Conducting a technology review/audit prior to commencing field projects is an important task in order to understand the 'technology estate' owned and/or operated by an organisation. It is for revelation purposes and to comprehend [legacy] technology as stand-alone or interconnected/intra-connected with [current] technology and significantly if or how legacy has been ported-over to operate via applications/software to work with current. So more information has been posted. This is for the purposes as mentioned previously dealing with cases requiring 'field project investigations' (from installs to troubleshooting). I am sharing these .pdfs because I found forensics became one of the tools to be applied during investigations and not the main tool. Knowing the background details (tech spec, set-up, logs files, install procedures, etc.) assists understand "why an artefact was there".
To read the posts - https://www.linkedin.com/groups/2436720
Latest Updates: Institute for Digital Forensics
- Windows Registry Reference
- Apple Reference Cards and iPad iOS7 Quick Guide
- USB Guide & USB Key Guide
- Hardware Configuration Dell Precision WorkStation
- Legacy DOS
- 100 Windows 8 Keyboard Shortcuts
- 100 Chrome Tips
Institute for Digital Forensics - Previous Updates
- Tron Commands
- Malware, Junkware, Virus
- Checking Implemented Security
- Backups
- Troubleshooting, Tips and Guides
- Windows NT Server Resource Reference
- Admin Tools To Know and Explained
- Corrupted Registry
- Windows Resource Kit Reference
- Fasteners
- Projects - Win 10
- Projects - Win 8
- Projects - Win 7
- Vulnerabilities in Critical Evidence Collection
- Imaging with Image-X: The Ghost Killer
- A Guide for the Forensically Sound Examination of a Macintosh Computer
- Interpol's Forensic Report on FARC Computers and Hardware
- Reducing Data Lifetime Through Secure De-allocation
- Realising - Risk Sensitive Evidence Collection
- Notes on Computer Systems and Operating Systems
- Finding Child Porn in the Workplace
- Drafting Electronic Evidence Protocols
- Data Hiding in Journaling File Systems
- Investigation of Protected Electronic Information
- Electronic Evidence: The Ten Commandments
- Electronic Evidence Best Practices
- Laws of evidence in criminal proceedings throughout the European Union
- Evaluating Commercial Counter-Forensic Software
- Hacking into computer systems
- Windows device interface security
- NSA Redacting with Confidence: How to Safely Publish Sanitized Reports
- Reproducibility of Digital Evidence
- Windows Memory Analysis
- Secure Deletion Myths
- Spoliation of Evidence
- Forensic Discovery
- VMware to boot cloned/mounted hard disk images
- Volume Serial Numbers: Format Verification Date/Time
Investigations, Practices and Procedures: Seizure-Forensic Examination-Evidence. Cellular and Satellite Telephones, Call Records-Billing Data, Cell Site Analysis. Telecomms. Computer and Network Analysis. GPS devices & Jammers, Cyber, IoT forensics.
Showing posts with label computers. Show all posts
Showing posts with label computers. Show all posts
Saturday, August 12, 2017
Friday, April 27, 2012
Data and Time Stamps
Data and Time Stamps
An important issue to bear in mind when dealing with any analogue or digital device that contain a 'clock', for the production of a 'date and time stamp', is whether the clock's inaccuracy might not disbar evidence when considering the operation of the device and content found stored on/in a device.
McKeown was convicted of drink-driving following a Lion intoximeter breathalyser test. It was found that the date and time stamp was erroneous when compared to the material time of the breath test. On Appeal their Lordships identified that the fact that the date and time stamp was erroneous would not of itself prevent the 'machine' to still carry out an effective breathalyser test (DPP v McKeown [1997] 1 WLR 295).
Such cases provide useful material to research whether:
1) The ruling, could it be applicable to mobile/smartphones to carry out an effective process or recording where the clock is inaccurate?
2) What impact that might have regarding the admissibility of the content in files stored/residing on mobile/smartphones (or indeed tablets etc) could still be seen as unaffected due to an erroneous clock?
3) Could a clock's inaccurate date and time stamp allow content to be altered or amended before being presented for admissibility?
There are many layers of investigation involved in each of the narratives above, and there are other questions that haven't been raised. Some food for thought, yes, but also a reminder that extracting and harvesting data from a digital device is only a fraction of the work involved when dealing with mobile telephone evidence.
An important issue to bear in mind when dealing with any analogue or digital device that contain a 'clock', for the production of a 'date and time stamp', is whether the clock's inaccuracy might not disbar evidence when considering the operation of the device and content found stored on/in a device.
McKeown was convicted of drink-driving following a Lion intoximeter breathalyser test. It was found that the date and time stamp was erroneous when compared to the material time of the breath test. On Appeal their Lordships identified that the fact that the date and time stamp was erroneous would not of itself prevent the 'machine' to still carry out an effective breathalyser test (DPP v McKeown [1997] 1 WLR 295).
Such cases provide useful material to research whether:
1) The ruling, could it be applicable to mobile/smartphones to carry out an effective process or recording where the clock is inaccurate?
2) What impact that might have regarding the admissibility of the content in files stored/residing on mobile/smartphones (or indeed tablets etc) could still be seen as unaffected due to an erroneous clock?
3) Could a clock's inaccurate date and time stamp allow content to be altered or amended before being presented for admissibility?
There are many layers of investigation involved in each of the narratives above, and there are other questions that haven't been raised. Some food for thought, yes, but also a reminder that extracting and harvesting data from a digital device is only a fraction of the work involved when dealing with mobile telephone evidence.
Monday, August 22, 2011
TCP/IP, RFC and a few laughs along the way
TCP/IP, RFC and a few laughs along the way
For those of us who are constantly studying to keep up to date with technological advances or going on re-fresher courses to remind ourselves of things we thought we knew well, but had actually forgotten bits and pieces, it is the daunting amount of information to be read and absorbed that can be off-putting at times. For example, I am currently on a re-fresher for TCP/IP (Transmission Control Protocol/Internet Protocol - TCP/IP_model) and just one of the documents I am reading runs to over 700 pages long. TCP/IP sounds very boring (and to most it probably is).
Given that the nitty-gritty of TCP/IP also appears technically demanding to understand (perhaps a bit like rocket science) one needs a sense of humour working in this arena if one is not to go ‘bonkers’ or become a total ‘anorak’ on the subject. Whilst reading the commentary on the standardisation bodies structure responsible for the creation of RFC (Request for Comments) IP Standards and proposals for RFC standards I was came across a couple of gems, which I found quite humorous. To fully appreciate the humour, one needs first to have an appreciation of the aura of formality and control engendered around understanding standardisation and the bodies that assist in their creation.
As a very brief overview, because of the openness and perpetual renewal of TCP/IP, which is popular with developers and users alike, there is no overall governing body to issue directives and regulations for the Internet. Control is mostly based on mutual co-operation. The Internet community is said to be organised and managed by the Internet Architecture Board (IAB). The IAB itself relies on the Internet Engineering Task Force (IETF) for issuing new Standards (RFCs) and the Internet Assigned Numbers Authority (IANA) for co-ordinating values shared among multiple protocols. RFC standards can be proposed by anyone; but the RFC Editor is responsible for reviewing and publishing new standards documents. The IETF itself is governed by the Internet Engineering Steering Group (IESG) and is further organised in the form of Areas and Working Groups where new specifications are discussed and new standards are proposed.
In order to have a new IP protocol approved as a standard, applicants have to submit a proposed specification to the IESG where it will be discussed and reviewed for technical merit and feasibility and also published as an Internet draft document. For Internet Protocol suite to evolve through the mechanism of Request for Comments (RFC) new protocols (mostly application protocols) are designed and implemented by researchers, and are brought to the attention of the Internet community identified in standard categories:
Draft standard: There is a possibility that changes will be made in a draft protocol before it becomes a standard.
Proposed standard: Revision of the protocol is likely.
Experimental: A system should not implement an experimental protocol unless it is participating in the experiment and has co-ordinated its use.
Informational: Protocols developed by other standard organisations, or vendors, or that are for other reasons outside the purview of the IAB may be published as RFCs
Historic: These are protocols that are unlikely to ever become standards, because they have been superseded by later developments or due to lack of interest.
Required: A system must implement the required protocols.
Recommended: A system should implement the recommended protocol.
Elective: A system may or may not implement an elective protocol. The general notion is that if you are going to do something like this, you must do exactly this.
Limited use: These protocols are for use in limited circumstances. This may be because of their experimental state, specialised nature, limited functionality, or historic state.
Not recommended: These protocols are not recommended for general use. This may be because of their limited functionality, specialised nature, or experimental or historic state.
The overall picture one gets, having glimpsed at this highly defined and controlled standardisation structure, is one of individuals feverishly working away solving technical conundrums with little room for levity. Well, apparently not. It was with a grinning surprise I found, amid all this rocket science, that some ‘techies’ have been allowed to let their imaginations run riot – presumably to defeat creeping techmadness, maybe? Two protocols identified by the RFC Editor, and dated April 1st that are described at best as “impractical”:
RFC 1149 (dated 1990 April 1 - rfc1149) describes: A standard for the transmission of IP datagrams by avian carrier (carrier pigeon)
See also RFC 6214 – (rfc6214)
RFC 1437 (dated 1993 April 1 - rfc1437) describes: The Extension of MIME Content-Types to a New Medium (transmission of people by electronic mail).
Are these two impractical or just ahead of their time?
Saturday, March 06, 2010
Google says PC will be irrelevant in 3 years
Google says PC will be irrelevant in 3 years
Interesting article in The Register:
http://www.theregister.co.uk/2010/03/05/google_says_pc_will_be_irrelevant_in_three_years/
I can see where Google is coming from because I have similar thoughts about how mobile phones and SIM/USIM cards, as devices, are making significant inroads to provide functions and features traditionally provided by computers. This is another area that is forcing change on the work we do and why I believe we cannot afford to rest on any laurels we think we may have in our field of distinction and move as quickly as is reasonably practicable to do so to generate Certified/Validated tools.
Google says PC will be irrelevant in 3 years
Google says PC will be irrelevant in 3 years
Interesting article in The Register:
http://www.theregister.co.uk/2010/03/05/google_says_pc_will_be_irrelevant_in_three_years/
I can see where Google is coming from because I have similar thoughts about how mobile phones and SIM/USIM cards, as devices, are making significant inroads to provide functions and features traditionally provided by computers. This is another area that is forcing change on the work we do and why I believe we cannot afford to rest on any laurels we think we may have in our field of distinction and move as quickly as is reasonably practicable to do so to generate Certified/Validated tools.
Wednesday, February 11, 2009
Forensic Science Regulator
Forensic Science Regulator
.
I would urge all of you who examine mobile telephones and computers that if you want to do public sector work for evidence in civil and criminal proceedings in the UK and you are not on the Forensic Science Regulator's (FSR) list of approved suppliers then you may not get any work at all.
.
Dr Chris Pamplin from the UK Register of Expert Witnesses has presented some open discussion on the FSR's report.
.
One recommendation is the demise of the Council for the Registration of Forensic Practitioners (CRFP)
.
Here is the weblink and go to the section on Understanding the Issues and read all the threads...very informative.
.
.
Subscribe to:
Posts (Atom)
