CNIT 121: Computer Forensics

Fall 2016 Sam Bowne

CRN 77242 Wed 6:10 - 9 pm SCIE 200

Textbook

Incident Response & Computer Forensics, Third Edition by by Jason Luttgens, Matthew Pepe, and Kevin Mandia
Publisher: McGraw-Hill Education; 3 edition (August 1, 2014)
Sold by: Amazon Digital Services, LLC
ASIN: B00JFG7152
Kindle edition: $36, Paper edition: $16 (prices I saw on 4-10-16 at Amazon)
Buy from Amazon ($15 - $40)

Catalog Description

Forensics tools, methods and procedures for investigating computers. Data recovery techniques and evidence collection, protection of evidence, expert witness skills and computer crime investigation techniques. Analysis of various file systems and specialized diagnostic software to retrieve data. Prepares in part for CompTIA Security+ and maps to Computer Investigation Specialists exam.
CSU

Examine computer media to discover evidence.

Prerequisite: Students should have taken CNIT 120 or have equivalent familiarity with the fundamentals of security.

After successful completion of this course, students will be able to:

Outcome 1: Define and describe computer forensics investigations.
Outcome 2: Compare and contrast the various operating systems and file systems.
Outcome 3: Evaluate and choose appropriate software, hardware, and tools to equip a Forensics Lab.
Outcome 4: Retrieve and analyze data from a suspect's computer.
Outcome 5: Create investigative reports and act as an expert witness.

Schedule

Wed 8-17		1 Real-World Incidents


Wed 8-24		2 IR Management Handbook


*Fri 9-2*	*Last Day to Add*

Wed 8-31		3 Pre-Incident Preparation


Wed 9-7	Quiz: Ch 1-3 Proj 1 & 2 due	4 Getting the Investigation Started on the Right Foot 5 Initial Development of Leads


Wed 9-14	Quiz: Ch 4 Proj 3 due	6 Discovering the Scope of the Incident 7 Live Data Collection


Wed 9-21	Quiz: Ch 6 & 7	8 Forensic Duplication


Wed 9-28	Quiz: Ch 8 Proj 4 & 6 & 7 due	9 Network Evidence


Wed 10-5	Quiz: Ch 9 Proj 8 & 9 due	10 Enterprise Services


Wed 10-12	Quiz: Ch 10 Proj 10 & 5 due	11 Analysis Methodology


Wed 10-19	Quiz: Ch 11 Proj 11 due	12 Investigating Windows Systems (Part 1) (Video for second half of class was lost)


*Mon 10-24*	*Mid-term grades due*
Wed 10-26	Guest Speaker: No Quiz, no Proj due Conrad del Rosario Assistant District Attorney San Francisco District Attorney's Office White Collar Crimes Division Case study on the Terry Childs case & more Please read this case document before the talk. Another reference: Healthy Paranoia Show 12: The Saga Of Terry Childs Biography

Wed 11-2	No Quiz Proj 12 & 13 due	12 Investigating Windows Systems (Part 2)


Wed 11-9	No Quiz Proj 14 due	12 Investigating Windows Systems (Part 3)


Wed 11-16	Quiz: Ch 12 Proj 15 due	13 Investigating Mac OS X Systems


Wed 11-23	Quiz: Ch 13 Proj 16 & 17 due	14 Investigating Applications


Wed 11-30	No Quiz Proj 18 due	17 Remediation Introduction


Wed 12-7	Last Class: No Quiz All Extra Credit Proj due	16 Report Writing


Wed 12-14		*Final Exam*

Lectures
Policy
Student Agreement
1 Real-World Incidents · KEY · PDF 2 IR Management Handbook · KEY · PDF 3 Pre-Incident Preparation · KEY · PDF 4 Getting the Investigation Started on the Right Foot & 5 Initial Development of Leads · KEY · PDF 6 Discovering the Scope of the Incident & 7 Live Data Collection · KEY · PDF 8 Forensic Duplication · KEY · PDF 9 Network Evidence · KEY · PDF 10 Enterprise Services · KEY · PDF 11 Analysis Methodology · KEY · PDF 12 Investigating Windows Systems (Part 1 of 3) · KEY · PDF 12 Investigating Windows Systems (Part 2 of 3) · KEY · PDF 12 Investigating Windows Systems (Part 3 of 3) · KEY · PDF 13 Investigating Mac OS X Systems · KEY · PDF 14 Investigating Applications · KEY · PDF ~~15 Malware Triage~~ 16 Report Writing · KEY · PDF 17 Remediation Introduction (Part 1) · KEY · PDF 18 Remediation Case Study
Click a lecture name to see it on SlideShare. If you want to use other formats, you may find this useful: Cloud Convert.

Back to Top

Projects
Downloading the Virtual Machines Download VMware Player Project 1: Using Virtual Machines (revised 8-16-16) (15 pts.) How to Fix Kali 2 Repositories Project 2: Capturing a RAM Image (written 1-7-2014) (15 pts.) memdump.7z (Use right-click, "Save As...") Project 3: Analyzing a RAM Image with Bulk Extractor (written 1-7-2014) (15 pts.) Project 4: Analyzing a RAM Image with Volatility (written 1-8-2014) (15 pts.) Project 5: Prefetch (10 pts.) Project 6: Recovering Deleted Photographs with PhotoRec (10 pts.) nps-2009-canon2-gen6.dd (Use right-click, "Save As...") Project 7: Rebuilding an Image Header (10 pts.) badheader.jpg (Use right-click, "Save As...") Project 8: NTFS Data Runs (25 pts.) (Rev. 10-5-16) FILE1.TXT FILE2.TXT Project 9: Fixing the Partition Table with TestDisk (20 pts.) Project 10: Static Acquisition with DEFT (20 Points) (rev. 1-26-15) p10Evidence.zip Project 11: Using EnCase (15 pts.) Project 12: Introduction to FTK (15 pts.) Project 13: Using FTK (25 pts.) Project 14: Acquiring a Forensic Image of an Android Phone (25 pts.) (rev. 11-9-16) Project 15: Live Response with Mandiant Redline (15 pts.) Project 16: Data Carving with Foremost (15 Points) Project 17: Capturing and Examining the Registry (30 pts.) Project 18: Shadow Copies and CCleaner (20 pts.) (Rev. 11-22-16) How to Increase the VMWare Boot Screen Delay Extra Credit Projects Project X0: Essential Linux (15 pts. extra credit) Project X1: Identifying File Types (Up to 25 points) text.7z Project X2: Static Image (15 pts. extra credit) Proj X2 Evidence File Project X3: National Software Reference Library (10 pts.) (Updated 11-16-16) Project X4: Acquiring an iPad image with iTunes (15 pts.) (rev. 5-6-15) Project X5: Sleuthkit and Autopsy (15 pts. extra credit) (rev. 10-13-16) Project X6: Analyzing an iTunes Backup with Magnet Forensics' Internet Evidence Finder (15 pts.) (rev. 11-29-16) Project X7: Procdump (10 pts.) Project X8: Thumbcache (10 pts.) Independent Projects (points vary)

Projects

Downloading the Virtual Machines

Download VMware Player

Project 1: Using Virtual Machines (revised 8-16-16) (15 pts.)

How to Fix Kali 2 Repositories

Project 2: Capturing a RAM Image (written 1-7-2014) (15 pts.)
     memdump.7z (Use right-click, "Save As...")
Project 3: Analyzing a RAM Image with Bulk Extractor (written 1-7-2014) (15 pts.)
Project 4: Analyzing a RAM Image with Volatility (written 1-8-2014) (15 pts.)
Project 5: Prefetch (10 pts.)
Project 6: Recovering Deleted Photographs with PhotoRec (10 pts.)
     nps-2009-canon2-gen6.dd (Use right-click, "Save As...")
Project 7: Rebuilding an Image Header (10 pts.)
     badheader.jpg (Use right-click, "Save As...")
Project 8: NTFS Data Runs (25 pts.) (Rev. 10-5-16)
      FILE1.TXT       FILE2.TXT
Project 9: Fixing the Partition Table with TestDisk (20 pts.)
Project 10: Static Acquisition with DEFT (20 Points) (rev. 1-26-15)
      p10Evidence.zip
Project 11: Using EnCase (15 pts.)
Project 12: Introduction to FTK (15 pts.)
Project 13: Using FTK (25 pts.)
Project 14: Acquiring a Forensic Image of an Android Phone (25 pts.) (rev. 11-9-16)
Project 15: Live Response with Mandiant Redline (15 pts.)
Project 16: Data Carving with Foremost (15 Points)
Project 17: Capturing and Examining the Registry (30 pts.)
Project 18: Shadow Copies and CCleaner (20 pts.) (Rev. 11-22-16)

How to Increase the VMWare Boot Screen Delay

Extra Credit Projects

Project X0: Essential Linux (15 pts. extra credit)

Project X1: Identifying File Types (Up to 25 points) text.7z
Project X2: Static Image (15 pts. extra credit) Proj X2 Evidence File
Project X3: National Software Reference Library (10 pts.) (Updated 11-16-16)
Project X4: Acquiring an iPad image with iTunes (15 pts.) (rev. 5-6-15)
Project X5: Sleuthkit and Autopsy (15 pts. extra credit) (rev. 10-13-16)
Project X6: Analyzing an iTunes Backup with Magnet Forensics' Internet Evidence Finder (15 pts.) (rev. 11-29-16)
Project X7: Procdump (10 pts.)
Project X8: Thumbcache (10 pts.)

Independent Projects (points vary)

Back to Top

Speaker Biography
Conrad del Rosario Graduated law school in 1991 and have worked as a prosecutor for over 20 years. Worked in various criminal units at the SF DA's office including domestic violence, sexual assault, and narcotics before working identity theft and high technology crimes. Currently the managing attorney for the Economic Crimes Unit, part of our White Collar Division, where I oversee 5 attorneys including the high technology and identity theft teams. Currently assigned to the Rapid Enforcement Allied Computer Team (REACT) Task Force which is a consortium of local law enforcement agencies investigating high technology crimes based out of Silicon Valley, member of HTCIA, and currently a certified instructor for Peace Officer Standards and Training (POST) in the area of High Technology Investigations.

Speaker Biography

Conrad del Rosario
Graduated law school in 1991 and have worked as a prosecutor for over 20 years. Worked in various criminal units at the SF DA's office including domestic violence, sexual assault, and narcotics before working identity theft and high technology crimes. Currently the managing attorney for the Economic Crimes Unit, part of our White Collar Division, where I oversee 5 attorneys including the high technology and identity theft teams.

Currently assigned to the Rapid Enforcement Allied Computer Team (REACT) Task Force which is a consortium of local law enforcement agencies investigating high technology crimes based out of Silicon Valley, member of HTCIA, and currently a certified instructor for Peace Officer Standards and Training (POST) in the area of High Technology Investigations.

Links
Links for Chapter Lectures Ch 1a: Deconstructing a Credit Card's Data Ch 1b: Mitigating Fraud Risk Through Card Data Verification Ch 1c: What data is stored on a payment card's magnetic stripe? Ch 2a: The OpenIOC Framework Ch 3a: Free Email Certificate \| Secure SSL Certificate from Comodo Ch 3b: Digitally Sign & Encrypt Emails Ch 3c: 3 Alternatives to the Now-Defunct TrueCrypt for Your Encryption Needs Ch 3d: VeraCrypt - Home Ch 3e: Security Onion Ch 3f: Network Security Toolkit (NST 24) Ch 3g: Skynet Solutions : EasyIDS Ch 3h: NIST Computer Forensic Tool Testing Program Ch 3i: Evidence Tags and Chain of Custody Forms Ch 3j: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Ch 3k: Federal Rules of Evidence Ch 3l: Security Technical Implementation Guides (STIGs) for host hardening Ch 3k: Securing Windows Service Accounts (Part 1) Ch 3l: Download Splunk Enterprise for free Ch 3m: GitHub - mcholste/elsa: Enterprise Log Search and Archive Ch 3n: Snare SIEM Software Products Ch 3o: SIEM, Security Information Event Management, ArcSight \| Hewlett Packard Enterprise Ch 3p: RSA enVision SIEM \| EMC RSA Ch 3q: Building a DNS Blackhole with FreeBSD Ch 3r: Windows DNS Server Sinkhole Domains Tool \| SANS Institute Ch 5a: Report Crimes Against Children \| Department of Justice Ch 7a: Redline User Guide Ch 7b: LINReS \| Network Intelligence India Pvt. Ltd.(NII Consulting), Mumbai Ch 7c: LiME – Linux Memory Extractor Ch 7d: Memoryze for Mac Ch 7e: Use the Mandiant Redline memory analysis tool for threat assessments Ch 8a: Host protected area - Wikipedia Ch 8b: Device configuration overlay - Wikipedia Ch 9a: Basic Snort Rules Syntax and Usage Ch 9b: Snort: Re: Rule for detecting ssh Ch 9c: OptiView XG Network Analysis Tablet Ch 9c: Network TAPs Ch 9d: Security Onion Ch 9e: Chapter 9 Scenario PCAPs - Incident Response and Computer Forensics, 3rd Edition Ch 9f: Download NetWitness Investigator Ch 9g: Old NetWitness Project Ch 10a: Analyze Microsoft DHCP Server Log Files Ch 10b: More About Microsoft DHCP Audit and Event Logging Ch 10c: DHCP \| Internet Systems Consortium Ch 10d: Linux How To/Tutorial: Checking DHCP Logs Ch 10e: using the ISC DHCP log function for debugging Ch 10f: BIND \| Internet Systems Consortium Ch 10g: DNSCAP - DNS traffic capture utility \| DNS-OARC Ch 10h: IT Information Systems Management Software \| LANDESK Ch 10i: Parsing Landesk Registry Entries FTW Ch 10k: LANDesk SoftMon Monitoring Information Ch 10l: How to browse Software License Monitoring data ... \|LANDESK User Community Ch 10m: RegRipper Ch 10n: GitHub - keydet89/RegRipper2.8 Ch 10o: GitHub - jprosco/registry-tools: Registry Forensics Tools Ch 10p: Client Management Suite \| Symantec Ch 10q: Altiris Inventory Solution™ 7.1 SP2 from Symantec™ User Guide Ch 10r: Symantec Quarantined VBN file decoder Ch 10s: John McAfee calls McAfee anti-virus "one of the worst products on the ... planet" Ch 10t: Removing a PHP Redirector Ch 10u: Understanding IIS 7 log files - Stack Overflow Ch 11i: Filesystem Timestamps: What Makes Them Tick? Ch 11j: File System Forensic Analysis: Brian Carrier Ch 11k: Uuencoding - Wikipedia Ch 11l: National Software Reference Library Ch 11m: Nsrllookup Ch 11n Security Firm Bit9 Hacked, Used to Spread Malware (2013) Other Links Yelp/osxcollector: A forensic evidence collection & analysis toolkit for OS X ProcDump SecureZeroMemory function (Windows) Under My Thumbs -- Revisiting Windows thumbnail databases Using Mandiant Redline to discover Meterpreter process injection - YouTube Elcomsoft Advanced mobile forensics: iOS (iPhone and iPad), Windows Phone and BlackBerry 10 Aid4Mail Now (Free Trial) New Unsorted Links Ch 11a: Sawmill Web Log Analysis Sample - Dashboard Ch 12a: File Times (Windows) Ch 12b: SetMace: Manipulate timestamps on NTFS Ch 12c: SANS Windows Artifact Analysis Poster Ch 12d: Known Alternate Stream Names Ch 12e: Bulk Removing Zone.Identifier Alternate Data Streams From Downloaded Windows Files Ch 12f: Streams Ch 12g: Manipulating Alternate Data Streams with PowerShell Ch 12h: INDXParse: Tool suite for inspecting NTFS artifacts. Ch 12i: Parse INDX Ch 12j: Fsutil usn: the USN Change Journal Ch 12k: Vssadmin Ch 12l: View the content of Windows Prefetch (.pf) files Ch 12k: FixEvt repairs corrupted Windows event logs Ch 12n: Job File Parser Ch 12o: SetRegTime Ch 12p: Windows USER - Wikipedia Ch 12q: Windows 7 Shellbags \| SANS Institute Ch 12r: MRU-Blaster Ch 12s: Registry Decoder Ch 12t: JLECmd: Automatic and Custom Destinations jump list parser with Windows 10 support Ch 12u: Rifiuti2 Ch 12t: Hiberfil.sys - ForensicsWiki Ch 12u: Zeus Malware Analysis using the Volatility Framework (Part I) Installing Rekall on Windows Download google/rekall � GitHub RecuperaBit - A Tool For Forensic File System Reconstruction Ch 12v: The VAD Tree: A Process-Eye View of Physical Memory Ch 13a: iBored Disk Editor for Mac Ch 13b: The MacPorts Project -- Download & Installation Ch 13c: OS X 10.9: where are password hashes stored Ch 13d: What type of hash are a Mac's password stored in? Ch 13e: How to crack macbook admin password Ch 13f: How to Convert plist Files to XML or Binary in Mac OS X Ch 14a: BrowsingHistoryView - View browsing history of your Web browsers Ch 14b: Extensible Storage Engine (ESE) Database File (EDB) format Ch 14c: ESEDatabaseView - View/Open ESE Database Files (Jet Blue / .edb files) Ch 14d: IECacheView - Internet Explorer Cache Viewer Ch 14e: Freeware Web Browser Tools Package Ch 14f: Google Chrome - ForensicsWiki Ch 14g: Browser Popularity Ch 14h: File:Browser usage share, 2009--2016, StatCounter.svg - Wikipedia Ch 14i: How to Read and Analyze the Email Header Fields and Information about SPF, DKIM, SpamAssassin Ch 14j: Inspect documents for hidden data and personal information iOS Secure Boot 101 Slides from Axi0mX Hibr2Bin: Comae Hibernation File Decompressor A glimpse of iOS 10 from a smartphone forensic perspective Mobile Forensics Monkey Wrench: iOS 10.2 and Encryption iOS Forensics (7/25/17) Evidence Acquisition and Analysis from iCloud GitHub - stuxnet999/MemLabs: Educational, CTF-styled labs for individuals interested in Memory Forensics Police Linked to Hacking Campaign to Frame Indian Activists (2022) -- IMPORTANT FORGED EVIDENCE Links from previous textbook

Links

Links for Chapter Lectures
Ch 1a: Deconstructing a Credit Card's Data
Ch 1b: Mitigating Fraud Risk Through Card Data Verification
Ch 1c: What data is stored on a payment card's magnetic stripe?

Ch 2a: The OpenIOC Framework

Ch 3a: Free Email Certificate | Secure SSL Certificate from Comodo
Ch 3b: Digitally Sign & Encrypt Emails
Ch 3c: 3 Alternatives to the Now-Defunct TrueCrypt for Your Encryption Needs
Ch 3d: VeraCrypt - Home
Ch 3e: Security Onion
Ch 3f: Network Security Toolkit (NST 24)
Ch 3g: Skynet Solutions : EasyIDS
Ch 3h: NIST Computer Forensic Tool Testing Program
Ch 3i: Evidence Tags and Chain of Custody Forms
Ch 3j: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations
Ch 3k: Federal Rules of Evidence
Ch 3l: Security Technical Implementation Guides (STIGs) for host hardening
Ch 3k: Securing Windows Service Accounts (Part 1)
Ch 3l: Download Splunk Enterprise for free
Ch 3m: GitHub - mcholste/elsa: Enterprise Log Search and Archive
Ch 3n: Snare SIEM Software Products
Ch 3o: SIEM, Security Information Event Management, ArcSight | Hewlett Packard Enterprise
Ch 3p: RSA enVision SIEM | EMC RSA
Ch 3q: Building a DNS Blackhole with FreeBSD
Ch 3r: Windows DNS Server Sinkhole Domains Tool | SANS Institute

Ch 5a: Report Crimes Against Children | Department of Justice

Ch 7a: Redline User Guide
Ch 7b: LINReS | Network Intelligence India Pvt. Ltd.(NII Consulting), Mumbai
Ch 7c: LiME – Linux Memory Extractor
Ch 7d: Memoryze for Mac
Ch 7e: Use the Mandiant Redline memory analysis tool for threat assessments

Ch 8a: Host protected area - Wikipedia
Ch 8b: Device configuration overlay - Wikipedia

Ch 9a: Basic Snort Rules Syntax and Usage
Ch 9b: Snort: Re: Rule for detecting ssh
Ch 9c: OptiView XG Network Analysis Tablet
Ch 9c: Network TAPs
Ch 9d: Security Onion
Ch 9e: Chapter 9 Scenario PCAPs - Incident Response and Computer Forensics, 3rd Edition
Ch 9f: Download NetWitness Investigator
Ch 9g: Old NetWitness Project

Ch 10a: Analyze Microsoft DHCP Server Log Files
Ch 10b: More About Microsoft DHCP Audit and Event Logging
Ch 10c: DHCP | Internet Systems Consortium
Ch 10d: Linux How To/Tutorial: Checking DHCP Logs
Ch 10e: using the ISC DHCP log function for debugging
Ch 10f: BIND | Internet Systems Consortium
Ch 10g: DNSCAP - DNS traffic capture utility | DNS-OARC
Ch 10h: IT Information Systems Management Software | LANDESK
Ch 10i: Parsing Landesk Registry Entries FTW
Ch 10k: LANDesk SoftMon Monitoring Information
Ch 10l: How to browse Software License Monitoring data ... |LANDESK User Community
Ch 10m: RegRipper
Ch 10n: GitHub - keydet89/RegRipper2.8
Ch 10o: GitHub - jprosco/registry-tools: Registry Forensics Tools
Ch 10p: Client Management Suite | Symantec
Ch 10q: Altiris Inventory Solution™ 7.1 SP2 from Symantec™ User Guide
Ch 10r: Symantec Quarantined VBN file decoder
Ch 10s: John McAfee calls McAfee anti-virus "one of the worst products on the ... planet"
Ch 10t: Removing a PHP Redirector
Ch 10u: Understanding IIS 7 log files - Stack Overflow

Ch 11i: Filesystem Timestamps: What Makes Them Tick?
Ch 11j: File System Forensic Analysis: Brian Carrier
Ch 11k: Uuencoding - Wikipedia
Ch 11l: National Software Reference Library
Ch 11m: Nsrllookup
Ch 11n Security Firm Bit9 Hacked, Used to Spread Malware (2013)

Other Links
Yelp/osxcollector: A forensic evidence collection & analysis toolkit for OS X
ProcDump
SecureZeroMemory function (Windows)
Under My Thumbs -- Revisiting Windows thumbnail databases
Using Mandiant Redline to discover Meterpreter process injection - YouTube
Elcomsoft Advanced mobile forensics: iOS (iPhone and iPad), Windows Phone and BlackBerry 10
Aid4Mail Now (Free Trial)

New Unsorted Links
Ch 11a: Sawmill Web Log Analysis Sample - Dashboard
Ch 12a: File Times (Windows)
Ch 12b: SetMace: Manipulate timestamps on NTFS
Ch 12c: SANS Windows Artifact Analysis Poster
Ch 12d: Known Alternate Stream Names
Ch 12e: Bulk Removing Zone.Identifier Alternate Data Streams From Downloaded Windows Files
Ch 12f: Streams
Ch 12g: Manipulating Alternate Data Streams with PowerShell
Ch 12h: INDXParse: Tool suite for inspecting NTFS artifacts.
Ch 12i: Parse INDX
Ch 12j: Fsutil usn: the USN Change Journal
Ch 12k: Vssadmin
Ch 12l: View the content of Windows Prefetch (.pf) files
Ch 12k: FixEvt repairs corrupted Windows event logs
Ch 12n: Job File Parser
Ch 12o: SetRegTime
Ch 12p: Windows USER - Wikipedia
Ch 12q: Windows 7 Shellbags | SANS Institute
Ch 12r: MRU-Blaster
Ch 12s: Registry Decoder
Ch 12t: JLECmd: Automatic and Custom Destinations jump list parser with Windows 10 support
Ch 12u: Rifiuti2
Ch 12t: Hiberfil.sys - ForensicsWiki
Ch 12u: Zeus Malware Analysis using the Volatility Framework (Part I)
Installing Rekall on Windows
Download google/rekall � GitHub
RecuperaBit - A Tool For Forensic File System Reconstruction
Ch 12v: The VAD Tree: A Process-Eye View of Physical Memory
Ch 13a: iBored Disk Editor for Mac
Ch 13b: The MacPorts Project -- Download & Installation
Ch 13c: OS X 10.9: where are password hashes stored
Ch 13d: What type of hash are a Mac's password stored in?
Ch 13e: How to crack macbook admin password
Ch 13f: How to Convert plist Files to XML or Binary in Mac OS X
Ch 14a: BrowsingHistoryView - View browsing history of your Web browsers
Ch 14b: Extensible Storage Engine (ESE) Database File (EDB) format
Ch 14c: ESEDatabaseView - View/Open ESE Database Files (Jet Blue / .edb files)
Ch 14d: IECacheView - Internet Explorer Cache Viewer
Ch 14e: Freeware Web Browser Tools Package
Ch 14f: Google Chrome - ForensicsWiki
Ch 14g: Browser Popularity
Ch 14h: File:Browser usage share, 2009--2016, StatCounter.svg - Wikipedia
Ch 14i: How to Read and Analyze the Email Header Fields and Information about SPF, DKIM, SpamAssassin
Ch 14j: Inspect documents for hidden data and personal information
iOS Secure Boot 101 Slides from Axi0mX
Hibr2Bin: Comae Hibernation File Decompressor
A glimpse of iOS 10 from a smartphone forensic perspective
Mobile Forensics Monkey Wrench: iOS 10.2 and Encryption
iOS Forensics (7/25/17)
Evidence Acquisition and Analysis from iCloud
GitHub - stuxnet999/MemLabs: Educational, CTF-styled labs for individuals interested in Memory Forensics
Police Linked to Hacking Campaign to Frame Indian Activists (2022) -- IMPORTANT FORGED EVIDENCE

Links from previous textbook

Back to Top

Last Updated: 12-8-16 8:15 am

CNIT 121: Computer Forensics

Fall 2016 Sam Bowne

CRN 77242 Wed 6:10 - 9 pm SCIE 200

Scores

Open Lab Hours for Sci 214

Schedule · Lectures · Projects · Speakers · Links · Home Page

Textbook

Catalog Description

Schedule

Lectures

Projects

Extra Credit Projects

Speaker Biography

Links

Links for Chapter Lectures

Other Links

New Unsorted Links