First published November 2006
courtesy of GFI Software – www.gfi.com
Introduction
Underrated, undervalued and underutilized; events management is most often rated as a tedious and ungrateful task. System administrators shy away from event logs and the events contained within, citing … Read more
First published October 2006
by Brian Marofsky
What follows is a synopsis of the experience I had of conducting my first computer forensic investigation. It was my no means a text book investigation. I made my share of mistakes but … Read more
First published October 2006
Sgt. Christopher Then, CISSP, EnCE September 17, 2006
Computer Crimes Unit
Morris County Prosecutor’s Office
Morristown, NJ 07963
[email protected]
First published September 2006
Steve Mead
National Institute of Standards & Technology
100 Bureau Drive, Stop 8970
Gaithersburg, MD 20899
[email protected]
Abstract:
The National Software Reference Library (NSRL) provides a repository of known software, file profiles, and file signatures for … Read more
First published July 2006
by Chetan Gupta
NII Consulting, Mumbai
www.niiconsulting.com
First published May 2006
Brett Shavers
May 2006
VMWare Workstation is one of the most up and coming software applications in both the corporate environment and in the computer forensic community. This paper will not detail the inner workings of
First published May 2006
Preview Data in Under Twenty Minutes
by Thomas Rude
THE FARMER’S BOOT CD
Preview Data in Under Twenty Minutes
On January 1, 2006, THE FARMER’S BOOT CD, or FBCD for short, was officially released to the … Read more
First published April 2006
Lih Wern Wong
School of Computer and Information Science, Edith Cowan University
[email protected]
Abstract
Windows registry contains lots of information that are of potential evidential value or helpful in aiding forensic examiners on other aspects of … Read more
First published March 2006
by Nathan Weilbacher
I have been reading the posts in Forensic Focus for about a year now and on many occasions I have followed with great interest the threads of discussion on many topics. There are … Read more
First published January 2006
Cheong Kai Wee
Edith Cowan University
[email protected]
Abstract
Criminals with sensitive information such as crime records tend to hide/encrypt this information so that even if their computers are collected by police department, there is no evidence … Read more
First published December 2005
Mike Harrington, CFCE EnCE
[email protected]
Innovative Digital Forensic Solutions, L.L.C.
Mark Lachniet, CISA CISSP
[email protected]
Analysts International
Table of Contents
1.Document Overview
2.LIBPST/LIBDBX
3.Locating Exchange .dbx/.pst Files
3.2 Locating files in the filesystem
3.2.1 Deleted Files… Read more
First published October 2005
A Key Component of a Comprehensive Insider Threat Solution
James E. Wingate, CISSP-ISSEP, CISM, IAM
Director, Steganography Analysis & Research Center (SARC)
and
Vice President for West Virginia Operations
Backbone Security.Com
and
Chad W. Davis, CCE… Read more
First published September 2005
Mariusz Burdach
[email protected]
Warsaw, March 2005
last update: July 11, 2005
Abstract
This paper presents methods by which physical memory from a compromised machine can be analyzed. Through this methods, it is possible to extract useful … Read more
First published September 2005
Venansius Baryamureeba and Florence Tushabe
[email protected], [email protected]
Institute of Computer Science, Makerere University
P.O.Box 7062, Kampala Uganda
www.makerere.ac.ug/ics
May 27, 2004
Abstract
Computer crimes are on the rise and unfortunately less than two percent of the … Read more
First published August 2005
by James E. Wingate, CISSP-ISSEP, CISM, IAM
Director, Steganography Analysis & Research Center
www.sarc-wv.com
Chad W. Davis
Computer Security Engineer
Backbone Security.Com
www.backbonesecurity.com
Introduction
Rapidly evolving computer and networking technology coupled with a dramatic expansion in … Read more
First published June 2005
by Steven McLeod
steven [email protected] com au
May 2005
EXECUTIVE SUMMARY
This paper highlights an oversight in the current industry best practice procedure for forensically duplicating a hard disk. A discussion is provided which demonstrates that … Read more