2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering最新文献

A Research Configuration for a Digital Network Forensic Lab 数字网络取证实验室的研究配置

2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering Pub Date : 2008-05-22 DOI: 10.1109/SADFE.2008.23

Jeffrey S. Marean, M. Losavio, Ibrahim N. Imam

{"title":"A Research Configuration for a Digital Network Forensic Lab","authors":"Jeffrey S. Marean, M. Losavio, Ibrahim N. Imam","doi":"10.1109/SADFE.2008.23","DOIUrl":"https://doi.org/10.1109/SADFE.2008.23","url":null,"abstract":"Summary form only given. The digital forensic network lab is implemented with the goal of providing all students and faculty with a configurable research environment ideally suited for conducting network forensic testing on all TCP/IP network protocols passing through it. Of particular interest are protocols that are commonly used for file sharing, message passing, and those that actively obfuscate or encrypt message traffic. Notably, Bit Torrent protocol, P2P protocols, IM (instant messaging) protocols, and anonymizing protocols such as I2P, Thor, and Freenet. Items of interest in protocol analysis include packet payload, sender and receiver real IP address, and crypto analysis.The forensic test bed consists of an a main node populated with a Cisco WAN router. This is the master router for the lab. It routes internal traffic between the three research nodes and selected outside networks. Populating the a node and the two remote nodes, B and C, are a combination of a Cisco routers, Cisco firewalls, Cisco switches, and computers. Each node has five dual core X86 computers capable of running combinations of Linux x86- 32 or -64 OS's, Microsoft x86-32 or -64 OS's, and, if necessary, both OS's can be configured to either use Microsoft, VMWare or Xen virtualization software. The a main node is connected remotely to the C node via a campus fast Ethernet circuit. While the B node, co-located with the a main node, is connected together via a fast Ethernet and Tl circuit. To increase the infrastructure component of the lab we have the ability to selectively place the forensic lab into an existing classroom domain for wider access to students and faculty researchers.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115624046","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Implications of Attorney Experiences with Digital Forensics and Electronic Evidence in the United States 美国律师在数字取证和电子证据方面的经验启示

2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering Pub Date : 2008-05-22 DOI: 10.1109/SADFE.2008.11

M. Losavio, D. Keeling, Adel Said Elmaghraby, George E. Higgins, J. Shutt

引用次数: 2

SÁDI - Statistical Analysis for Data Type Identification SÁDI -数据类型识别的统计分析

2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering Pub Date : 2008-05-22 DOI: 10.1109/SADFE.2008.13

Sarah J. Moody, R. Erbacher

{"title":"SÁDI - Statistical Analysis for Data Type Identification","authors":"Sarah J. Moody, R. Erbacher","doi":"10.1109/SADFE.2008.13","DOIUrl":"https://doi.org/10.1109/SADFE.2008.13","url":null,"abstract":"A key task in digital forensic analysis is the location of relevant information within the computer system. Identification of the relevancy of data is often dependent upon the identification of the type of data being examined. Typical file type identification is based upon file extension or magic keys. These typical techniques fail in many typical forensic analysis scenarios such as needing to deal with embedded data, such as with Microsoft Word files, or file fragments. The SADI (Statistical Analysis Data Identification) technique applies statistical analysis of the byte values of the data in such a way that the accuracy of the technique does not rely on the potentially misleading metadata information but rather the values of the data itself. The development of SADI provides the capability to identify what digitally stored data actually represents and will also allow for the selective extraction of portions of the data for additional investigation; i.e., in the case of embedded data. Thus, our research provides a more effective type identification technique that does not fail on file fragments, embedded data types, or with obfuscated data.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122659787","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 45

Finding the Evidence in Tamper-Evident Logs 在可篡改日志中查找证据

2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering Pub Date : 2008-05-22 DOI: 10.1109/SADFE.2008.22

Daniel Sandler, Kyle Derr, Scott A. Crosby, D. Wallach

引用次数: 12

Protecting Digital Legal Professional Privilege (LPP) Data 保护数字法律专业特权(LPP)数据

2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering Pub Date : 2008-05-22 DOI: 10.1109/SADFE.2008.19

F. Law, P. Lai, Z. L. Jiang, R. Ieong, M. Kwan, K. Chow, L. Hui, S. Yiu, C. Chong

引用次数: 8

Combining Physical and Digital Evidence in Vehicle Environments 结合车辆环境中的物理和数字证据

2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering Pub Date : 2008-05-22 DOI: 10.1109/SADFE.2008.10

D. Nilsson, U. Larson

引用次数: 16

Legal Issues Pertaining to the Development of Digital Forensic Tools 与数字取证工具发展有关的法律问题

2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering Pub Date : 2008-05-22 DOI: 10.1109/SADFE.2008.17

Charles W. Adams

引用次数: 31

Node-Based Probing and Monitoring to Investigate Use of Peer-to-Peer Technologies for Distribution of Contraband Material 基于节点的探测和监测以调查使用点对点技术分发违禁品的情况

2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering Pub Date : 2008-05-22 DOI: 10.1109/SADFE.2008.16

O. Nasraoui, D. Keeling, Adel Said Elmaghraby, George E. Higgins, M. Losavio

{"title":"Node-Based Probing and Monitoring to Investigate Use of Peer-to-Peer Technologies for Distribution of Contraband Material","authors":"O. Nasraoui, D. Keeling, Adel Said Elmaghraby, George E. Higgins, M. Losavio","doi":"10.1109/SADFE.2008.16","DOIUrl":"https://doi.org/10.1109/SADFE.2008.16","url":null,"abstract":"We consider the requirements for node-based probing and monitoring for network forensic investigation of the use of peer-to-peer technologies for distribution of contraband material. The architecture of peer-to-peer (P2P) data exchanges must be examined for opportunities to capture data on the transfer of contraband data with a focus on node structures in P2P exchanges. This examination is of technical, social and legal aspects of P2P use leading to the design and testing offorensically-sound investigative tools and protocols. Computational research must examine: 1. Undercover Node-based Probing and Monitoring to Build an Approximate Model of Network Activity 2. Flagging Contraband Content (keyword, hashes, other patterns) 3. Evaluation against different recipient querying, distribution and routing cases 4. Using the Evaluation results to fine-tune the node positioning strategy Legal and social research is needed to examine the U.S. and transnational legal constraints on the use of particular tools and the presence of possible behavioral signatures.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128109776","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Exemplifying Attack Identification and Analysis in a Novel Forensically Viable Syslog Model 在一种新的法医可行的Syslog日志模型中举例说明攻击识别和分析

2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering Pub Date : 2008-05-22 DOI: 10.1109/SADFE.2008.14

S. Monteiro, R. Erbacher

引用次数: 14

Towards the Virtual Memory Space Reconstruction for Windows Live Forensic Purposes 面向Windows实时取证目的的虚拟内存空间重构

2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering Pub Date : 2008-05-22 DOI: 10.1109/SADFE.2008.21

Antonio Savoldi, P. Gubian

引用次数: 12