Last modified:
Tue Jun 30 15:48:02 PDT 2009
Computer Forensics
- Online resources
- Basic Steps in Forensic Analysis of Unix Systems, David Dittrich (Pasos Básicos en Análisis Forense de Sistemas GNU/Linux, Unix, modified, updated and translated to Spanish by Ervin S. Odishoo)
- The Honeynet Project's Forensic Challenge
- The Forensics Wiki
- dnsstuff.com
- samspade.com
- Computer Forensics World
- Course notes for Black Hat '00 Unix forensics class, Dominique Brezinski and David Dittrich
- Dan Farmer & Wietse Venema's class on computer forensic analysis
[ forensics.tar.gz contains the slides in 6-up portrait PostScript format for printing on just 25 double-sided pages]
- Forensic Computer Analysis: An Introduction -- Reconstructing past events, By Dan Farmer and Wietse Venema, Dr. Dobb's Journal, September 2000
- What Are MACtimes?: Powerful tools for digital databases, By Dan Farmer, Dr. Dobb's Journal, October 2000
- Strangers In the Night: Finding the purpose of an unknown program, by Wietse Venema, Dr. Dobb's Journal, November 2000
- Computer Forensics Column, Errata
- The Law Enforcement and Forensic Examiners Introduction to Linux, a Beginner's Guide, Barry J. Grundy, NASA Office of the Inspector General
- Notes on updating Red Hat Linux 7.1 to support >2GB images with TCT, TCTUTILS & Autopsy (see also Large File Support in Linux)
- Forensic Analysis of a Compaq RAID-1 Array and Using dd with EnCase v3, by Keith J. Jones
- RAID Reassembly - A forensic Challenge (using PyFlag to reconstruct a filesystem from a RAID array)
- Forensic Analysis Using FreeBSD - Part 1 by Keith J. Jones
- Email Forensics CEIC 2002, William L. Farwell, 2002
- Time Zone Converter
- Open Source Windows Forensic Tools for Windows
- Linux NTFS file system drivers
- Open Source Windows Forensic Tools for Unix
- chkwtmp (SunOS 4.x)
- chklastlog (SunOS 4.x)
- NT Objectives was mentioned in a DEFCON talk on forensics. They produce a free toolkit (that lets you do the same thing as find does for free on Unix!)
- NTI Information & Resource Page (Mostly Windows-specific instructions, but some general forensic guidelines)
- Slashdot thread on wiping hard drive contents
- Put A Trace On It: A Command You Can ``truss'', SunSolve Online document
- Signatures of Macintosh files
- DD'¿½Ultimate Guide to Mac OS Forensics
- Forensic analysis tools and related software
- Brian Carrier's Sleuthkit (formerly TASK, formerly The Coroner's Toolkit, formerly TCT-Utils)
- Bootable CD-ROM and Virtual Machine toolkits
- Generic bootable CDs
- Forensic-specific bootable CDs
- FLAG (Forensic Log Analysis GUI), from the Australian Defence Signals Division
- Live View from Carnegie Mellon
- The Advanced Forensics Format (AFF) (See also: AFF publications list)
- Blogs
- Books
- Articles/Journals
- Digital Evidence: How Law Enforcement Can Level the Playing Field With Criminals, by Nancy Ritter, NIJ Journal No. 254, July 2006
- Ten Steps to Forensic Readiness, by Robert Rowlingson, International Journal of Digital Evidence, Winter 2004, Volume 2, Issue 3
- Forensic Readiness, by John Tan, @Stake, 2001
- International Responses to Cyber Crime
- International Journal of Digital Evidence
- Sleuthkit Informer
- Open Source Digital Forensic Tools: The Legal Argument, by Brian Carrier, @stake
- Computer forensics specialists in demand as hacking grows, by Suzanne Monson, Special to The Seattle Times, September 8, 2002
- Electronic Data Discovery Primer, by Albert Barsocchini, Law Technology News, August 28, 2002
- Solving the Perfect Computer Crime, by Jay Lyman, www.NewsFactor.com, February 27, 2002
- NT Incident Response Investigations and Analysis, by Harlan Carvey, Information Security Bulletin, June 2001
- "A harder day in court for fingerprint, writing experts: US judge limits testimony of forensic analysts, in a ruling that might alter how evidence is presented at trial," by Seth Stern, Christian Science Monitor, January 16, 2002
- Cybersleuthing solves the case (and related stories) by Deborah Radcliff, Computerworld, January 14, 2002
- Digital sleuthing uncovers hacking costs, by Robert Lemos, Special to CNET News.com, March 22, 2001
- "Intrusion Detection Systems as Evidence", by Peter Sommer, Computer Security Research Centre, London School of Economics & Political Science
- Advancing Crime Scene Computer Forensic Techniques, by Chet Hosmer, John Feldman, and Joe Giordano
- Recovering and Examining Computer Forensic Evidence, Forensic Science Communications, FBI, October 2000
- Analysis: The forensics of Internet security, by Carole Fennely, SunWorld (via CNN), July 26, 2000
- September 2000 Market Survey -- Computer Forensics, by James Holley, SC Magazine (ranks Linux dd a Best Buy! ;)
- Cybercops Need Better Tools -- Law enforcement agencies are falling behind hackers, says exec of CIA tech incubator, by Matthew Schwartz, Computerworld, July 31, 2000
- Crime Seen (Cover story on digital forensics), by Bill Betts, Information Security Magazine, March, 2000
- Disk Shows Love Bug-Like Virus, by Dirk Beveridge, AP, May 16 2000
- Computer Forensics: Investigators Focus on Foiling Cybercriminals, by Illena Armstrong, SC Magazine (cover story), April 2000
- CD Universe evidence compromised -- Failure to protect computer data renders it suspect in court, by Mike Brunker and Bob Sullivan, MSNBC, June 7, 2000
- Crime & Clues -- The Art and Science of Criminal Investigation
- FBI Forensic Science Communications
- Organizations/conferences/training
- Law and Legal Process
- Being an Expert Witness or Consulting for Counsel
- Digital Timestamping
- Microsoft's OCCUR: Open Chronologist for Currently Undisclosed Research
- Trusted
Timestamping at Wikipedia
- Stamper digital timestamping service
- Internet X.509 Public Key Infrastructure Time Stamp Protocol (TSP)
- What is digital timestamping?, RSA Cryptography FAQ section 7.11
- Secure Time/Date Stamping in a Public Key Infrastructure, Surety.com White Paper (PDF)
- Time Stamp Protocol, by Byun, Jung-Soo
- Time is of the Essense: Electronic documents will only stand up in court if the who, what, and when they represent are unassailable, by Charles R. Merrill, CIO.com, March 15, 2000
- How to Time-Stamp a Digital Document (PDF), by Stuart Haber and W. Scott Stornetta, Journal of Cryptology, Vol. 3, No. 2, pp. 99-111 (1991)
- Improving the Efficiency and Reliability of Digital Time-Stamping (PostScript), by Dave Bayer, Stuart Haber, and W. Scott Stornetta, in Sequences II: Methods in Communication, Security, and Computer Science, eds. R. Capocelli, A. DeSantis, and U. Vaccaro, pp. 329-334, (Springer-Verlag, 1993)
- Secure Names for Bit-Strings (PostScript), by Stuart Haber and W. Scott Stornetta, in Proceedings of the 4th ACM Conference on Computer and Communication Security, (ACM, 1997).
- Guidelines and standards
- APWG suggests e-crime reporting system, by Jeremy Kirk, IDG News Service, March 11, 2009
- The Emergent Law Enforcement Network Security Initiative (eLENS), APWG
- National Information Exchange Model (NIEM), IJIS Institute
- Investigations Involving the Internet and Computer Networks, National Institute of Justice, NCJ 210798, 2006
- Electronic Crime Scene Investigation: A Guide for First Responders, National Institute of Justice, NCJ 187736, 2001
- Forensic Examination of Digital Evidence: A Guide for Law Enforcement, National Institute of Justice, NCJ 199408, 2004
- Windows Vista Security Guide, Microsoft
- Fundamental Computer Investigation Guide For Windows, Microsoft
- U.S. Department of Energy Computer Forensic Laboratory's First Responder's Manual (PDF)
- Handbook of Legislative Procedures of Computer and Network Misuse in EU Countries (CSIRT Project Survey)
- Directors and Corporate Advisors Guide to Digital Investigations and Evidence, by Peter Sommer for IAAC, September 2005
- Federal Guidelines for Searching and Seizing Computers, U.S. Deptarment of Justice
- Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations, Computer Crime and Intellectual Property Section, Criminal Division, United States Department of Justice, January 2001 (PDF Version)
- Field Guidance on New Authorities (Redacted), enacted in the 2001 Anti-terrorism Legislation ("USA Patriot Act"), issued by the Department of Justice
- How the FBI Investigates Computer Crime, CERT Coordination Center
- Evidence Examinations -- Computer Examinations, Handbook of Forensic Services, U.S. Department of Justice, FBI
- Digital Evidence: Standards and Principles, Forensic Science Communications, US DoJ, April 2000, Volume 2, Number 2
- Recovering and Examining Computer Forensic Evidence, Forensic Science Communications, US DoJ, October 2000, Volume 2, Number 4
- RFC 3227: Guidelines for Evidence Collection and Archiving, by Dominique Brezinski and Tom Killalea
- An Introduction to the Field Guide for Investigating Computer Crime, by Timothy E. Wright (Security Focus Incident Handling focus)
- The Field Guide for Investigating Computer Crime: Overview of a Methodology for the Application of Computer Forensics, by Timothy E. Wright (Security Focus Incident Handling focus)
- The Field Guide for Investigating Computer Crime: Search and Seizure Basics, by Timothy Wright (Security Focus Incident Handling focus)
- Recovering from an Intrusion, by /dev/null
- Interviews
- Reverse engineering/Debugging/Malware Analysis
- Reverse Engineering Hostile Code, by Joe Stewart, SecurityFocus Online, October 23, 2002
- Alien Autopsy: Reverse Engineering Win32 Trojans on Linux, by Joe Stewart, SecurityFocus Online, November 14, 2002
- Reverse Engineering Malware, by Lenny Zeltser, May 2001
- The Honeynet Project's Reverse [engineering] Challenge
- Fenris, by Michal Zalewski, BINDVIEW
- OllyDbg Win32 runtime debugger (See also OllyDbg Stuph debugger aids)
- Linux tools for Reverse Engineering at Packet Storm
- LinuxAssembly.org resources
- Linux Assembly HOWTO, by Konstantin Boldyshev and François-René Rideau
- Programmer's Tools Decompiler/Dissassembler page
- Linux Kernel Internals (especially the "How System Calls Are Implemented on i386 Architecture chapter)
- The Decompilation Page at the University of Queensland
- IDA Pro Disassembler (commercial product, multi-platform/OS) [older freeware version]
- GDB tutorial
- Gnu GDB docs
- Cornell Theory Center Totorial on GDB
- Norm Matloff's Debugging Tutorial
- UNIX Kernel Stack Overflows, SunSolve Online Infodoc
- Last Fravia's mirror of Reverse code engineering
- The Solaris Memory System: Sizing, Tools and Architecture (PDF)
- SE Toolkit (Sun memory management tuning utility)
- Books
- The Art of Computer Virus Research and Defense, by Peter Szor, Addison Wesley in collaboration with Symantec Press, ISBN 0321304543, February, 2005
- Linkers and Loaders, by John Levine, Morgan-Kauffman, ISBN 1-55860-496-0, October 1999
- Intel 64 and IA-32 Architectures Software Developer Manuals, Intel Corporation
- Anubis: Analyzing Unknown Binaries, Secure Systems Lab, Vienna University of Technology
- Anti-Forensics (Note: Use these on an isolated analysis system)
- Encryption/Stegonography
- Secure Deletion
- Cell Phone/Mobile Forensics
- Fingerprint databases
- Rootkit identification utilities
- File system integrity checking tools
- Forensic analysis or related hardware
- Partitioning/File system documentation
- Destruction/Recovery of data
- Incident costs, damage estimation, and risk analysis
- Project Develops Model for Analyzing Security Incident Costs in Academic Computing Environments
- A Study on Incident Costs and Frequencies, by Virginia Rezmierski <ver@umich.edu>, Adriana Carroll <adriana_carroll@hotmail.com>, and Jamie Hine
- Faking It:Calculating Loss in Computer Crime Sentencing By Jennifer S. Granick, March 17, 2006 (Draft) [In relation to this case: Computer Privacy Upheld, but Sidestepped by Silver Platter Doctrine and Schools Special Needs Exception]
- Security Attribute Evaluation Method: A Cost Benefit Approach, by Shawn Butler, Carnegie Mellon University, International Conference on Software Engineering 2002 (ICSE 2002) Proceedings
- Multi-Attribute Risk Assessment, by Shawn Butler, Carnegie Mellon University, Proceedings from Symposium on Requirements Engineering for Information Security (SREIS 2002)
- Attack Trees: Modeling security threats, by Bruce Schneier, Dr. Dobb's Journal, December 1999
- Attack Modelling for Information Security and Survivability, Andrew P. Moore, Robert J. Ellison, Richard C. Linger, Technical Note CMU/SEI-2001-TN-001, March 2001
- A Quick Tour of Attack Tree Based Risk Analysis Using Secur/Tree, whitepaper by Amenaza.com, May 2002
- Other documents/terms/legal resources
- Certificate/Degree Programs
- A university in Texas is offering a cybersecurity degree program, by Sandra Swanson, Informationweek, May 3, 2002
- U.T. Dallas To Establish Digital Forensics And Security Institute To Help Fight Cybercrime, University of Texas, Dallas, press release, May 1, 2002
- University of New Haven Forensic Computer Investigation Program
- Graduate Certificate Program in Computer Forensics (GCCF), University of Central Florida
- UCF's list of University Programs/Courses in Computer Forensics [PDF]
- Georgetown Institute for Information Assurance
- Dan J. Ryan's Educational Materials
- Johns Hopkins University Information Security Institute
- Carnegie Mellon University Information Networking Institute (a C3S affiliated program)
- Syracuse University Information Security Management Program
- Dartmouth University Institute for Security Technology Studies
- Purdue University CERIAS Information Assurance Education Graduate Certificate Program
- Jobs
Back to home page