issues arising in forensic computer examinations
DESCRIPTION
Issues Arising in Forensic Computer Examinations. Mike Dickson Forensic Analyst SCDEA e-Crime. Data Capacity. 1 kilobyte = 1000 characters. 1 megabyte = 1 million characters or 500 sheets of paper (about 5 cm tall). 1 gigabyte = 1 billion characters - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/1.jpg)
NOT PROTECTIVELY MARKED
Issues Arising in Forensic Computer Examinations
Mike DicksonForensic AnalystSCDEA e-Crime
![Page 2: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/2.jpg)
NOT PROTECTIVELY MARKED
Data Capacity
![Page 3: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/3.jpg)
NOT PROTECTIVELY MARKED
1 kilobyte
= 1000
characters
![Page 4: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/4.jpg)
NOT PROTECTIVELY MARKED
1 megabyte
= 1 million
characters
or 500
sheets of
paper (about
5 cm tall)
![Page 5: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/5.jpg)
NOT PROTECTIVELY MARKED
1 gigabyte = 1 billion charactersor a pile of paper 50 metres tall
![Page 6: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/6.jpg)
NOT PROTECTIVELY MARKED
400 gigabytes is about averageThat’s 20km of paper
Or 2 ½ Mount Everests
![Page 7: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/7.jpg)
NOT PROTECTIVELY MARKED
The biggest hard drive commercially available today is2 terabytes, or 2 trillion characters
That’s two million packets of A4paper which would reach….
![Page 8: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/8.jpg)
NOT PROTECTIVELY MARKED
…about 100 kilometers
Approx here to Stirling
![Page 9: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/9.jpg)
NOT PROTECTIVELY MARKED
An average person can readthrough about 220 words perminute…
…which is about a
kilobyte of data
![Page 10: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/10.jpg)
NOT PROTECTIVELY MARKED
So therefore…
Reading two terabytes of data would take the average person
2 x 1000 x 1000 x 1000 minutes
![Page 11: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/11.jpg)
NOT PROTECTIVELY MARKED
Also known as 3800 years
The Nordic Bronze age started3800 years ago
![Page 12: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/12.jpg)
NOT PROTECTIVELY MARKED
Hitachi have announced 4Tb drives for 2011
That’s 200km of paper
=
![Page 13: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/13.jpg)
NOT PROTECTIVELY MARKED
Analyst and Investigator
![Page 14: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/14.jpg)
NOT PROTECTIVELY MARKED
Encryption
![Page 15: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/15.jpg)
NOT PROTECTIVELY MARKED
Identifying Devices
![Page 16: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/16.jpg)
USB Phone (12Gb)
![Page 17: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/17.jpg)
USB Watch (2Gb)
![Page 18: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/18.jpg)
USB Subbuteo (22-32Gb)
![Page 19: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/19.jpg)
USB Rubber Duck (2Gb)
![Page 20: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/20.jpg)
USB Vibrator (128kb)
![Page 21: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/21.jpg)
USB Teddy Bear (4Gb)
![Page 22: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/22.jpg)
USB Teddy Bear (4Gb)
![Page 23: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/23.jpg)
BMW M5 (8Gb)
![Page 24: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/24.jpg)
NOT PROTECTIVELY MARKED
Virtual Computers or ‘The Cloud’
![Page 25: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/25.jpg)
NOT PROTECTIVELY MARKED
![Page 26: Issues Arising in Forensic Computer Examinations](https://reader035.vdocuments.site/reader035/viewer/2022062723/56813f89550346895daa79f8/html5/thumbnails/26.jpg)
NOT PROTECTIVELY MARKED