Forensic Focus Blog

Academic institutions - who are we missing?

noreply@blogger.com (admin) — Fri, 06 Nov 2009 13:08:00 +0000

Hi everyone,

As many of you know I've recently made a start on building the new education section at Forensic Focus (hopefully bringing it online later this month) with the aim of listing every computer forensics university and college course worldwide.

I'd like to ask for your help in making sure I don't miss out any relevant institutions. The following is a list of the places currently on my master list - if you know of any place not listed below (and I'm sure there are many of them) I'd be grateful if you could either post a reply to this thread or email me with the details on admin @ forensicfocus.com. If you're able to provide a contact email address for a member of the teaching staff that would be great too (obviously if you yourself are a member of staff please don't hesitate to get in touch!)

OK, here's what I have so far:

UK

University of Bedfordshire
Birmingham City University (contact person details required)
University of Bradford
Coventry University
Cranfield University
De Montfort University (contact person details required)
University of Derby
University of East London (contact person details required)
Edinburgh Napier University
University of Glamorgan
University of Greenwich (contact person details required)
University of Huddersfield
Kingston University (contact person details required)
University of Central Lancashire
Leeds Metropolitan University
Lincolns College London (contact person details required)
Liverpool John Moores University (contact person details required)
London Metropolitan University
Middlesex University
Northumbria University
The Open University
University of Portsmouth
Royal Holloway, University of London
Staffordshire University
University of Strathclyde
University of Sunderland
Teesside University (contact person details required)
University of the West of England
University of Westminster

Ireland

University College Dublin
Dublin City University
Waterford Institute of Technology

US & Canada

Anne Arundel Community College
BCIT Centre for Forensics and Security Technology Studies
Bloomsburg University of Pennsylvania
Butler County Community College
California State University, Fullerton
Champlain College
DeVry University (contact person details required)
Edmonds Community College
University of Central Florida (contact person details required)
The George Washington University
Highline Community College (contact person details required)
Johns Hopkins University
John Jay College of Criminal Justice
Kaplan University - Hagerstown Campus (contact person details required)
Kennesaw State University
College of Lake County
Missouri Southern State University
Central Piedmont Community College
Pittsburgh Technical Institute
Purdue University Cyber Forensics Lab
University of Rhode Island (USA)
Rich Mountain Community College
Sam Houston State University
Stark State College of Technology
Stevenson University (contact person details required)
University of Texas at San Antonio
Tompkins Cortland Community College (contact person details required)
Walsh College
Washtenaw Community College (contact person details required)
Wilmington University (contact person details required)

Other

University of Cape Town (UCT)
University of Madras
University of Milan
Asian School of Cyber Laws (contact person details required)

If you can help by adding to this list or providing contact details I'd be very grateful - many thanks in advance!

Kind regards,

Jamie

Academic contacts - can you help?

noreply@blogger.com (admin) — Thu, 05 Nov 2009 15:20:00 +0000

I'm in the middle of compiling the new education section for the site and am trying to contact as many academic institutions as possible. However, I'm having some difficulty contacting staff members at the following universities and colleges:

UK

Birmingham City University
De Montfort University
University of Greenwich
University of East London
Leeds Metropolitan University
Lincolns College London
Royal Holloway, University of London
Kingston University
Liverpool John Moores University
Teesside University

Ireland

Waterford Institute of Technology
Dublin City University

US

University of Central Florida
DeVry University
Highline Community College
Kaplan University - Hagerstown Campus
Stevenson University
Tompkins Cortland Community College
Walsh College
Washtenaw Community College
Wilmington University

Italy

University of Milan

India

University of Madras

If you have an email address for a member of the computer forensics teaching staff - preferably the course leader - at any of the above I'd be grateful if you could mail me with it (if you're comfortable doing so) or alternatively ask the staff member to contact me directly on admin @ forensicfocus.com if you think they might want their institution to appear in the new section (there's no fee for inclusion, I just want to make sure the details are accurate.)

Many thanks in advance!

Jamie

Certifications are Evil

noreply@blogger.com (admin) — Wed, 14 Oct 2009 11:51:00 +0000

Thought-provoking post from John McCash over at Mark McKinnon's blog:

"Folks, this is an opinion piece, and it's going to be a controversial one. Some of you started composing a scathing rebuttal to it as soon as you read the title. Normally I restrict myself to what I hope are useful technical tidbits, but like most of you out there, I'm a forensic practitioner, and I have little patience for time sinks which provide no benefit (no I'm not including the training in that category, save your flames for the end). I've always begrudged the time commitment (over and above what's required to actually take the training and learn the included material) required to attain certifications, despite which I'm in possession of five, soon to be six, not counting my master's degree, so I like to think I speak from some degree of experience..."

Read more, and the ensuing discussion, here.

Shrinking the gap: carving NTFS-compressed files

noreply@blogger.com (admin) — Tue, 13 Oct 2009 07:20:00 +0000

A new paper from Joachim Metz of Hoffmann Investigations titled "Shrinking the gap: carving NTFS-compressed files" is now available here. Readers may be interested to note that carving NTFS-compressed data will also be part of the advanced carving topic of the Hoffmann Forensic Sessions in November.

My thanks to Joachim for another excellent paper!

Interview with Jim Gordon, West Mercia Police

noreply@blogger.com (admin) — Thu, 24 Sep 2009 13:25:00 +0000

Forensic Focus: Jim, can you tell us something about your background?

Jim Gordon: I left school in Dundee, Scotland when I was 17 years old and joined the Royal Air Force Police. I served in the RAF Police for just over 15 years, the majority of which was spent in the Special Investigation Service. Like most service personnel I served all over the place including three years in Cyprus, also visiting Belize in Central America, the Falkland Islands and finishing off with three years at the Joint Headquarters at Rheindahlen near Monchengladbach in Germany.

On leaving the RAF I joined Merseyside Police where I served in Liverpool city centre. I ended up on a Pro Active vehicle crime unit. After three great years I transferred to West Mercia Police where I was initially stationed at Kidderminster to the South West of Birmingham.

West Mercia is the fourth largest geographic police area in England and Wales. It covers the Welsh border counties of Herefordshire, Worcestershire and Shropshire. While West Mercia is predominantly rural, it also contains some densely populated urban areas and many market towns. As you can imagine it was quite a culture shock compared to Liverpool City centre.

After a short period in uniform I spent a number of years on the Pro Active CID, mainly employed in drug investigations at a local level, before successfully applying to become a Detective in the Criminal Investigation Department. In 2001 I successfully applied to join the Hi Tech Crime Unit. As they say the rest is history.

Forensic Focus: Why did you decide to work in the field of computer crime investigation?

Jim Gordon: I was always interested in computers from my days of being the proud owner of a ZX Spectrum and later when I seriously upgraded to an Olivetti 486. Whilst in the CID at Kidderminster I successfully completed a project management course and later during 2000 had the opportunity of going on an attachment to help the Force introduce the National Intelligence Model. Whilst part of the project team I first came into contact with the Hi Tech Crime Unit that at that time consisted of one member of staff. During 2001 the Hi Tech Crime Unit expanded and I successfully applied for one of the roles within the unit. As you can see from my background I’ve always worked in an investigatory role which is something that I enjoy and so computer forensics allows me to continue this, learn new things everyday and support the investigation teams...

Forensic Focus Graduate Recruitment

noreply@blogger.com (admin) — Wed, 23 Sep 2009 14:51:00 +0000

I'm delighted to announce the introduction of the Forensic Focus Graduate Recruitment program. Headed by respected computer forensics recruitment specialist David Sullivan and supported by technical experts in the fields of both computer and mobile forensics, this program aims to match graduates with suitable employers throughout the US, Canada and the UK.

Further details can be found at http://www.forensicfocus.com/graduates. Enquiries and resumes/CVs may be sent to graduates@forensicfocus.com

Helix 3 Enterprise review

noreply@blogger.com (admin) — Wed, 23 Sep 2009 10:05:00 +0000

A review of Helix 3 Enterprise written by Jonathan Krause of Forensic Control can be read here with discussion here.

"Helix 3 Enterprise (H3E) is e-fense’s flagship investigation suite pitched at a similar level as EnCase Enterprise or Access Data Enterprise. It’s aimed at organisations which need to be able to carry out incident response, forensics and e-discovery functions over networks. H3E facilitates centralised incident response, imaging of drives and volatile data and also enables scans and searches of a user’s internet history and documents on any computer which has had the H3E Agent pre-installed on it..."

Read more...

Forensic PC anti-contamination procedures

noreply@blogger.com (admin) — Mon, 24 Aug 2009 09:08:00 +0000

For those who don't follow the forums, there's an interesting discussion ongoing here about hard disk sterilization (if, indeed, that's the term of choice). I'd like to encourage further comments and viewpoints on this topic so please don't hesitate to have your say!

Mobile Telephone Case Law forum

noreply@blogger.com (admin) — Wed, 19 Aug 2009 11:19:00 +0000

New Mobile Telephone Case Law sub-forum here in response to this recent post.

Interview with Sean McLinden, Outcome Technology Associates, Inc.

noreply@blogger.com (admin) — Thu, 30 Jul 2009 14:49:00 +0000

[Sean is a Forensic Focus forum regular and posts under the username "seanmcl"]

Forensic Focus: Sean, can you tell us something about your background?

Sean McLinden: My first exposure to computers was as an undergraduate when I saw an episode of the PBS series Nova about artificial intelligence (AI). Since I was headed to the University of Pittsburgh to begin a graduate study in Medicine I hooked up with the team of Jack D. Myers, MD, and Harry E. Pople, PhD., who were researching the development of programs which could mimic the actions of human diagnosticians. Their laboratory was kind of a skunkworks which not only explored artificial intelligence, but also computer networking, hardware design and operating systems. Everyone who worked there was expected to be well versed in computer design and applications and innovative and there were a lot of opportunities for creativity and independent action. That model became my model for building collaborative teams in which people are encouraged to think independently, question conventional wisdom and be self-motivating.

Following completion of medical training I was recruited to become the head of MIS for what would become a university affiliated teaching hospital. Whereas in the research lab, sharing was the norm, in a patient care setting, the security of the information is paramount. This experience also taught me how production IT operations work, including the human element, an understanding of which is critical to cost-effective enterprise forensics.

From there, I chaired a university graduate program in IT management and then directed a clinical outcomes research group before starting Outcome Technology Associates in 1998.

Forensic Focus: What type of work is Outcome Technology Associates, Inc. engaged in? What does your role as president involve?

Sean McLinden: Outcome Technology Associates began as an organization that developed software and refined practices for the health care industry. Specifically, we did data analysis for patient clinical trials and helped to design systems for the sharing of patient information via data networks. Because our work involved a high degree of confidentiality, we were retained by law firms which had the need not only for data capture and analysis, but also the ability to be discrete. At that time, computer forensics was unheard of and so, "experts" were drawn from the academic and business units where IT practices were the area of specialization.

Our first cases involved simple data recovery, preservation and analysis for use in civil and criminal legal proceedings. The paper record was still the standard for courtroom evidence and most computer forensics involved the detection of traces of the paper record on computers. In 1995, we were consulted by attorneys for the plaintiff on a very large case involving tens of thousands of electronic documents, including e-mail, which was thought to contain evidence of an intentional breach of contract by the defendant. The outcome of the case was a $30 million judgment in favor of our client, and that was the start of our full-time business.

Today we are involved in any and all types of civil and criminal investigations in which the preparation, storage or transmission of information in electronic format is involved. I can say, in all honesty, that each of our cases has had one or more features which is/are unique among all of our clients, so it would be hard to pin us down as specializing in one form of computer forensics...

Read more at http://www.forensicfocus.com/sean-mclinden-interview-210709

Write Blocker Review

noreply@blogger.com (admin) — Thu, 23 Jul 2009 15:39:00 +0000

by David Kovar of NetCerto, Inc. (www.netcerto.com)

Digital evidence needs to come from somewhere, right? It doesn’t appear, “forensically sound”, from out of the blue. And the phrase “forensically sound” is key – the evidence needs to be acquired in a manner that ensures that the process doesn’t modify the evidence in any manner. There are exceptions to this – cell phones and live acquisitions come to mind – but even then, the process should be minimally invasive.

The key to this acquisition process is the ubiquitous write blocker, probably the most important tool in any acquisition kit. A write blocker was my first forensics hardware purchase and I keep my collection of write blockers up to date religiously.

The differences between write blockers used to be fairly significant in terms of quality, speed, features, and price. In the last year or two the number of options has expanded somewhat, the major vendors all have similar features, and the prices have come down. The major difference appears to be in the layout, form factor, and physical design of the units...

Read more: http://www.forensicfocus.com/write-blocker-review-230709

Loser wins major competition!

noreply@blogger.com (admin) — Mon, 20 Jul 2009 12:16:00 +0000

In a surprising turn of events late yesterday afternoon a rank outsider and frequent loser fought off the challenge of more mature competition to win a major international trophy.

But enough of the Open golf championship. In other news, the Forensic 4cast awards also contained a few surprises :-)

Joking aside, thanks to the guys over there for putting together this fun event. Thanks too for all who voted for a certain website owner (I didn't think the money would reach your accounts in time).

I hope Forensic Focus continues to be a useful resource and I'm looking forward to introducing some exciting new features later this year...stay tuned!

Hard disk data storage

noreply@blogger.com (admin) — Thu, 16 Jul 2009 07:52:00 +0000

From the forums...

ForensicMania asks: "Here is a quick question. I cloned hard disk using bit-by-bit copy and kept this hard disk without power in evidence store. I was wondering is there any limitation on data storage life-time on that hard disk if kept without providing power to it. e.g., will the data be there after five years?"

Logg replies: "You'll want to store your hard drives each in sealed, anti-static bags in a climate-controlled (arid) room. The baggies run under a dollar a piece at Fry's (or free if you keep them when you purchase hardware for yourself).

Power is your hard drive's enemy, so as long as you maintain low humidity, mild/moderate temperatures, and a generally dust-free environment, you'll be fine.

A flimsy cd that's damaged simply by prolonged exposure to sunlight can otherwise last to 100 years in storage (or so they say). An immobilized hard drive (and a backup drive if costs permit!) will last you the necessary 5 years years ... with a few decades to spare..."

More: http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=3943

Top 100 Computer Forensics Twitterers to Follow

noreply@blogger.com (admin) — Mon, 13 Jul 2009 14:42:00 +0000

I'd like to put together a list of the "top 100" computer forensics tweeters out there - click here to add your suggestions!

Build Your Own Digital Evidence Collection Kit

noreply@blogger.com (admin) — Mon, 06 Jul 2009 08:02:00 +0000

by David Kovar, NetCerto, Inc.

Collecting evidence accurately is clearly a foundational element for any ediscovery or forensics analysis project. The equipment required is important, but so are the supporting items – office supplies, forms, and documentation tools. And if you cannot find the items, or get them to the destination, it doesn't matter how great your tools are.

This kit, and the thoughts and processes behind it, attempt to address concerns I've encountered while doing collections all over the world. That said, it isn't perfect, even for my own needs. Treat this as a framework for building your own kit and if you can improve on this, please let me know how so I can improve my own processes.

Bear in mind that, in addition to this kit, I carry a laptop backpack everywhere. The backpack has my primary laptop for note taking and Internet research with WiFi and a cellular modem, cell phone cables, spare USB thumb drives, food, reading materials, and other basic necessities of any computer forensics analyst...

This year's Digital Safety Conference

noreply@blogger.com (admin) — Mon, 06 Jul 2009 08:00:00 +0000

by Jan Collie

Cyberstalking is the new urban terror – the message rang home loud and clear at the Digital Safety Conference in London.

For although, in Cyberspace, no-one hears you scream, increasing numbers of people are getting off on imagining it.

The evils of instant communication – texting, live chat, social networking – were laid out in lurid detail before delegates meeting in a brick-lined space known as The Brewery, near the city’s Barbican.

Tales of horror: physical threats and psychological manipulation, poured out. The family pursued relentlessly via emails, bulletin board postings and websites dedicated to damaging their names for more than five years. The teenager who suffered Post Traumatic Stress Syndrome following a campaign of anonymous texts. The Information Age exposed in all its gory.

This, said former Scotland Yard detective, Hamish Brown, was the intimidation that kills lives, the silent terror that dogs every waking moment for harassed victims. Who stalks and why is the subject of ongoing research but the trend is that more men stalk women than the other way around. The style of mental torture is similar to that shown in cases of domestic violence, Brown asserted, and the perpetrator often has no previous convictions.

As the first police officer to charge an offender with Grievous Bodily Harm of the mind, Brown passionately believes that victims of cyber violence should be taken more seriously.

“It’s not right that you should have to be punched on the nose for something to happen,” he commented, and asked for a campaign to educate the public on the issue.

Two alarming presentations based on personal experience followed. Graham Brown-Martin described how he, his wife and small child ran from Jamaica to London after enduring a series of death threats and vicious slanders posted on the Internet. The virtual bullying followed them and has continued for five years. Despite continued threats, including an invitation to all-comers to murder the family published with a map of their whereabouts, the authorities have been unable to help. Differences in international law were quoted as the main difficulty

More at http://www.forensicfocus.com/digital-safety-conference-review-230609

UK members - Can you HACK it?

noreply@blogger.com (admin) — Tue, 30 Jun 2009 14:18:00 +0000

Forensic Focus is pleased to support The National Society for the Prevention of Cruelty to Children (NSPCC), a charity which will be familiar to many UK members, especially those involved with child protection issues. The NSPCC's annual HACK (Hike Against Cruelty to Kids) is now in its fifth year and has so far raised over £250,000. After four successful years in the north this summer there are five 25 mile HACKS taking place in some of the most stunning locations across the UK: Yorkshire 5 September, Northern Ireland 5 September, Wales 12 September and Devon 27 September. And just in case you need any further motivation, there's a Forensic Focus T-Shirt for everyone who completes the hike - what more could you ask for?

More details here

Message from Nick Furneaux

noreply@blogger.com (admin) — Thu, 18 Jun 2009 11:59:00 +0000

Thought it might be useful to reproduce Nick's recent welcome message in the new live/network forensics forum:

"Hi everyone and welcome to the new forum covering Live and Network forensics.

My name is Nick Furneaux from CSITech and if you don't know me or have never sat in a classroom with me, then hello! Jamie has kindly asked if I would assist in the moderation of this forum and I was delighted to accept. If you are truly bored you can waste 90 seconds of your life and find out more about me on my poorly used blog at nickfurneaux.blogspot.com.

In the past 3 years or so the subject of so called live forensics has become an increasingly discussed topic and most investigators now believe that a live response to a running machine constitutes best evidence, often ahead of pulling the plug and continuing with a traditional disk image.

Whereas disk imaging has a certain accepted methodology and protocol associated with it, live response still has the feeling of the Wild West about it and as much work as possible needs to be done by the community to work towards a generally accepted method and process. Hopefully this forum, broken out from the melee of other topics will assist with that process.

This, of course, is not to ignore the vital area of network investigations that tends not to get such a 'following' in respect to forum postings, hopefully that will change.

We are fortunate to have some leading lights in these subjects contributing to Forensic Focus (you know who you are) and we welcome your continued positive contribution and input.

I look forward to reading your ideas, thoughts and comments.

Nick Furneaux"

The original message can be read here.

New forum (Live and Network Forensics) and new moderator

noreply@blogger.com (admin) — Wed, 17 Jun 2009 14:49:00 +0000

Hi everyone,

We now have a new forum dedicated to live and network forensics (e.g. memory analysis, running process enumeration, network traffic analysis etc.) If you want to discuss something related to volatile data collection before or without pulling the plug then this is the right place.

That's only half the good news. I'm also delighted to announce that Nick Furneaux has agreed to be the moderator of this new forum which is a huge coup for all Forensic Focus members (for a recent interview with Nick, click here.)

Nick joins Greg Smith (our mobile forensics forum moderator) as another highly regarded and influential name in the forensics world willing to share their knowledge and experience in these forums - my thanks to them both!

Jamie

Interview with Graham Brown-Martin, Digital Safety Conference

noreply@blogger.com (admin) — Mon, 15 Jun 2009 12:12:00 +0000

An interview with Graham Brown-Martin, organiser of the upcoming Digital Safety Conference in London, is now online at http://www.forensicfocus.com/graham-brown-martin-interview-120609

There's a link within the interview to a documentary about the event which inspired Graham to put this conference together, and while there's nothing "technical" in it I think it's worth viewing for the perspective it gives of someone who's been a victim of computer crime (surprisingly, perhaps, something we don't discuss very often at Forensic Focus).

Interview with Lee Whitfield, Forensic 4cast

noreply@blogger.com (admin) — Fri, 12 Jun 2009 10:47:00 +0000

An interview with Lee Whitfield of Forensic 4cast is now online at http://www.forensicfocus.com/lee-whitfield-interview-100609

It's always interesting to learn more about one of the voices behind a podcast and Lee doesn't disappoint!

Interview with Robert Botchek, President and Founder – Tableau, LLC

noreply@blogger.com (admin) — Wed, 10 Jun 2009 14:33:00 +0000

An interview with Robert Botchek, President and Founder of Tableau, LLC is now online at http://www.forensicfocus.com/robert-botchek-interview-090609

This is a fairly lengthy interview and Robert goes into a lot of detail in his responses - I highly recommend taking the time to make your way through it, it's well worth it.

Huge thanks to Robert for taking the time to share his thoughts!

Digital Safety Conference, 19th June 2009, London

noreply@blogger.com (admin) — Fri, 05 Jun 2009 00:38:00 +0000

The inaugural Digital Safety Conference brings together thought leaders, policy makers, legal professionals, law enforcement agencies, government representatives, educators, industry leaders and those committed to protecting civil liberties to consider the health, reputation and environment of the digital world.

Speakers include:

• Tom Watson MP
• Tanya Byron
• Anthony Lilley
• Dr Richard Clayton, Cambridge University
• Dr Tim Watson, De Montfort University
• Prof Mike Short, President, Mobile Data Association
• Hamish Brown, MBE (UK's leading expert on stalking)

Delegate places from £95 (students), education and charities £145 and FF members £170 if using the code dsg via online registration at:

http://www.digitalsafety.com/conference/registration

A supporting television documentary concerning one of the organisers as a case study can be viewed here:

www.digitalsafety.com/cyberstalking

Two men guilty of student murders

noreply@blogger.com (admin) — Thu, 04 Jun 2009 12:36:00 +0000

So, after five weeks Sonnex and Farmer have been found guilty of the appalling murders of Gabriel Ferez and Laurent Bonomo. I was actually at the Old Bailey on the first day of the trial (in the public gallery) and had hoped to return at a later date to see if there was any mobile forensics expert witness testimony - as seemed likely given the use of mobile phones on the date in question - but unfortunately my plans changed and I didn't have the chance. If anyone knows what part this evidence played in the trial please feel free to email me.

Interview with Dr Chris Pamplin, Editor – UK Register of Expert Witnesses

noreply@blogger.com (admin) — Thu, 04 Jun 2009 08:46:00 +0000

An interview with Dr Chris Pamplin, Editor of the UK Register of Expert Witnesses is now online at http://www.forensicfocus.com/chris-pamplin-interview-310509