Digital.Investigation.February

Future direction......Page 1
Letter To The Editor......Page 3
But the Feds are on a roll......Page 4
Customers will pay, threaten ISPs…......Page 5
Encase helps save stolen baby......Page 6
Guidance gets choosy with evidence acquisition......Page 7
Historical tape technologies......Page 8
Open backup formats......Page 9
Finding evidence at each abstraction layer......Page 10
Tape files and partitions......Page 11
Gap slack......Page 12
Cryptographic hash of tape......Page 13
Solution requirements......Page 14
Acquisition......Page 15
Restoring content using the original backup software......Page 16
References......Page 17
Introduction......Page 19
Static analysis......Page 20
Dynamic analysis......Page 21
Resources......Page 22
A background to the Trojan defence......Page 23
Definitions......Page 24
Anti-virus and personal-firewall killers......Page 25
Scenario 1......Page 26
Considering volatile evidence......Page 27
Network evidence......Page 28
Coming up in Part II......Page 29
The future of forensic computing......Page 31
Diversity will drive changes in forensic investigation methods......Page 32
Is there an alternative future - in search of forensic nirvana......Page 34
Birthday paradox......Page 36
Cryptanalysis of MD5......Page 37
The impact of MD5 collision on the use of MD5 in computer forensics......Page 38
References......Page 39
What is our challenge?......Page 41
Technical, managerial and socio-legal factors......Page 42
Conclusion......Page 43
Reference......Page 44
Introduction......Page 45
The investigators perspective - building the jigsaw......Page 46
Timestamps......Page 47
Common forensic analysis tools and provenance......Page 48
References......Page 49
A new blind method for detecting novel steganography......Page 50
Least significant bit (LSB) encoding......Page 51
Discrete cosine transform (DCT) encoding......Page 52
Steganography programs......Page 53
Computational immune system model......Page 54
Hyper-geometric classifier building blocks......Page 55
Classifier performance......Page 56
Convex polytope model......Page 58
Choosing beta......Page 59
Hyper-ellipsoid......Page 61
Hybrid anomaly/signature classifier......Page 62
Testing methodology......Page 63
Phase III - expanded tests......Page 64
Phase II results - expanded CIS comparison......Page 65
Phase III results - new steganography database......Page 66
Conclusion......Page 68
References......Page 69