computer forensic capabilities migrationconfirmed set · pdf filecomputer forensic...

4
Crimson and White VOL. XIV. No. 9 THE MILNE SCHOOL, ALBANY, N. Y. FEBRUARY 16, 1945 Co-ed Antics Planned--Wow!! On Tuesday evening, March 27, a new event will be written in the history of Milne. This will be a combined boys and girlsgym night with all Milne gym classes par- ticipating jointly. Mrs. Merle Ties- zen, girlsathletic instructor, and Coach Merlin Hathaway, director of boysphysical education, have been planning together the events to take place. The theme upon which the gym night is to be presented w.ill follow the pattern of a Spanish Fiesta. The Sophomore class has already begun to practice their part of the entertainment. They are learning American Square Dances to which Spanish touch will be added m keeping with the theme of the Fiesta. The gym classes are now being combined so that half the class meets Monday and Wednesday, and the other will be together on Tues- days and Thursdays. The traditional girlsbasketball games, the freshmen versus the sophomores, and the juniors versus the seniors, usually played on gym nights, will be played on some other night. The Adelphoi-Theta Nu game will also be postponed until some future date. The Coach and Mrs. Tieszen hope to be able to arrange this dual bas- ketball program for some night after the close of the basketball season, so as to be a greater attrac- tion to all students. Brick and Ivy Get New Art Staff The Bricks and Ivy has two pew associate editors, as this issue goes to press. Lois Messent and Jean- nette Price have been appointed by Miss Grace Martin, faculty adviser to the Bricks and Ivy. Both are be- ing used in the capacity of Art edi- tors. Lois, who has won many local prizes for her illustrations, is in charge of this phase of the work. Jeannette is to do the arrangements and organization. Since she also has had a great deal of experience in her field, the Bricks and Ivy should be well planned and illus- trated. Dr. Henrickson is still complet- ing photographic assignments with the various organizations, but the work is scheduled to be finished very soon. Page dummeys are be- ing worked on. and Betty Stone, editor-in-chief says, With the co- operation of every one on the staff, this years yearbook should turn out to be the best on record.Geniuses Again Honored; Office Releases List Again the sophomores take the proverbial cake, as far as scholastic averages go. With nineteen names to their credit, they have but two male names to thank. This adds just one more proof of which is really the superior sex!! The freshman are next with nine names on their roster. The juniors are tied with the seniors for last place, but Mary Mapes again re- deems the juniors by having the highest average recorded. Her 97.2 (especially for a mid-year average) is breathtaking. Names are as fol- lows: Twelfth Grade Kctzin, Gerald .......................... . .. 92.5 Wiley, Janet .............................. , . . 92.2 Cohen, Beverly ........................ . . 91.8 Bayreuther, Julia .................... , .. 91.1 Carlson, C. Theodore ............ ... 91. Meskil, Shirley ........................ . . 90.5 Meehan, Lois ............................ . . . 90.2 Messent, Lois .......................... . .. 90. Sexton, Elaine .......................... ... 90. Eleventh Grade Mapes, Mary .......................... . .. 97.2 Pirnie, Jean .............................. . . 94.4 Bull, William ............................ . . . 93.8 Jacobs, Carol ............................ , .. 92.7 Brehm, Diane ........................ .. . . 92.2 Smith, Barbara ...................... .. .. 91.7 Bonsall, Nancy ........................ . . . 91. Herrick, Richard .................... . . 90. Woolfolk, Nancy .................... . .. 90. Tenth Grade Bookstein, Marjorie ................ . .. 94.8 Richter, Leona ........................ ... 94. Silverman, Anne ...................... ... 93.6 Gaus, Sally .............................. . .. 93.1 Martin, Mabel ........................ ... 93. Leslie, Barbara ........................ . .. 93. Drake, Florence .................... . . . 92.8 Schmidt, Marie ........................ ... 92. Thompson, John ...................... ... 92. Barnet, Jesse ............................ . .. 91.1 Jones, Katherine .................. . . . 91. Forth, Adele ............................ ... 91. Traver, Joan .......................... . .. 91. Flanders, Bettie-Jane .......... . . . 90.8 Fletcher, Ellen ...................... . .. 90.3 Ambler, Ruth ........................ . .. 90.1 Clark, Nancy .......................... ... 90.1 Betham, Barbara .................. . .. 90. Mohling, Franz! .................... ... 90. Ninth Grade Leslie, Robert ........................ Pelletier, Suzanne ................ . .. 91.6 French, Nancy ...................... . .. 91.1 Abernathy, Robert ................ ... 91. Fiske, Mary Jane .................. . . . 90.8 Clarke. Robert ........................ . . . 90.6 Herrick, Carolyn ................ .. . 90.5 Underwood, Ann .............. . . . 90.5 Blum, Arlene ........................ . .. 90.1 Kotzin, Rosara ...................... ... 90. Meserve, Donald .................. ... 90. All-Stars Lose Benefit Game The third polio benefit game be- tween the Albany-All Stars and the Schenectady Mont Pleasant Red Raiders was held Wednesday, Feb- ruary first in the C B A gym. There was an estimated crowd of five thousand to witness the Albany All-Stars go down to an inglorious defeat. Off to a slow start, the Red Raiders went to work in the second period and roared to a 57-39 vic- tory over the All-Stars. Comes from Behind Strange as it may seem, the Sche- nectady team was compelled to come from behind to win. Sig Ma_ kofskis mighty quintet trailed in the early minutes, 5-1, knotted the contest 6-6 and were behind 9-6 at the end of the stanza. John Dieckleman, started a strong well-rounded club, featuring Ed Muehlick, and Lee Aronowitz of Milne, Dan Hogan and Jim Dickle- man of VI, and Angelo Salamone of CBA. Milne has honors among Albany ! schools, having scored one third of the total amount of points made by the All-Stars, between Lee Aron- owitz and Ed Muehlick, Muehlick was co-high scorer, with Hogan of VI. Pictured in the Knickerbocker News the next day were Lee Aron- owitz, Ed Muehlick, players, and Jackie Pfeiffer and Caryl Ferber, spectators,who stole into prominence by sitting on the floor! Mother Milne Takes Four In Her Doors As the second semester starts merrily on its way, Milne welcomes four newcomers: Betty Goewie, Harriet Bailey, Margaret Leonard, and Charles Kritzler. Betty Goewie comes from Cam- bridge High and Latin School, Cambridge, Mass. Fifteen and a sophomore, she loves to swim and take long bike trips. Harriet Bailey is an Albanian, coming from Philip Livingston. A ninth grader, she likes dramatics (a recruit for the dramatics club, Miss Conklin), riding, and sports in general. Margaret Leonard, another Al- bany girl, comes from good old School 16. She is an 8th grader and very interested in sports. The only new boy is Charles Kritzler, a seventh grader, who comes from that wondrous city, Brooklyn. Gym and shop are his favorites; a typical boy, it seems. The general opinion seems to be that Milne is small and friendly. They all say, I like it.Thats a good start, kids. Were awfully glad to have you with us. Societies Again Install Sophs Wellington Feeds Quin; Sigma Invades Jack’s Quintillian Literary Society held its Installation Luncheon on Satur- day, February 10, at 1 P. M. in the main dining room of the Wellington Hotel. After a very delicious luncheon, the group adjourned to the Green Room on the second floor for the installation ceremony. Ihe sophomores were called up in order after lighting their candles, proceeded to take the oath. Tne seniors received their society keys and all that were present received a white carnation. The meeting was adjourned after the singing of the Quin song. The sophomores who became members were: Glada Appleton, Ruth Ambler, Nancy Bearup, Bar- bara Betham, Joan Clark, Barbara Doran, Betty Jane Flanders, Ellen Fletcher, V/innie Hauf, Betty Jarcs, Joan Lehner, Barbara Leslie, Adele Perth, Ann Silverman, Jane Sim- mons, Pat Snyder, and Ruth Weil. Sigma Eats Too Friday, February 4, Sigma held its annual installation luncheon at Jacks. Miss Slater and Miss Neilson were the very welcome chaperons. The luncheon was served at 1:00. After the meal was over, the candle light service was held. Each pledge came to the main table and lit her candle from the large candle on the table, which was to represent the heart of all Sigma. Then they took their oath. The ceremony ended at 2:00. There were many pretty dresses displayed, and the juke box was played until it ran dry. Those who became members of Sigma were: Mabel Martin, Nancy Lee Clark, Katherine Jones, Dianne Ostrander, Nancy Moorhead, Jackie Mann, Florence Drake, Lois Pres- cott, Sally Gaus, Leona Richts, Marge Bookstein, Joan Minoch, Norma Linzes, Marie Schmidt, June Linton and Jackie Pfeiffer. The Sigma Seniors will be getting their keys in the very near future. Plans are being made for the Quin-Sigma dance, which shall take place soon. Basketball Tonight Sure, the VI gym is crowded, but the fellows HAVE TO play. Lets all of us go and cheer them on to victory. We want to make up for last weeks loss. (They have swell dances after their games too).

Upload: vuongkien

Post on 15-Mar-2018

218 views

Category:

Documents


2 download

TRANSCRIPT

Page 1: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Computer Forensic Capabilities

Administrator
Sticky Note
MigrationConfirmed set by Administrator
Page 2: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Agenda

• What is computer forensics?• Where to find computer evidence• Forensic imaging• Forensic analysis

Page 3: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

What is “Computer Forensics”?

• The preservation, identification, extraction, analysis, and interpretation of digital data, with the expectation that the findings will be introduced in a court of law.

Page 4: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Capabilities

• Reveals direct evidence on the machine• Associates a machine with data • Provides investigative leads• Reveals evidence that corroborates or refutes

allegations or alibis• Reveals behavioral evidence

Page 5: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Case Agent-Examiner Relationship

• The case agent and forensic examiner must work as a team

• Case agent– Involves examiner early– Explains case– Provides focused requests

• Forensic examiner– Educates and advises investigator– Explains results and limitations

Page 6: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence
Page 7: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Where to Find Computer Evidence

• Seize items specified in the search warrant.– Computers, laptops, Network Equipment (hubs and

switches)– Peripherals: CDR’s, DVD-R’s, Digital cameras, PDA’s– External Media: CD’s, floppy disks, USB thumb drives– Paper notes, documentation and manuals, post-it notes.

• Document computer equipment and peripherals prior to removal.– Digital pictures, diagrams

Page 8: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

• Desktops to Servers

Types of Electronic Media

Page 9: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Variety of Media

Page 10: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

But Wait, There’s More

Page 11: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

What is Forensic Imaging?

• Obtained by a method which does not, in any way, alter any data on the drive being duplicated

• Duplicate must contain a copy of every bit, byte and sector of the source drive

• Duplicate will not contain any data except filler characters (for bad areas of the media) other than that which was copied from the source media.

• Accurate, Verifiable, Reproducible

Page 12: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Value of Forensic Imaging

• Incident Response/Forensic Imaging is the MOST IMPORTANT step in the entire electronic investigation

• Failure can invalidate or make inadmissible all further information gathered from the digital evidence– Or at least give attorneys a headache

Page 13: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

The Imaging Process

Writ

eBlo

ck Imaging Hardware

or Software

010011010101

01

010011010101

01

Page 14: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Physical Write Blocks

• What Are They?– Physical device that prevents writes to the

evidence drive– BEST method of imaging

Page 15: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Attaching Write Block

Page 16: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Attaching Write Block

Page 17: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Hardware Imager

Page 18: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Software Imaging

• Bootable CDs or floppies• Control computer so it only

issues read commands to the drive, never write

• Examples:– FTK Imager– EnCase– DD– Ghost– Others

Page 19: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Physical vs. Logical

• Physical data structure refers to the actual organization of data on a storage device. Physical imaging gets all the zeros and ones possible from the device.

• Logical data structure refers to how the information appears to a program or user as seen through the operating system. Logical imaging misses data from areas not seen by the operating system.

Page 20: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence
Page 21: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

What Can the Examiner Find?

• Deleted files• Text fragments• Enhanced metafiles (previously printed files)• Enhanced metadata (embedded information)• Date/time stamp information• E-mail messages and chat logs• Internet usage information (history)• Archived and compressed files (zip)• Encoded e-mail attachments• Images (active and deleted)

• AND MORE...

Page 22: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Forensic Request from Case Agent

• EXAMPLE: Kidnapping assault of Heather Miller

– Evidence of defendant’s involvement with abduction– Search for victim’s name– Pictures of victim– Evidence of threatening letter sent to victim – Evidence of references to date rape drugs– Evidence of conspirator– Activity on the computer during time of crime– User attribution

Key word searches

Page 23: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Getting Started

• Keyword Searches • Drawbacks to key word searches

– Adobe PDF documents– Faxes– Excel– Registry– Compound/Compressed Files– Several others

Victim Name

Page 24: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Getting Started

• Right now we have the Victim’s name “Heather Miller” and we know what she looks like. What do you want to do first?

• Key word search for victim’s name reveals no relevant Information.

• Next: review graphics

Graphic Review

Page 25: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Graphics Review

Page 26: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Graphics Review

Email with attachment

Page 27: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Email Review

Deleted Attachment

Headers

TO / FROM / SUBJECT/ DATE

Page 28: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Email Headers

Time Analysis

Page 29: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Types of Email Metadata

• What types of Metadata are available

– When Created– How Created– When Sent– When Received– Who Sent/Received – Route

Time analysis

– Time Analysis– Graphic Analysis

– Origination– Who Created it– When Created

– Application Logs

Page 30: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Time Analysis

Reply email

Page 31: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Reply Email

Same info in temp internet files

Page 32: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Internet Cache-Copy of “Message005”

Chat logs in time analysis

Page 33: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Chat Logs

What have we learned

Page 34: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Joy.zip

• Metadata from Joy.zip

How are we going to search for this? Keyword

Page 35: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Time Analysis

Link File w/Thumb drive

Page 36: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Link File

Log file c:\my joy\joy.zip

Page 37: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

What does this tell us?

What is TRANSCEND - Google

TRANSCEND?

Page 38: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

What is “Transcend”?

Page 39: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Google is Your Friend

Click on Images Tab

Page 40: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Google is Your Friend (Images)

Next we find a LINK file

Page 41: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Web History

• Identify web surfing session– Where/when did they open browser?– How did they get to the significant finding?– Web mail– Other Activities?

• All goes toward user attribution

Page 42: Computer Forensic Capabilities MigrationConfirmed set  · PDF fileComputer Forensic Capabilities. ... – Explains results and limitations. Where to Find Computer Evidence

Summary

• Electronic evidence is everywhere• Case agents must work closely with examiners• Forensic examiners must look beyond the “Single

File”• Metadata can be critical to establishing user

attribution• Even if evidence itself has been deleted/destroyed,

numerous artifacts can be found