IFSM 498x

From Thinairlabs

IFSM 498x Digital Evidence & Computer Crime

Fall Session 2, 2008 - December 6/7 @ Yongsan - 0900-1730

Contents 1 News 2 Description 3 Prerequisites 4 Class Schedule 5 Class Photos 6 Course Information 7 Textbooks 8 Class Notes and Links 9 Links

News

• Course is Scheduled for Term 2 in Yongsan
• You should read the book before class
• Students should bring a USB stick, 128MB or larger

Description

This course covers the relevant background and terminology, legal issues that arise in computer related investigations, and presents a systematic approach to investigating a crime based on the scientific method. Topics include file systems, data recovery, Internet traces, as well as procedures and tools for properly collecting and examining digital evidence. This course demonstrates how computers are extensions of traditional crime scenes and how digital evidence can be useful in a variety of investigations including computer intrusions and violent crimes.

Prerequisites

You are required to take CCJS 105 or IFSM 310 before this class. It is highly recommended that students bring laptops with DVD Drive, and a wireless card.

Class Schedule

Date	#	Assignments
Dec 6	01	Morning Session Register for the class Buy the book Digital Evidence History and Terminology Computer Basics Bring laptop to class
Dec 6	02	Afternoon Session Quiz Applying Forensic Science to Computers
Dec 7	03	Morning Session Turn in file2 homework Quiz Forensic Examination of Windows Systems Bring laptops, floppies, Helix CDs to class.
Dec 7	04	Afternoon Session Quiz Digital Evidence in the Courtroom Final Exam - Comprehensive

Class Photos

Course Information

• Course Syllabus
• On Being a Maryland Student - Your Rights and Responsibilities
• Asian Division Student Handbook - Good tips for new and old students
  • Listening and Note-taking
  • Studying
  • Test Taking
• EUSA Library Website

Textbooks

• Required
  • Michael G. Solomon, Diane Barrett, Neil Broom - Forensics JumpStart
  • BJ Gleason, Drew Fahey - Helix for Beginners
• Recommended
  • Casey, Eoghan - Digital Evidence and Computer Crime, 2nd ed
  • Casey, Eoghan - Handbook of Computer Crime Investigation: Forensic Tools & Technology
  • Nelson, Bill - Guide to Computer Forensics and Investigations
  • Mandia, Kevin - Incident Response & Computer Forensics 2nd

Class Notes and Links

You should download and read the lecture notes before class. The lecture notes are in PDF format, you might have to download a reader for your machine.

You should visit the websites, and download the programs and run them.

Also, the lecture notes may not be complete, and should not serve as a substitute for attending class.

Date	#	Notes	Topic / Links
081206	01	PDF	Morning Session Digital Evidence What Lawyers and Managers Should know About Computer Forensics Adventures in Computer Forensics Internet Assisted Suicide: the Story of Sharon Lopatka Building a Forensic Workstation On a Budget - Greg Dominguez Helix - Linux Based Forensic Toolkit Helix for Beginners Manual Laboratory Hard Drives - Evidence Issues Computer disk drives from WTC could yield clues Identity theft case could be largest so far Cyber crime is right under your nose 'Erased' hard drives can bite you Seeking the Treasure Trove of Data From The Laptops Of Terrorists Accent OFFICE Password Recovery Forensic Focus - excellent website History and Terminology DOJ Cybercrime Website safeback - Evidence grade Bitstream backup software EnCase - Leader in Computer Forensics & Incident Response Solutions Sleuthkit - Forensics Tools for Linux DOJ Searching and Seizing Computers Computer Basics BootDisk.com - Lots of boot disks for different systems - boot98se.exe Mod_com - Modify operating system files for safe boot US v Moussaoui (2003) - computer and e-mail evidence PGP International PGP Freeware Version PGP Corporation Earth Liberation Front - uses PGP encryption Passware - Password Recovery Software
081206	02	PDF	Afternoon Session Applying Forensic Science to Computers Siegel, Rich (2005) Tuesdays with Mantu Electronic Crime Scene Investigation: A Guide for Law Enforcement Forensic Examination of Digital Evidence: A Guide for Law Enforcement Uniform Crime Report - How computers are being used in crimes Natascha Kampusch RFC 1321 The MD5 Message-Digest Algorithm What are MD2, MD4, and MD5? DigestIT Knoppix - bootable Linux Penguin Sleuth - Knoppix designed for forensics Knoppix First Responder's Guide KNOPPIX Bootable CD Validation Study Computer First Aid Using Knoppix Password Recovery Solutions John The Ripper How Secure Is Encrypted File System? Recover Lost NT passwords KeyKatch England's Angel of Death The Shipman Inquiry WinImage Ultrablock - Hard Drive write protector EasyExif - used to display Exif information
081207	03	PDF	Morning Session Forensic Examination of Windows Systems Norton Ghost 2003 as a Forensics Image Acquisition Tool Detailed Forensic Procedure for Laptop computers Forensic acquiring and analysis Independent Review of Common Forensic Imaging Tools Helix - a more recent Knoppix Forensics CD P2P in the Legal Crosshairs - Wired, Data Scrubbing Office 2003/XP Add-in: Remove Hidden Data The hidden dangers of documents Hidden Data in Electronic Documents - Excellent Paper
081207	04	PDF	Afternoon Session Digital Evidence in the Courtroom Dell Optiplex GX260 Manuals - (Yongsan) Take a look at these before class Dell Inspiron 8100 Manuals - (Chinhae) Take a look at these before class Topic: Final Exam

Links

• Course Links
  • [ifsm498x/IFSM498xs.063.pdf Course Syllabus]
• Mentioned in Class
• Programs
  • PDF Reader - to read the lecture notes
  • Winzip - Needed to work with zip files
• FAQ Files
  • FAQs (at ftp.sunet.se)
  • FAQs (at RTFM.mit.edu)
  • RSA Laboratories' cryptography FAQ
  • Cookie Central FAQ
  • The World Wide Web Security FAQ
• Tutorials, References
  • Microsoft Windows NT Security Seminar
  • Risks List Risks in the Computer Age
  • Privacy and Security on the Internet, by Karen A. Forcht
  • How to Hack - a FAQ for beginners
  • National Computer Security Association - Now International
  • College Students Think Piracy is Acceptable - A new Report
  • AntiOnline A website for hackers
  • WWW Security Links
  • Cryptography A-2-Z
  • NIST Computer Security Resource Clearinghouse
  • Cyber Notes - Computer Crime Newsletter
  • NSA Handbook
• General Links
  • DOWNLOAD.COM Where many of the programs in class are found.
  • Computer Dictionary An online web based dictionary
  • PC Webopaedia - resource for information about PCs
  • Computer Almanac A lot of interesting Numbers about Computers
  • What is? A really good online reference
  • How Stuff Works - excellent detailed explainations