Archive for category: Computer Forensics

You are here: / Computer Forensics

Online Registration Closes Friday for 2012 DoD Cyber Crime Conference

11th Annual DoD Cyber Crime Conference 2012
Hyatt Regency Atlanta, Atlanta, GA
Pre-Con Training: Jan. 20-23  |  Conference: Jan. 23-27  |  Exposition: Jan. 24-26
www.DoDCyberCrime.com

REGISTER NOW to get trained by the experts in revolutionary technologies and techniques for exposing and preventing cyber crime. There is still time to make your plans and reserve your spot.

ONLINE CONFERENCE REGISTRATION
HURRY! Online conference registration closes this Friday, January 13, 2012

ONSITE CONFERENCE REGISTRATION
Those who cannot register online and wish to register at the event in person must provide a letter of sponsorship on the sponsoring Government Agency’s letterhead. The letter needs to include the following:

Name of the individual the Government sponsor is sending to the conference (including job title)
Organization where the sponsored individual is employed
The sponsoring agency point of contact (name, phone number, email address)
IMPORTANT NOTE: The sponsoring agency point of contact will be called to verify the sponsorship; conference credentials will only be issued if that contact person is able to verify the sponsorship.

ACCOMMODATIONS
Visit the TRAVEL page of the Web site for details about accommodations and travel.

CONFERENCE HIGHLIGHTS
• Pre-Conference Hands-on Digital Forensics Training Courses (attorneys can earn CLEs), including
SANS Lethal Digital Forensic Techniques and Memory Analysis
• Classified Cyber Threat Session
• 21 Concurrent Breakout Sessions
• Forensic Tool Expo
• 80+ Exhibitors
• DC3 Digital Crime Scene Challenge (new to the 2012 Conference!)
• 6th Annual DC3 Digital Forensic Challenge Awards Presentations (challenge occurs prior to
conference: www.dc3.mil/challenge)

Visit the event Web site for detailed event information: www.DoDCyberCrime.com

CONTACTS
Attendance: Sharla Warren, (703) 740-1950, SWarren@GovernmentMeetings.com
Speaker Services: Marnie Herren, (703) 740-1933, MHerren@GovernmentMeetings.com

The Techno Forensics Conference 2011 – Call for Papers

Conference Dates: October 31st – November 1st, 2011

Conference Location: Myrtle Beach Convention Center, Myrtle Beach, South Carolina

Call for Papers Deadline: March 25, 2011

The Techno Forensics Conference is all about digital forensics, evidence collection, crime scene documentation, and e-Discovery. Sessions are for industry professionals with some previous experience in these disciplines. Advanced level content and depth are a must. We are looking for speakers in the following areas:

* Case studies of actual criminal cyber crime involving unique digital investigation

* Innovative approaches to investigations

* Information on the effective establishment or operation of a digital forensic lab

* Demonstrable data of future technologies or cyber threats that will challenge traditional digital investigation methods

* Technological innovations necessary to combat and prepare for future cyber threats. No product pitches considered.

* Investigations requiring network forensics (especially those involving cloud computing)

* Cell phone, handheld device, and smartphone forensics

* Forensic analysis of images and video

* Government or private sector research and development funding programs related to cyber crime, digital investigation, or e-Discovery

* Evidence collection and crime scene documentation

* Information/tips for staying current in the rapidly evolving industry of digital forensics and e-Discovery

* Latest rulings affecting ESI and e-Discovery

Speakers are expected to include the latest trends, technology, and ideas. Their presentations should be non-commercial and not promote a particular product or company.

To submit a paper, please complete the PDF Submission Form that appears on this page and include the following:

Abstract should be approximately 100 words. It should include a title, clearly state the proposed topic, and outline the content. If your paper is accepted, this abstract will be used to describe and promote your session, so please write it with this in mind.

Biography should be an approximately 50-word summary of your professional background and any other relevant industry qualifications. If there is more than one presenter, please provide a biography for both. (Number of presenters is limited to two. Additional speakers are subject to approval.) If your paper is accepted, this biography will be used in the conference materials, so please write it with this in mind. Please submit a headshot with your biography to be used in the conference materials.

Sessions are 45 minutes long, with five minutes allowed for questions. If you feel that additional time is needed for your presentation, please indicate how long and offer strong justification. (Time allotments are subject to approval.) Company logos or other commercial content are not allowed on your graphics and slides and you will be asked to remove them if they appear.

Previously Presented Material: If this paper has been presented elsewhere, please indicate where and when. Prior presentation of the material will not eliminate it from consideration, but we are looking primarily for material that this audience has not seen before.

Your Contact Information: Please include complete contact information for all presenters. (Communication will be mainly via e-mail.)

Specify whether or not you are speaking on behalf of a company or yourself and identify the company you work for.

Identify Audio Video required for your presentation. We will provide one LCD projector and a wireless lapel or hand held microphone unless otherwise instructed. Please bring your presentation on a laptop along with a spare copy on CD in the event of machine failure.

Please Note: The Techno Forensics Conference does not pay for airfare, hotel accommodations, or other expenses for speakers. You do receive free registration to the conference as well as promotion in conference materials and marketing pieces.

Acceptance: Submission of an abstract does not guarantee placement. Notification of acceptance will be emailed in April.

Accepted speakers are required to adhere to a 100% NO COMMERCIALISM Policy. Sessions are to be strictly educational in nature.

No Substitutions

Substitution of speakers or panelists is not allowed except in the case of an emergency. In the event of an emergency where the original selected speaker is not available a written request for substitution may be considered, but strictly at the sole discretion of the organizer.

If you are interested in speaking opportunities at the 2011 Techno Forensics Conference in Myrtle Beach, please send your completed PDF Submission Form to:

Rebecca Waters

Chief Editor

DFI News®

4 Limbo Lane, Amherst, NH 03031

rwaters@DFInews.com
——————————————————————————–
In an interview at the 2006 Techno Forensics Conference, James Wingate talks about the current threat of steganography.

 

The EnCase Evidence File Format

The EnCase evidence file can also be referred to as a forensic image file. The concept of an image file is where the entire drive contents of a target media is copied to a file and checksum values are calculated to verify the integrity (useful in court cases) of the image file (often referred to as a “hash value”). Forensic images are acquired with the use of software tools such as the UNIX “dd’ and FTK Imager as well as hardware were cloning devices such as the Solo Masster and Logicube’s MD5 have added forensic functionality.

One major difference between the above mentioned techniques to acquire image files and the EnCase image files is the “bag-and-tag” concept. The UNIX “dd” and many of the hardware cloning devices only provide the bit-for-bit information during acquisition. EnCase on the other hand provides the bit-for-bit data as well as additional data such as case information; data block integrity and file integrity to name a few. These functions are built into the EnCase imaging process for interoperability and ease of use. If the same function were to be implemented using the UNIX “dd” or the hardware options, this process would require many different tools and multiple steps to obtain the same results.

My next posting will be on the “EnCase Evidence File Components and Functions”.

85% of All Crimes Leaves a Digital Fingerprint

It has been stated that 85% of all crime leaves a digital fingerprint in electronic devices. This may occur from an Internet intrusion, identity theft and traditional crime like murder. Computer forensics has aided in the investigation of these crimes. Computer Forensics is the use of specialized techniques for recovery, authentication, and analysis of electronic data when a case involves issues relating to reconstruction of computer usage, examination of residual data, authentication of data by technical analysis or explanation of technical features of data and computer usage. Computer forensics requires specialized expertise that goes beyond normal data collection and preservation techniques available to end-users or system support personnel. The challenges facing many computer forensics examiners are an abundant of data that must be analyzed to produce a story or show correlation. Hard disk space is enormous and continues to grow. Hard disk space is inexpensive thus allow for more. In conjunction, RAID systems also provide additional challenges for the investigator. A simple case on a 200 GB hard drive can take weeks to review alone before any real assessment can occur. Issues such as terrorism and murder cases can prove to be fatal. By including Social network analysis (SNA), the time to locate correlation will be reduced. This will assist the examiner to focus his analysis on key area from the SNA results.