Understanding Metadata

NISA 2017 - UNDERSTANDING METADATA - WHAT IS METADATA, AND WHAT IS IT FOR? is available. Surprisingly, not read anywhere else that this update was out, being that it is a highly relevant subject to digital (mobile, computer, audio, etc.) forensics.
http://www.niso.org/apps/group_public/download.php/17446/Understanding%20Metadata.pdf

Survey: Digital Forensics Tool Testing

Following on from the post "Study into Carving Validation" - http://trewmte.blogspot.co.uk/2017/05/study-into-carving-validation.html ,Dr Graeme Horsman from the Faculty of Computer Science University of Sunderland has produced a questionnaire designed to acquire industry consensus on the wider vista associated with tool testing in the field of Digital Forensics. Responses are anonymous and the results will form part of research into the design and implementation of tool testing in the field, and will also be used as part of the production, publication and dissemination of research in this area.

As the survey responses are anonymous Dr. Horsman requests any questions or comments you have should be posted at the LinkedIn Group "Institute for Digital Forensics" - https://www.linkedin.com/groups/2436720 as all questions and comments made are under Chatham House Rules  ( https://www.chathamhouse.org/about/chatham-house-rule )

This survey contains 15 questions. Estimated time to complete - 4 minutes.

https://sunduni.eu.qualtrics.com/jfe/form/SV_5uupcHQ8cMYiiO1

Study into Carving Validation

At the LinkedIn Group "Institute for Digital Forensics" ( https://www.linkedin.com/groups/2436720 ) we are pleased to announce Dr Graeme Horsman PhD, BSc (Hons), MJur (Dur), PGCertHE, SFHEA from the Faculty of Computer Science University of Sunderland has joined the Group and wants to seek assistance from practitioners, in-house test and examination departments and laboratories regarding thoughts on testing in terms of the tools that are used. This is in terms of strategies etc., given the importance (albeit it has always been important) with ISO standards etc. Do IDF members have their own "test data and strategy that they roll out on new software/releases"? This is in relation to potential value of an automated test data generator for known good content from which to evaluate parsing/carving algorithms. This would be with respect to "carving validation" so test data would be geared towards such algorithms. Dr Horsman would appreciate as much feedback as possible and wants to engage in discussions to facilitate this study.

Access to content and discussions is open to LinkedIn members who request and are approved for membership to the Group "Institute for Digital Forensics.

FAB LAB Manchester

FAB LAB Manchester

(For those international readers of my blog, that is 'Manchester' in the Great U of K)

People often refer back to the early days of the BBC Microcomputer,  Commodore 65, ZX Spectrum and Amstrad CPC. Nostalgic, well maybe, but with that style of programming it doesn't mean it has gone forever.

Have you seen Fab Lab in Manchester (http://www.fablabmanchester.org/) - what a great idea.
Creating-Interactive-Devices-With-The-Arduino-Beginner-Course

I heard about this place on BBC Radio Four. They have built their own basic computer board with operating system and just needs terminal devices added.  From there anyone can programme the system to do 'something'.

In essence teaching how to programme from the floor upwards.

Here are the excellent images of retro devices of the early 1980s and links to their background.

ZX_Spectrum

BBC_Microcomputer

 Commodore_64

Amstrad_CPC

Other material on mobile programming:
fundamentals-principles-mobile-phone

Barristers - Surrey Chambers

Barristers - Surrey Chambers

One of the most overlooked parts of the law when dealing with crimnal and civil cases is that an expert, professional and client comes into contact with Barristers and Barristers' Chambers. That is quite shocking really as we meet with Barristers virtually on a daily basis for mobile telephone, computer, software and technology evidence in criminal cases and other commerical and civil matters.

Most professional people or companies one way or another require legal advice about professional matters for business and there are others who need assistance when initiating or facing civil or criminal proceedings. I have found a very good Set run by Mr James Tucker, Surrey Chambers of 1A Middle Temple Lane and Global House, Epsom http://www.surreychambers.org/. Not only does Surrey Chambers handle full range of commercial and civil matters but also prosecution, police and defence work. Really excellent Set.

FORENSIC RECRUITMENT

FORENSIC RECRUITMENT

I get alot of enquiries asking about computer and mobile telephone recruitment. I try and answer as many queries as I can but I can't deal with all enquiries for those seeking employment. Moreover, it seems to me, at any rate, that alot of enquiries I get would be better directed to a recruitment consultant who specialises in this area and is more able to deal with the employment questions and vacancies in the forensic arena.

I have added a new link in the weblinks block under FORENSIC RECRUITMENT (on the right-hand side of this blog) so that students and professionals seeking employment etc can consult those who specialise in this area. I have spoken with David Sullivan of Appointments-UK (www.appointments-uk.co.uk) and he has confirmed to me that he is happy to field enquiries for those seeking employment.

File Signatures Mobile Phone & Computer Forensics

File Signatures Mobile Phones & Computer Forensics

FILESIG MANAGER

Given the ever growing list of file signatures needed when drilling down into imaged data to determine varying file types that may be recorded in the data can be a real pain if, like me, you create every growing lists of file signatures copied and pasted into notepad documents. The raw data I see from imaging mobile telephones, SIM/USIM, Smart/MMC cards and hard disc drives means that I need to retain a single database for all the file signatures captured. I have found a great little tool called Filesig Manager, created by Tim Coakley (www.filesig.co.uk), which is a "file signature and keyword management tool, acting as an examiner's central repository of File Identification information." Importantly, not only does it work very well, but it's FREE.

Screen Image 1

The screen image 1 illustrates a range of captured file signatures stored in the database that includes file extensions, description and category of file and in addition fields that contain data for segments and offsets used by other computer forensic products. The database comes with some pre-defined file signatures, which are the most common and most useful and the user can enter their own file signatures as and when they are discovered.

Typically, file signatures usually contain the first eight bytes and last four bytes of a file. Below are some examples of common file signature types I have recovered following imaging of mobile phones and MMC cards saved and deleted data.

Header...........................................Footer...................Extension

[FF D8 FF E0 00 10 4A 46]........[A4 83 FF D9]......[.JPG]

[30 26 B2 75 8E 66 CF 11].........[23 AE 00 00].......[.WMA]

[FF FA 61 C0 EA 3D 00 00].......[00 00 00 00]........[.MP3]

[00 00 00 14 66 74 79 70]...........[31 31 31 30]........[.3GP]

[47 49 46 38 39 61 18 01]...........[00 00 00 00]........[.GIF]

[52 49 46 46 AC D3 01 00].........[0D 0A 0D 0A].....[.WAV]

It is worth mentioning that some signatures use a Header that does not require all 8 bytes to be used. For example, .JPG file signatures are commonly referenced with a Header FF D8 FF E0 or FF D8 FF E1.

Screen Image 2

The screen image 2 illustrates file extensions and description of file extension as a look-up table.

GPS Mobile Phone Computer Training Shoes

GPS Mobile Phone Computer Training Shoes

The conventional mobile 'phone looks set to radically undergo a design change, if the above training shoe becomes popular. The internal microphone and speaker fitted into the trainer can be configured to act as a wireless phone. The trainer even comes with a USB port. Problems might arise of course when going through customs or airport security and you are wearing a pair of these. I must confess perhaps to a little apprehension regarding having to examine this type of exhibit. Will be adding odour eaters and Fabreeze to my forensic examiners toolkit.

To find out more click on the Technologies tab at the bottom of home page - http://www.isaacdaniel.com/fele.htm