Lab Investigation : Anomalous Traffic On Jane Of Blacksuit Computing 's System Essay

By performing the tasks required in this lab, many other attributes, references, and system information was gleaned that will benefit forensic efforts in the future. For this lab, the time zone of the computer has been isolated to China Standard Time, which in itself is suspicious. BHOs and add-ins were also located using registry values. Among this, there was only a reference to Bing Bar, which was identified in an earlier lab as a download performed on Jane’s computer. Moreover, this lab uncovered startup applications (UPnP.exe and SCVHhost.exe) that were identified as potentially suspicious in previous labs. Lastly, this lab allowed the student to locate USB storage devices that were connected to Jane’s system as well as the times associated with the connection and removal of the device in the system’s

2. Explain, from a forensics perspective, the digital evidence found on the Anthony family computer

This week’s lab objective is for the student to examine a memory dump from Jane’s computer (BlackSuit Case from week 1) to answer the following: Ascertain Jane’s IP address at the time of the memory acquisition; Determine if there are any active connections and report on their legitimacy; Identify listening ports, and report any suspicious activity. To accomplish this goal, the student is given the memory dump collected by a first responder in the investigation as well as access to two tools contained within the provided EnCase VM; RedLine and Volatility to complete their investigation with.

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

In your report, describe how that evidence was discovered and retrieved by law officers or computer forensic experts

The image was created on a clean 120GB hard drive. The computer was put back together and turned back on. The camera’s SDHC card and SanDisk Pro Duo USB memory stick would be connected separately to the portable forensics notebook. An image would be created of the SDHC card using a write-blocker program onto a clean 16GB SDHC card. An image would be created of the SanDisk Pro Duo USB memory stick using a write-blocker program onto a clean 8GB USB memory stick. The SDHC card showed 10GB was in use and 6GB of the SanDisk Pro Duo USB Memory stick was in use. Once the images were created, the investigator will put everything back where it was located based on the photos captured upon arrival. All activities which occurred in Mr. Wilkens’ room would be documented as they occurred.

As the lead forensics investigator for XYZ, Inc. I have just been informed that our client, HCC Partners in Life has undergone an apparent breach of its medical records system. Its IT security staff detected some discrepancies in the intrusion detection system (IDS) logs, which is an open source application called Snort that is run on a Linux platform. Furthermore, it is believed that the intrusion was made when the database administrator received a peculiar e-mail from human resources. This e-mail contained an attachment that was opened and discovered to be empty. Afterwards, the database administrator’s information system, which is a Microsoft Windows XP workstation, commenced performing peculiarly after opening the attachment.

What the expert retrieved were files named in a sexually descriptive manner which could not be recovered, some of which had the same names as files from the previous case for which that hard drive was used. “It is of serious concern for future cases. In the U.S., every citizen is guaranteed a fair trial; if one is not achievable due to lack of expertise of legal counsel and investigators in an area that could acquit the defendant, then the very foundation of the legal justice system has been compromised” [16]. There is a need for a standardized credentialing process for digital forensics experts [16].

A forensic tool validation report provides information starting with an overview of the tool and procedures that has to be performed upon the forensic tool. However, the tests can be different depending on the nature of forensic tools as each tool is indifferent to other tools. This report also contains series of tests, their respective results and a conclusion to determine if the tool met all the criteria required by the trusted sources such as

There may be supplementary requirements regarding documentation of systems and processes to fulfill forensic and evidentiary requirements. The report generation capability provided by the information system should have the capability to generate customizable reports. Furthermore, such analysis can also facilitate the development and implementation of comprehensive solutions, ensuring the use of more effective protective strategies. The results of forensic analysis can also be used to prosecute threat

Event #1: VE’s Trojan Attack. About a year ago prior to my employment, one of the project managers was web-surfing on one of the company’s PC. The project manager was visiting male enhancement product sites for her significant other. Since the owners did not establish a web browsing policy nor set-up firewalls to block certain websites, the project manager downloaded a Trojan program. The program did several things to the computer and parts of the server. The program held certain files for ransom while infecting several programs including FileMaker,

The current literature reveals a number of proposed frameworks, models and procedures that have been put in place in an attempt to formally describe an effective digital forensic investigation process. In digital forensic investigations, various processes focus on different actions performed, such as the data extraction, data examination, and data gathering and so on. Others tend to be more concerned with the analysis of the data extracted from the digital media.

ABSTRACT: digital forensics is the procedure of revealing and understanding electronic information. The objective of the procedure is to protect any confirmation in its most unique structure while collecting so as to perform an organized examination, recognizing and approving the advanced data. Digital evidence is not only used for electronic crimes but also used to accuse any type of crime. The goal of digital forensic analysis is to find evidence for an investigation. This paper gives summary of digital forensics, and also the processes, and uses in digital forensics involved investigations. This paper also reviews the tools used for digital forensics in today’s world.

The goal of this case study is to follow a packet capture file to investigate the fictitious character Ann Dercover. Examining the file will show how she uses network tunneling to cover her tracks, but more importantly, it will help develop skills that can be applied to network forensics. The challenge is to determine if the DNS traffic is truly suspicious, determine the purpose of the DNS traffic, recover all possible information on the local and remote systems involved, and the risk associated with the data leaking from the organization.

Digital forensic is a systematic approach to extract a confidential data from the electronic device by using the investigation techniques and tools. In order to accept the evidence in the court of law standardized and formalized digital evidence are required. Because of this the investigators uses many tools and techniques for the investigation purpose and must also follow some of the ACPO guidelines and Principles. This report mainly explains about the digital forensic tools and techniques that help in the investigation process and the advantages and limitation of the tools with brief conclusions.