Ipad2 Logical Acquisition: Automated Or Manual Examination?,
2012
Zayed University
Ipad2 Logical Acquisition: Automated Or Manual Examination?, Somaya Ali, Sumaya Alhosani, Farah Alzarooni, Ibrahim Baggili
Electrical & Computer Engineering and Computer Science Faculty Publications
Due to their usage increase worldwide, iPads are on the path of becoming key sources of digital evidence in criminal investigations. This research investigated the logical backup acquisition and examination of the iPad2 device using the Apple iTunes backup utility while manually examining the backup data (manual examination) and automatically parsing the backup data (Lantern software-automated examination).The results indicate that a manual examination of the logical backup structure from iTunes reveals more digital evidence, especially if installed application data is required for an investigation. However, the researchers note that if a quick triage is needed of an iOS device, then …
Older, Wiser, Novice: An Autoethnographic Study Of Nontraditional Students' Participation In Collegiate Forensics,
2012
Minnesota State University - Mankato
Older, Wiser, Novice: An Autoethnographic Study Of Nontraditional Students' Participation In Collegiate Forensics, Laura Kathleen Pelletier
All Graduate Theses, Dissertations, and Other Capstone Projects
There is a growing trend in nontraditional college student enrollments in the United States. Older, nontraditional students are currently the majority on many college campuses. Due to the constraints on nontraditional students' time, they are often unable to spend as much time on campus as traditional students and are unable to fully partake in campus life and socialization. Cocurricular activities, such as collegiate forensics, can be time consuming activities which for nontraditional students, especially those who have children, may seem like an impossible fit for their already busy schedules. Because college demographics continue to change and there are a growing …
Forensics And The Basic Communication Course: A New Path To Satisfying Learning Outcomes,
2012
Minnesota State University - Mankato
Forensics And The Basic Communication Course: A New Path To Satisfying Learning Outcomes, Benjamin Walker
All Graduate Theses, Dissertations, and Other Capstone Projects
Forensic scholars have long written about the educational benefits of forensics, but very few have attempted to tie the activity to learning objectives from the curriculum. This thesis seeks to determine if collegiate forensics can offer the same learning opportunities as one of the most common and fundamental communication classes in the discipline: the basic communication course. This research uses experiential learning as a pedagogical framework for forensics in attempting to answer if forensics can offer the same learning opportunities of the basic communication course, and if so, how the activity does this and what the students actually learn. Likert …
Column: The Physics Of Digital Information-Part 2,
2012
CEO, Fred Cohen & Associates President, California Sciences Institute
Column: The Physics Of Digital Information-Part 2, Fred Cohen
Journal of Digital Forensics, Security and Law
In part 1 of this series (Cohen, 2011a), we discussed some of the basics of building a physics of digital information. Assuming, as we have, that science is about causality and that a scientific theory should require that cause(C) produces effect (E) via mechanism M (written C→ME), we explore that general theory of digital systems from the perspective of attributing effects (i.e., traces of activities in digital systems) to their causes. Full details of the current version of this physics are available online2 , and in this article, we explore a few more of them.
Comparing Android Applications To Find Copying,
2012
Virtual System Platform Cadence Design Systems
Comparing Android Applications To Find Copying, Larry Melling, Bob Zeidman
Journal of Digital Forensics, Security and Law
The Android smartphone operating system includes a Java virtual machine that enables rapid development and deployment of a wide variety of applications. The open nature of the platform means that reverse engineering of applications is relatively easy, and many developers are concerned as applications similar to their own show up in the Android marketplace and want to know if these applications are pirated. Fortunately, the same characteristics that make an Android application easy to reverse engineer and copy also provide opportunities for Android developers to compare downloaded applications to their own. This paper describes the process for comparing a developer’s …
An Overview Of The Jumplist Configuration File In Windows 7,
2012
University of Warwick, Coventry
An Overview Of The Jumplist Configuration File In Windows 7, Harjinder S. Lallie, Parmjit S. Bains
Journal of Digital Forensics, Security and Law
The introduction of Jumplists in Windows 7 was an important feature from a forensic examiners viewpoint. Jumplist configuration files can provide the examiner with a wealth of information relating to file access and in particular: dates/times, Volume GUIDs and unique file object IDs relating to those files. Some of the information in the Jumplist could be used to build a more precise timeline relating to system and file usage. In this article, we analyse the structure of a Jumplist configuration file and in particular a record from a Jumplist configuration file and highlight some of the important entries therein.
Pandora’S Email Box? An Exploratory Study Of Web-Based Email Forgery Detection And Validation.,
2012
Murdoch University
Pandora’S Email Box? An Exploratory Study Of Web-Based Email Forgery Detection And Validation., Richard Boddington, Grant Boxall, Jeremy Ardley
Journal of Digital Forensics, Security and Law
Web based email systems may be a source of pristine digital evidence because of the perceived difficulty of client tampering with messages stored inside the email account. We demonstrate that such assumption is wrong in the case of Windows Live Hotmail®1 . Windows Live Mail®1 synchronises message on client-side computers with the Hotmail® server, benefiting users wishing to synchronise their email accounts and personal devices. However, this synchronisation opens an exploit for wrongdoers to tamper with existing email messages and attachments as well as facilitating the insertion of fabricated messages. The exploit process enables persistent storage of tampered and fabricated …
Book Review: The Software Ip Detective's Handbook: Measurement, Comparison, And Infringement Detections,
2012
American Military University
Book Review: The Software Ip Detective's Handbook: Measurement, Comparison, And Infringement Detections, Diane Barrett
Journal of Digital Forensics, Security and Law
Do not the book title fool you into thinking that the book is only for those looking to detect software infringement detection. It is a comprehensive look at software intellectual property. The book covers a wide range of topics and has something to offer for just about everyone from lawyers to programmers.
Technology Corner: Dating Of Electronic Hardware For Prior Art Investigations,
2012
VintageTech
Technology Corner: Dating Of Electronic Hardware For Prior Art Investigations, Sellam Ismail
Journal of Digital Forensics, Security and Law
In many legal matters, specifically patent litigation, determining and authenticating the date of computer hardware or other electronic products or components is often key to establishing the item as legitimate evidence of prior art. Such evidence can be used to buttress claims of technologies available or of events transpiring by or at a particular date.
Applying The Acpo Principles In Public Cloud Forensic Investigations,
2012
University of Warwick, Coventry
Applying The Acpo Principles In Public Cloud Forensic Investigations, Harjinder S. Lallie, Lee Pimlott
Journal of Digital Forensics, Security and Law
The numerous advantages offered by cloud computing has fuelled its growth and has made it one of the most significant of current computing trends. The same advantages have created complex issues for those conducting digital forensic investigations. Digital forensic investigators rely on the ACPO (Association of Chief Police Officers) or similar guidelines when conducting an investigation, however the guidelines make no reference to some of the issues presented by cloud investigations. This study investigates the impact of cloud computing on ACPO’s core principles and asks whether these principles can still be applied in a cloud investigation and the challenges presented …
Column: Factors Affecting Data Decay,
2012
Johns Hopkins University
Column: Factors Affecting Data Decay, Kevin Fairbanks, Simson Garfinkel
Journal of Digital Forensics, Security and Law
In nuclear physics, the phrase decay rate is used to denote the rate that atoms and other particles spontaneously decompose. Uranium-235 famously decays into a variety of daughter isotopes including Thorium and Neptunium, which themselves decay to others. Decay rates are widely observed and wildly different depending on many factors, both internal and external. U-235 has a half-life of 703,800,000 years, for example, while free neutrons have a half-life of 611 seconds and neutrons in an atomic nucleus are stable.
Automated Identification And Reconstruction Of Youtube Video Access,
2012
Centre for Forensic Computing
Automated Identification And Reconstruction Of Youtube Video Access, Jonathan Patterson, Christopher Hargreaves
Journal of Digital Forensics, Security and Law
YouTube is one of the most popular video-sharing websites on the Internet, allowing users to upload, view and share videos with other users all over the world. YouTube contains many different types of videos, from homemade sketches to instructional and educational tutorials, and therefore attracts a wide variety of users with different interests. The majority of YouTube visits are perfectly innocent, but there may be circumstances where YouTube video access is related to a digital investigation, e.g. viewing instructional videos on how to perform potentially unlawful actions or how to make unlawful articles. When a user accesses a YouTube video …
Dns In Computer Forensics,
2012
University of Westminster
Dns In Computer Forensics, Neil F. Wright
Journal of Digital Forensics, Security and Law
The Domain Name Service (DNS) is a critical core component of the global Internet and integral to the majority of corporate intranets. It provides resolution services between the human-readable name-based system addresses and the machine operable Internet Protocol (IP) based addresses required for creating network level connections. Whilst structured as a globally dispersed resilient tree data structure, from the Global and Country Code Top Level Domains (gTLD/ccTLD) down to the individual site and system leaf nodes, it is highly resilient although vulnerable to various attacks, exploits and systematic failures.
Digital Evidence Education In Schools Of Law,
2012
University of Washington
Digital Evidence Education In Schools Of Law, Aaron Alva, Barbara Endicott-Popovsky
Journal of Digital Forensics, Security and Law
An examination of State of Connecticut v. Julie Amero provides insight into how a general lack of understanding of digital evidence can cause an innocent defendant to be wrongfully convicted. By contrast, the 101-page opinion in Lorraine v. Markel American Insurance Co. provides legal precedence and a detailed consideration for the admission of digital evidence. An analysis of both cases leads the authors to recommend additions to Law School curricula designed to raise the awareness of the legal community to ensure such travesties of justice, as in the Amero case, don’t occur in the future. Work underway at the University …
Identifying Trace Evidence From Target-Specific Data Wiping Application Software,
2012
California State Polytechnic University
Identifying Trace Evidence From Target-Specific Data Wiping Application Software, Gregory H. Carlton, Gary C. Kessler
Journal of Digital Forensics, Security and Law
One area of particular concern for computer forensics examiners involves situations in which someone utilized software applications to destroy evidence. There are products available in the marketplace that are relatively inexpensive and advertised as being able to destroy targeted portions of data stored within a computer system. This study was undertaken to analyze a subset of these tools in order to identify trace evidence, if any, left behind on disk media after executing these applications. We evaluated five Windows 7 compatible software products whose advertised features include the ability for users to wipe targeted files, folders, or evidence of selected …
Technology Corner Automated Data Extraction Using Facebook,
2012
Technology Corner Automated Data Extraction Using Facebook
Technology Corner Automated Data Extraction Using Facebook, Nick V. Flor
Journal of Digital Forensics, Security and Law
Because of Facebook’s popularity, law enforcement agents often use it as a key source of evidence. But like many user digital trails, there can be a large amount of data to extract for analysis. In this paper, we explore the basics of extracting data programmatically from a user’s Facebook via a Web app. A data extraction app requests data using the Facebook Graph API, and Facebook returns a JSON object containing the data. Before an app can access a user’s Facebook data, the user must log into Facebook and give permission. Thus, this approach is limited to situations where users …
Table Of Contents,
2012
Embry-Riddle Aeronautical University
Table Of Contents
Journal of Digital Forensics, Security and Law
No abstract provided.
Book Review: System Forensics, Investigation, And Response,
2012
Book Review: System Forensics, Investigation, and Response
Book Review: System Forensics, Investigation, And Response, Nate Keith
Journal of Digital Forensics, Security and Law
I recently expressed an interest to a respected colleague in finding a way to “give back” to the forensic community. He suggested writing a review for a text he recently received and provide feedback to the community. It is my intent to present an objective analysis of System Forensics, Investigation, and Response.
Column: Analysis Of Digital Traces,
2012
Fred Cohen & Associates
Column: Analysis Of Digital Traces, Fred Cohen
Journal of Digital Forensics, Security and Law
In part 1 of this series (Cohen, 2011a), Analysis of digital traces is a foundational process by which the examiner, typically using computer software tools, comes to understand and answer basic questions regarding digital traces.
Automatic Crash Recovery: Internet Explorer's Black Box,
2012
County of Cumberland
Automatic Crash Recovery: Internet Explorer's Black Box, John Moran, Douglas Orr
Journal of Digital Forensics, Security and Law
A good portion of today's investigations include, at least in part, an examination of the user's web history. Although it has lost ground over the past several years, Microsoft's Internet Explorer still accounts for a large portion of the web browser market share. Most users are now aware that Internet Explorer will save browsing history, user names, passwords and form history. Consequently some users seek to eliminate these artifacts, leaving behind less evidence for examiners to discover during investigations. However, most users, and probably a good portion of examiners are unaware Automatic Crash Recovery can leave a gold mine of …
