensive and very time consuming. Analysis avoidance techniques are so heavily used by malware that the detection of the use of analysis avoidance techniques could be a very good indicator of the presence of malicious intent. However, there is a tendency for analysis …

Digital Records Forensics: A New Science And Academic Program For Forensic Readiness, Luciana Duranti, Barbara Endicott-Popovsky

Journal of Digital Forensics, Security and Law

This paper introduces the Digital Records Forensics project, a research endeavour located at the University of British Columbia in Canada and aimed at the development of a new science resulting from the integration of digital forensics with diplomatics, archival science, information science and the law of evidence, and of an interdisciplinary graduate degree program, called Digital Records Forensics Studies, directed to professionals working for law enforcement agencies, legal firms, courts, and all kind of institutions and business that require their services. The program anticipates the need for organizations to become “forensically ready,” defined by John Tan as “maximizing the ability …

Solid State Drives: The Beginning Of The End For Current Practice In Digital Forensic Recovery?, Graeme B. Bell, Richard Boddington

Journal of Digital Forensics, Security and Law

Digital evidence is increasingly relied upon in computer forensic examinations and legal proceedings in the modern courtroom. The primary storage technology used for digital information has remained constant over the last two decades, in the form of the magnetic disc. Consequently, investigative, forensic, and judicial procedures are well-established for magnetic disc storage devices (Carrier, 2005). However, a paradigm shift has taken place in technology storage and complex, transistor-based devices for primary storage are now increasingly common. Most people are aware of the transition from portable magnetic floppy discs to portable USB transistor flash devices, yet the transition from magnetic hard …

Book Review: Digital Forensic Evidence Examination (2nd Ed.), Gary C. Kessler

Journal of Digital Forensics, Security and Law

On the day that I sat down to start to write this review, the following e-mail came across on one of my lists: Person A and Person B write back and forth and create an email thread. Person A then forwards the email to Person C, but changes some wording in the email exchange between A & B. What is the easiest way (and is it even possible) to find out when that earlier email message was altered before sent to Person C? Before you try to answer these questions, read Fred Cohen's Digital Forensic Evidence Examination. His book won't …

Identifying A Computer Forensics Expert: A Study To Measure The Characteristics Of Forensic Computer Examiners, Gregory H. Carlton, Reginald Worthley

Journal of Digital Forensics, Security and Law

The usage of digital evidence from electronic devices has been rapidly expanding within litigation, and along with this increased usage, the reliance upon forensic computer examiners to acquire, analyze, and report upon this evidence is also rapidly growing. This growing demand for forensic computer examiners raises questions concerning the selection of individuals qualified to perform this work. While courts have mechanisms for qualifying witnesses that provide testimony based on scientific data, such as digital data, the qualifying criteria covers a wide variety of characteristics including, education, experience, training, professional certifications, or other special skills. In this study, we compare task …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Cybercrime And The 2012 London Olympics, Denis Edgar-Nevill

Annual ADFSL Conference on Digital Forensics, Security and Law

The London 2012 Olympics is just three years away and the clock is ticking to put in place plans get it right. The potential for cybercrime to cause harm during this event is very great; harm to national reputation, harm to the reputation to the Olympic movement, and harm to individuals competing, watching or officiating. This paper considers the need to address these risks by taking a look at what has happened in the past at sporting events and the rising wave of electronic security threats and fraud facilitated by computers at recent Olympics. The problems for law enforcement are …

Methodology For Investigating Individuals Online Social Networking Persona, Jonathan T. Rajewski

Annual ADFSL Conference on Digital Forensics, Security and Law

When investigators from either the private or public sector review digital data surrounding a case for evidentiary value, they typically conduct a systematic categorization process to identify the relevant digital devices. Armed with the proper methodology to accomplish this task, investigators can quickly recognize the appropriate digital devices for forensic processing and review. This paper purposes a methodology for investigating an individual’s online social networking persona.

Keywords: Social Networking, Web 2.0, Internet Investigations, Online Social Networking Community

Bluetooth Hacking: A Case Study, Dennis Browning, Gary C. Kessler

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper describes a student project examining mechanisms with which to attack Bluetooth-enabled devices. The paper briefly describes the protocol architecture of Bluetooth and the Java interface that programmers can use to connect to Bluetooth communication services. Several types of attacks are described, along with a detailed example of two attack tools, Bloover II and BT Info.

Keywords: Bluetooth hacking, mobile phone hacking, wireless hacking

Concerning File Slack, Stephen P. Larson

Annual ADFSL Conference on Digital Forensics, Security and Law

In this paper we discuss the phenomena known as file slack. File slack is created each time a file is created on a hard disk, and can contain private or confidential data. Unfortunately, the methods used by Microsoft Windows operating systems to organize and save files require file slack, and users have no control over what data is saved in file slack. This document will help create awareness about the security issue of file slack and discuss research results concerning file slack.

Keywords : Computer Forensics, File Slack, Ram Slack, Disk Slack

Don’T Touch That! And Other E-Discovery Issues, Linda Volonino

Annual ADFSL Conference on Digital Forensics, Security and Law

The ability to preserve and access electronically stored information (ESI) took on greater urgency when amendments to the Federal Rules of Civil Procedure went into effect in December 2006. These amendments, referred to as the electronic discovery (e-discovery) amendments, focus on the discovery phase of civil litigation, audits, or investigations. Discovery is the investigative phase of a legal case when opponents learn what evidence is available and how accessible it is. When ESI is the subject of discovery, it is called e-discovery. Recognizing that most business and personal records and communications are electronic, Judge Shira A. Scheindlin stated, "We used …

Why Are We Not Getting Better At Data Disposal?, Andy Jones

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper describes two sets of research, the first of which has been carried out over a period of four years into the levels and types of information that can be found on computer hard disks that are offered for sale on the second hand market. The second research project examined a number of second-hand hand held devices including PDAs, mobile (cell) phones and RIM Blackberry devices. The primary purpose of this research was to gain an understanding of the reasons for the failure to effectively remove potentially sensitive information from the disks and handheld devices. Other objectives included determining …

The Computer Fraud And Abuse Act And The Law Of Unintended Consequences, Milton Luoma, Vicki Luoma

Annual ADFSL Conference on Digital Forensics, Security and Law

One of the most unanticipated results of the Computer Fraud and Abuse Act arose from the law of unintended consequences. The CFAA was originally enacted in 1984 to protect federal government computers from intrusions and damage caused by hackers, identity thieves, and other cyber criminals. The law was later amended to extend the scope of its application to financial institutions’, business’s and consumers’ computers. To aid in the pursuit of cyber criminals, one of the subsequent revisions to the law included provision “G” that gave the right to private parties to seek compensation for damages in a civil action for …

Correlating Orphaned Windows Registry Data Structures, Damir Kahvedžić, Tahar Kechadi

Annual ADFSL Conference on Digital Forensics, Security and Law

Recently, it has been shown that deleted entries of the Microsoft Windows registry (keys) may still reside in the system files once the entries have been deleted from the active database. Investigating the complete keys in context may be extremely important from both a Forensic Investigation point of view and a legal point of view where a lack of context can bring doubt to an argument. In this paper we formalise the registry behaviour and show how a retrieved value may not maintain a relation to the part of the registry it belonged to and hence lose that context. We …

Analysis Of The ‘Db’ Windows Registry Data Structure, Damir Kahvedžić, Tahar Kechadi

Annual ADFSL Conference on Digital Forensics, Security and Law

The Windows Registry stores a wide variety of data representing a host of different user properties, settings and program information. The data structures used by the registry are designed to be adaptable to store these differences in a simple format. In this paper we will highlight the existence of a rare data structure that is used to store a large amount of data within the registry hives. We analyse the manner in which this data structure stores its data and the implications that it may have on evidence retrieval and digital investigation. In particular, we reveal that the three of …

Graduate Accounting Students' Perception Of It Forensics: A Multi-Dimensional Analysis, Grover S. Kearns

Annual ADFSL Conference on Digital Forensics, Security and Law

Forensics and information technology (IT) have become increasingly important to accountants and auditors. Undergraduate accounting students are introduced to general IT topics but discussion of forensic knowledge is limited. A few schools have introduced an undergraduate major in forensic accounting. Some graduate schools offer accounting students an emphasis in forensic or fraud accounting that includes instruction in forensics and information technology. When students do not view the IT topics as being equally important to their careers as traditional accounting topics, these attitudes may reduce the quality of the course. In an effort to assess student attitudes, a survey of 46 …

Visualization Of Honeypot Data Using Graphviz And Afterglow, Craig Valli

Annual ADFSL Conference on Digital Forensics, Security and Law

This research in progress paper explores the use of Graphviz and Afterglow for the analysis of data emanating from a honeypot system. Honeypot systems gather a wide range of data that is often difficult to readily search for patterns and trends using conventional log file analysis techniques. The data from the honeypots has been statically extracted and processed through Afterglow scripts to produce inputs suitable for use by the DOT graph based tools contained within Graphviz. This paper explores some of the benefits and drawbacks of currently using this type of approach.

Keywords: honeypot, network forensics, visualization, Graphviz, Afterglow

Volume 02, Joseph A. Mann, Kathryn J. Greenly, Scott E. Jenkins, Andrew E. Puckette, Daniel M. Honey, Jeffery P. Ravenhorst, Jamie Elizabeth Mesrobian, Thomas Scott, Jay Crowell, Sarah Spangenberg, Amy S. Eason, Kenny Wolfe, Liz Hale, Rachel Bouchard, Will Semonco, Carley York, Ryan Higgenbothom, Adrienne Heinbaugh, Melissa Dorton, Madeline Hunter, June Ashmore, Clark Barkley, Jay Haley

Incite: The Journal of Undergraduate Scholarship

Introduction from Dean Dr. Charles Ross

Mike's Nite: New Jazz for an Old Instrument by Joseph A. Mann

Investigation of the use of Cucumis Sativus for Remediation Of Chromium from Contaminated Environmental Matrices: An Interdisciplinary Instrumental Analysis Project by Kathryn J. Greenly, Scott E. Jenkins, and Andrew E. Puckette

Development of GC-MS and Chemometric Methods for the Analysis of Accelerants in Arson Cases by Scott Jenkins

Building and Measuring Scalable Computing Systems by Daniel M. Honey and Jeffery P. Ravenhorst

Nomini Hall: A Case Study in the Use of Archival Resources as Guides for Excavation at An Archaeological Site by …

A University-Based Forensics Training Center As A Regional Outreach, Education, And Research Activity, Rayford B. Vaughn, David A. Dampier

Computer Sciences and Electrical Engineering Faculty Research

This paper describes a university-based Forensics Training Center (FTC) established by a Department of Justice grant for the purpose of improving the ability of state and local law enforcement in the Southeastern part of the United States to address the rising incidence of computer based crime. The FTC effort is described along with supporting evidence of its need. The program is not only a service activity, but also contributes to the Mississippi State University (MSU) security program pedagogy, and research effort.

The Deterrent Effect Of Death Penalty Eligibility: Evidence From The Adoption Of Child Murder Eligibility Factors, Michael D. Frakes, Matthew Harding

Faculty Scholarship

We draw on within-state variations in the reach of capital punishment statutes between 1977 and 2004 to identify the deterrent effects associated with capital eligibility. Focusing on the most prevalent eligibility expansion, we estimate that the adoption of a child murder factor is associated with an approximately 20% reduction in the homicide rate of youth victims. Eligibility expansions may enhance deterrence by (1) paving the way for more executions and (2) providing prosecutors with greater leverage to secure enhanced non-capital sentences. While executions themselves are rare, this latter channel is likely to be triggered fairly regularly, providing a reasonable basis …

Defining A Forensic Audit, G. S. Smith, D. L. Crumbley

Journal of Digital Forensics, Security and Law

Disclosures about new financial frauds and scandals are continually appearing in the press. As a consequence, the accounting profession's traditional methods of monitoring corporate financial activities are under intense scrutiny. At the same time, there is recognition that principles-based GAAP from the International Accounting Standards Board will become the recognized standard in the U.S. The authors argue that these two factors will change the practices used to fight corporate malfeasance as investigators adapt the techniques of accounting into a forensic audit engagement model.

Visualisation Of Honeypot Data Using Graphviz And Afterglow, Craig Valli

Journal of Digital Forensics, Security and Law

This research in progress paper explores the use of Graphviz and Afterglow for the analysis of data emanating from a honeypot system. Honeypot systems gather a wide range of data that is often difficult to readily search for patterns and trends using conventional log file analysis techniques. The data from the honeypots has been statically extracted and processed through Afterglow scripts to produce inputs suitable for use by the DOT graph based tools contained within Graphviz. This paper explores some of the benefits and drawbacks of currently using this type of approach.

Insecurity By Obscurity: A Review Of Soho Router Literature From A Network Security Perspective, Patryk Szewczyk, Craig Valli

Journal of Digital Forensics, Security and Law

Because of prevalent threats to SoHo based ADSL Routers, many more devices are compromised. Whilst an end-user may be at fault for not applying the appropriate security mechanisms to counter these threats, vendors should equally share the blame. This paper reveals that the lack of security related content and poor overall design could impact on end-users’ interpretation and willingness to implement security controls on their ADSL router. It argues that whilst the number of threats circulating the Internet is increasing, vendors are not improving their product literature.

Program And Proceedings: Nebraska Academy Of Sciences 1880–2009, 129th Anniversary Year, One Hundred-Nineteenth Annual Meeting

Nebraska Academy of Sciences: Programs and Proceedings

Program

Aeronautics and Space Science

Collegiate Academy: Biology

Earth Science

Collegiate Academy: Chemistry and Physics

Biological and Medical Sciences

Nebraska Wesleyan University Health and Sciences Graduate School Fair

Junior Academy: Senior High Competition

Aeronautics and Space Science, Poster Session

History and Philosophy of Science

Teaching of Science and Math

Maiben Memorial Lecture: Donald Frey, Department of Family Practice, Creighton University Medical Center

Anthropology

Chemistry and Physics

Junior Academy, Junior High Competition

Telecommunications Liberalisation In Africa: Proposed Regulatory Model For The Sadc Region, Z. N. Jobodwana

Journal of Digital Forensics, Security and Law

The liberalisation of the telecommunication industry in Africa, and the further development of the region’s physical infrastructure was accompanied by the further development of Africa’s information, communication and technology infrastructure. Competition within the industry stimulated heavy economic investment in other sectors of the economy. The outcome of liberalisation also included the establishment of community-based structures that continue to enable communities to manage their own development and gain access to information and communication technologies (ICTs) in an unprecedented manner. The telecommunication infrastructure further stimulated the fast development of other related services, for example, ecommerce and mobile commerce (m-commerce), e-government, internet banking, …

Self-Reported Cyber Crime: An Analysis On The Effects Of Anonymity And Pre-Employment Integrity, Ibrahim Baggili, Marcus Rogers

Electrical & Computer Engineering and Computer Science Faculty Publications

A key issue facing today’s society is the increase in cyber crimes. Cyber crimes pose threats to nations, organizations and individuals across the globe. Much of the research in cyber crime has risen from computer science-centric programs, and little experimental research has been performed on the psychology of cyber crime. This has caused a knowledge gap in the study of cyber crime. To this end, this research focuses on understanding psychological concepts related to cyber crime. Through an experimental design, participants were randomly assigned to three groups with varying degrees of anonymity. After each treatment, participants were asked to self-report …

The Forensic Analysis Of Triacetone Triperoxide (Tatp) Precursors And Synthetic By-Products, Kimberly Painter

Electronic Theses and Dissertations

Triacetone Triperoxide (TATP) is a primary high explosive that can be synthesized using commercially available starting materials and has grown in use among terrorists over the past several years. Additives present in the precursors were investigated to see if they carry through the TATP synthesis and can be detected in the final product potentially aiding in the identification of the source. Additives identified in the acetones were also identified in pre-blast and in some post-blast samples. However, these additives are present in trace quantities relative to the TATP, which coupled with the volatility and short lifetimes of some of the …