Cyber forensics group

Fall 2005 schedule

Date	Presenter	Topic	Links
09/19	Florian	Digital forensics overview	PowerPoint slides
09/28	Florian	HoneyNet Scan 24	Presentation write-up
10/05	Brian	The Helix live CD
10/12	Patrick	HoneyNet Scan 26
10/19	No meeting
10/26	Florian	The SleuthKit and Autopsy	PDF slides
11/02	Morgan and Matthew	EnCase Forensics
11/09
11/16
11/23		Thanksgiving - no meeting
11/30
12/07

Below is a list of possible material that we can present and discuss in the meetings.

Papers

• P. Sommer, Computer Forensics: an introduction
• P. Sommer, Downloads, Logs and Captures: Evidence from Cyberspace
• B. Schneier and J. Kelsey, Secure Audit Logs to Support Computer Forensics
• M.B. Gerber, Shrinking the Ocean: Formalizing I/0 Methods in Modern Operating Systems
• L. Pan and L.M. Batten, Reproducibility of Digital Evidence in Forensic Investigations
• T.B. Stallard, Automated Analysis for Digital Forensic Science
• S.T. King and P.M. Chen, Backtracking Intrusions
• A. Whitaker and R.S. Cox and S.D. Gribble, Configuration Debugging as Search: Finding the Needle in the Haystack
• B. Carrier and E.H. Spafford, Defining Event Reconstruction of Digital Crime Scenes
• M. Reith, C. Carr, and G. Gunsch, An Examination of Digital Forensic Models
• M.W. Burnette, Forensic Examination of a RIM (BlackBerry) Wireless Device
• E. Casey, Practical Approaches to Recovering Encrypted Digital Evidence
• E. Casey, Error, Uncertainty and Loss in Digital Evidence
• N. Provos and P. Honeyman, Hide and Seek: An Introduction to Stegangography, 2003
• J.R. Smith and B.O. Comiskey, Modulation and Information Hiding in Images, 1996
• F.A.P. Petitcolas, R.J. Anderson, and M.G. Kuhn, Information Hiding A Survey , 1999
• J. Holley, Meeting Computer Forensic Analysis Requirements , 2001

Journals and Conferences

• International Journal of Digital Evidence
• Journal of Digital Investigation
• Digital Forensics Research Workshop

Tools

• The Sleuthkit
• Encase
• The Forensic Toolkit
• Zeitline
• Helix: a customized distribution of the Knoppix Live Linux CD for forensics
• Outguess and Stegdetect steganography tools

Case studies

• HoneyNet Scan 15: Recover a deleted rootkit
• HoneyNet Scan 19: Analyze two Snort binary captures
• HoneyNet Scan 24: Recover and analyze captured evidence from a floppy
• HoneyNet Scan 26: Continuation from SotM24, investigate the drug supplier Jimmy Jungle
• HoneyNet Scan 33: Advanced reverse engineering challenge
• HoneyNet Forensics Challenge
• HoneyNet Reverse Challenge
• DFRWS Memory Challenge

Other resources

• A fairly comprehensive link collection can be found at the Electronic Evidence Information Center
• Dan Farmer and Vietse Venema Forensic Pages
• Computer Crime and Intellectual Property Section (U.S. Department of Justice)
• National Center for Forensic Science
• American Academy of Forensic Sciences