CNIT 121: Computer Forensics

Spring 2012 Sam Bowne

CRN 33817 Wed 6 pm - 9 pm SCIE 200


Open Lab Hours for Sci 214

Schedule · Lecture Notes · Projects · Links · Home Page

text (141K)


Guide to Computer Forensics and Investigations, Fourth Edition, by Bill Nelson, Amelia Phillips, Christopher Steuart; ISBN-10: 1435498836
Buy printed book from Amazon
Buy e-book from Cengage
Guide to Computer Forensics and Investigations, 4th Edition
by Nelson; Phillips; Steuart
Price to Student $53.49

Catalog Description

The class covers forensics tools, methods, and procedures used for investigation of computers, techniques of data recovery and evidence collection, protection of evidence, expert witness skills, and computer crime investigation techniques. Includes analysis of various file systems and specialized diagnostic software used to retrieve data. Prepares for part of the industry standard certification exam, Security+, and also maps to the Computer Investigation Specialists exam.

Examine computer media to discover evidence.

Prerequisite: Students should have taken CNIT 120 or have equivalent familiarity with the fundamentals of security.

Upon successful completion of this course, the student will be able to:

  1. Define and describe computer investigations
  2. Demonstrate correct methods of evidence gathering
  3. Use and evaluate various operating systems and file systems
  4. Equip a Forensics Lab with appropriate hardware and software
  5. Install, configure, and use various command-line and graphical software forensics tools
  6. Describe and compare various hardware devices employed by computer forensics experts
  7. Retrieve and analyze data from a suspect's computer
  8. Create security implementation plans
  9. Summarize the evidence and write investigative reports
  10. Utilize the services of expert witnesses
  11. Recover file images, and categorize the data
  12. Examine and trace email messages
  13. Obtain and control digital evidence


Date         QuizTopic
Wed 1-18  Ch 1: Computer Forensics and Investigation Processes
Wed 1-25  Ch 2: Understanding Computing Investigations
Wed 2-1 Ch 3: The Investigator's Office and Laboratory
Fri 2-3 Last Day to Add Classes
Wed 2-8Quiz on Ch 1-3  
Proj 1-4 due
Ch 4: Data Acquisitions
Wed 2-15Quiz on Ch 4 
Proj 5-6 due
Ch 5: Processing Crime and Incident Scenes
Tue 2-21 Last Day to Request pass/no pass Grading
Wed 2-22Quiz on Ch 5 
Proj 7-8 due
Ch 6: Working with Windows and DOS Systems
Wed 2-29Quiz on Ch 6 
Proj 9 due
Ch 7. Current Computer Forensics Tools
Wed 3-7Quiz on Ch 7 
Proj 10 due
Ch 8: Macintosh and Linux Boot Processes and File Systems
Wed 3-14Quiz on Ch 8 
Proj 11 due
Ch 9: Computer Forensics Analysis
Wed 3-21Quiz on Ch 9
Proj 12 due
Ch 10: Recovering Graphics Files
Wed 3-28 Holiday - No Class
Wed 4-4Quiz on Ch 10 
No Proj due
Ch 11: Virtual Machines, Network Forensics, and Live Acquisitions
Wed 4-11No Quiz, no Proj. due Guest Speaker: Chris Bross, Strategic Technical Alliances, Drive Savers Data Recovery
Wed 4-18Quiz on Ch 11 
Proj 14 due
Ch 12: E-mail Investigations &
Ch 13: Cell Phone and Mobile Device Forensics
Thu 4-19 Last Day to Withdraw
Wed 4-25Quiz on Ch 12-13 
Proj 15 due
Ch 14: Report Writing for High-Tech Investigations &
Ch 15: Expert Testimony in High-Tech Investigations
Wed 5-2Quiz on Ch 14&15
Proj 13 & 16 due
Ch 16: Ethics and High-Tech Investigations
Wed 5-9No Quiz ProDiscover and Data Carving
Wed 5-16No Quiz
All extra credit projects due
Last Class
Guest Speaker: Matthew Linton, NASA: "Using BSD & PFSense as an inexpensive enterprise firewall"
Wed 5-23  Final Exam: 6 pm SCIE 200

Lecture Notes

Student Agreement
1: Computer Forensics and Investigation Processes    Powerpoint
2: Understanding Computing Investigations    Powerpoint
3: The Investigator's Office and Laboratory    Powerpoint
4: Data Acquisitions (modified 9-23-10)    Powerpoint
5: Processing Crime and Incident Scenes    Powerpoint
6: Working with Windows and DOS Systems    Powerpoint
7: Current Computer Forensics Tools    Powerpoint
8: Macintosh and Linux Boot Processes and File Systems    Powerpoint
9: Computer Forensics Analysis    Powerpoint
10: Recovering Graphics Files    Powerpoint
11: Virtual Machines, Network Forensics, and Live Acquisitions    Powerpoint
12: E-mail Investigations    Powerpoint
13: Cell Phone and Mobile Device Forensics    Powerpoint
14: Report Writing for High-Tech Investigations    Powerpoint
15: Expert Testimony in High-Tech Investigations    Powerpoint
16: Ethics and High-Tech Investigations    Powerpoint
The lectures are in Word and PowerPoint formats.
If you do not have Word or PowerPoint you will need to install the
Free Word Viewer 2003 and/or the Free PowerPoint Viewer 2003.

Back to Top


How to Read Your CCSF Email
How to Get your Windows Activation Codes from MSDNAA
Downloading MSDNAA Software
Virtual Machines at Home
VMware Networking Troubleshooting
Fixing Problems with Ubuntu on VMware

Project 1: Preparing a Windows XP Virtual Machine (10 pts.)
Project 2: Viewing Segments and Clusters with a Hex Editor (25 pts.)
Project 3: Installing FTK (15 pts.) (revised 1-25-12)
Project 4: Examining the Registry (15 pts.) (revised 1-25-12)
Project 5: Capturing the Registry with FTK Imager (20 pts.) (revised 2-1-12)
Project 6: Learning About the Registry from the FTK User Guide (10 pts.) (rev. 1-16-12)
Project 7: USB Write-Blocking in the Registry (15 pts.) (rev. 2-15-12)
Project 8: Static Acquisition with BackTrack 5 R1 (20 pts.) (revised 2-8-12)      Proj 8 Evidence File (383 KB)
Project 9: Sloppy Static Acquisition with FTK Imager in Windows (15 pts.) (revised 2-8-12)
Project 10: Better Static Acquisition with FTK Imager in Windows (15 pts.) (revised 2-8-12) File (99 KB)
Project 11: Static Acquisition with Raptor 2 (15 pts.) (revised 2-8-12)
Project 12: Analyzing an Image with FTK (20 pts.) (revised 9-27-10)
(Finally ready!) Project 13: Sleuthkit and Autopsy (15 pts.) (revised 2:45 pm 4-18-12)
Project 14: Rebuilding an Image Header (10 pts.)      Proj 14 image
Project 15: EnCase (15 pts.)
Project 16: RAM Capture and Analysis (15 pts.) (rev. 5-2-12)

Extra Credit Projects

Project X1: Using a PDF Exploit with Metasploit (15 pts. extra credit) (revised 10-14-10)
Project X2: Static Image (15 pts. extra credit)      Proj X2 Evidence File
Project X3: Bypassing a BIOS password (15 pts. extra credit)
Project X4: TrueCrypt (15 pts. extra credit)
Project X5: MD5 Collisions (15 pts. extra credit)
Project X6: Encrypted Email (15 pts. extra credit)
Project X7: Making a Report with ProDiscover and FTK (20 pts. extra credit)
Project X8: Amazon Web Services (15 pts. extra credit)
Project X9: SSH Honeypot on AWS (15-20 pts. extra credit)
Project X10: File and Strings (10 pts. extra credit)

Project X11: Using IDA Pro Free to Disassemble Executable Files (10 - 40 pts. extra credit)
      crackme-121-1.exe       crackme-121-2.exe       crackme-121-3.exe       crackme-121-4.exe

Project X12: Harvesting Files from Packet Captures with Wireshark (10 pts.)
      pX12-121.pcap (1.2 MB)

Project X13: Dynamic Malware Analysis with RegShot and Process Monitor (10 pts.)

Project X14: Analyzing Running Programs with LordPE (10 pts.)

Project X15: Data Carving with ProDiscover (10 pts.)

Independent Projects (points vary)

There are more projects coming later, of course

Back to Top


Links for Chapter Lectures

Ch 1a: Deconstructing a Credit Card's Data
Ch 1b: Mitigating Fraud Risk Through Card Data Verification
Ch 1c: What data is stored on a payment card's magnetic stripe?

Ch 2a: The OpenIOC Framework

Ch 3a: Free Email Certificate | Secure SSL Certificate from Comodo
Ch 3b: Digitally Sign & Encrypt Emails
Ch 3c: 3 Alternatives to the Now-Defunct TrueCrypt for Your Encryption Needs
Ch 3d: VeraCrypt - Home
Ch 3e: Security Onion
Ch 3f: Network Security Toolkit (NST 24)
Ch 3g: Skynet Solutions : EasyIDS
Ch 3h: NIST Computer Forensic Tool Testing Program
Ch 3i: Evidence Tags and Chain of Custody Forms
Ch 3j: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations
Ch 3k: Federal Rules of Evidence
Ch 3l: Security Technical Implementation Guides (STIGs) for host hardening
Ch 3k: Securing Windows Service Accounts (Part 1)
Ch 3l: Download Splunk Enterprise for free
Ch 3m: GitHub - mcholste/elsa: Enterprise Log Search and Archive
Ch 3n: Snare SIEM Software Products
Ch 3o: SIEM, Security Information Event Management, ArcSight | Hewlett Packard Enterprise
Ch 3p: RSA enVision SIEM | EMC RSA
Ch 3q: Building a DNS Blackhole with FreeBSD
Ch 3r: Windows DNS Server Sinkhole Domains Tool | SANS Institute

Ch 5a: Report Crimes Against Children | Department of Justice

Ch 7a: Redline User Guide
Ch 7b: LINReS | Network Intelligence India Pvt. Ltd.(NII Consulting), Mumbai
Ch 7c: LiME – Linux Memory Extractor
Ch 7d: Memoryze for Mac
Ch 7e: Use the Mandiant Redline memory analysis tool for threat assessments

Ch 8a: Host protected area - Wikipedia
Ch 8b: Device configuration overlay - Wikipedia

Ch 9a: Basic Snort Rules Syntax and Usage
Ch 9b: Snort: Re: Rule for detecting ssh
Ch 9c: OptiView XG Network Analysis Tablet
Ch 9c: Network TAPs
Ch 9d: Security Onion
Ch 9e: Chapter 9 Scenario PCAPs - Incident Response and Computer Forensics, 3rd Edition
Ch 9f: Download NetWitness Investigator
Ch 9g: Old NetWitness Project

Ch 10a: Analyze Microsoft DHCP Server Log Files
Ch 10b: More About Microsoft DHCP Audit and Event Logging
Ch 10c: DHCP | Internet Systems Consortium
Ch 10d: Linux How To/Tutorial: Checking DHCP Logs
Ch 10e: using the ISC DHCP log function for debugging
Ch 10f: BIND | Internet Systems Consortium
Ch 10g: DNSCAP - DNS traffic capture utility | DNS-OARC
Ch 10h: IT Information Systems Management Software | LANDESK
Ch 10i: Parsing Landesk Registry Entries FTW
Ch 10k: LANDesk SoftMon Monitoring Information
Ch 10l: How to browse Software License Monitoring data ... |LANDESK User Community
Ch 10m: RegRipper
Ch 10n: GitHub - keydet89/RegRipper2.8
Ch 10o: GitHub - jprosco/registry-tools: Registry Forensics Tools
Ch 10p: Client Management Suite | Symantec
Ch 10q: Altiris Inventory Solution™ 7.1 SP2 from Symantec™ User Guide
Ch 10r: Symantec Quarantined VBN file decoder
Ch 10s: John McAfee calls McAfee anti-virus "one of the worst products on the ... planet"
Ch 10t: Removing a PHP Redirector
Ch 10u: Understanding IIS 7 log files - Stack Overflow

Ch 11i: Filesystem Timestamps: What Makes Them Tick?
Ch 11j: File System Forensic Analysis: Brian Carrier
Ch 11k: Uuencoding - Wikipedia
Ch 11l: National Software Reference Library
Ch 11m: Nsrllookup
Ch 11n Security Firm Bit9 Hacked, Used to Spread Malware (2013)

Other Links

Yelp/osxcollector: A forensic evidence collection & analysis toolkit for OS X
SecureZeroMemory function (Windows)
Under My Thumbs -- Revisiting Windows thumbnail databases
Using Mandiant Redline to discover Meterpreter process injection - YouTube
Elcomsoft Advanced mobile forensics: iOS (iPhone and iPad), Windows Phone and BlackBerry 10
Aid4Mail Now (Free Trial)

New Unsorted Links

Ch 11a: Sawmill Web Log Analysis Sample - Dashboard
Ch 12a: File Times (Windows)
Ch 12b: SetMace: Manipulate timestamps on NTFS
Ch 12c: SANS Windows Artifact Analysis Poster
Ch 12d: Known Alternate Stream Names
Ch 12e: Bulk Removing Zone.Identifier Alternate Data Streams From Downloaded Windows Files
Ch 12f: Streams
Ch 12g: Manipulating Alternate Data Streams with PowerShell
Ch 12h: INDXParse: Tool suite for inspecting NTFS artifacts.
Ch 12i: Parse INDX
Ch 12j: Fsutil usn: the USN Change Journal
Ch 12k: Vssadmin
Ch 12l: View the content of Windows Prefetch (.pf) files
Ch 12k: FixEvt repairs corrupted Windows event logs
Ch 12n: Job File Parser
Ch 12o: SetRegTime
Ch 12p: Windows USER - Wikipedia
Ch 12q: Windows 7 Shellbags | SANS Institute
Ch 12r: MRU-Blaster
Ch 12s: Registry Decoder
Ch 12t: JLECmd: Automatic and Custom Destinations jump list parser with Windows 10 support
Ch 12u: Rifiuti2
Ch 12t: Hiberfil.sys - ForensicsWiki
Ch 12u: Zeus Malware Analysis using the Volatility Framework (Part I)
Installing Rekall on Windows
Download google/rekall � GitHub
RecuperaBit - A Tool For Forensic File System Reconstruction
Ch 12v: The VAD Tree: A Process-Eye View of Physical Memory
Ch 13a: iBored Disk Editor for Mac
Ch 13b: The MacPorts Project -- Download & Installation
Ch 13c: OS X 10.9: where are password hashes stored
Ch 13d: What type of hash are a Mac's password stored in?
Ch 13e: How to crack macbook admin password
Ch 13f: How to Convert plist Files to XML or Binary in Mac OS X
Ch 14a: BrowsingHistoryView - View browsing history of your Web browsers
Ch 14b: Extensible Storage Engine (ESE) Database File (EDB) format
Ch 14c: ESEDatabaseView - View/Open ESE Database Files (Jet Blue / .edb files)
Ch 14d: IECacheView - Internet Explorer Cache Viewer
Ch 14e: Freeware Web Browser Tools Package
Ch 14f: Google Chrome - ForensicsWiki
Ch 14g: Browser Popularity
Ch 14h: File:Browser usage share, 2009--2016, StatCounter.svg - Wikipedia
Ch 14i: How to Read and Analyze the Email Header Fields and Information about SPF, DKIM, SpamAssassin
Ch 14j: Inspect documents for hidden data and personal information
iOS Secure Boot 101 Slides from Axi0mX
Hibr2Bin: Comae Hibernation File Decompressor
A glimpse of iOS 10 from a smartphone forensic perspective
Mobile Forensics Monkey Wrench: iOS 10.2 and Encryption
iOS Forensics (7/25/17)
Evidence Acquisition and Analysis from iCloud

Back to Top
Last Updated: 5-16-12 4:00 pm