Discussion

discussion@lists.fsfe.org

1 participants
3272 discussions

Forensic Strategy Data Recovery Newsletter: Vol 1 Issue 1
by Forensic Strategy Newsletter 14 Apr '03

14 Apr '03

*********************************************************************** Forensic Strategy Data Recovery Newsletter Vol. 1, Issue 1 *********************************************************************** --------- EDITOR'S NOTE ----------------------------------------------- The intent of this newsletter is to educate and inform attorneys about basic computer forensics for cases that involve personal computers or computer evidence. Utilizing the services of a computer forensics specialist can eliminate problems that often occur when forensics is of significant importance to a case: timing, the handling of the data and the possibility of evidence being destroyed. -------- IN THIS ISSUE: ----------------------------------------------- 1. COMMENTARY - Computer Forensics 101: What is Computer Forensics? 2. SPONSOR - Varidev Technology Solutions 3. UPCOMING NEWSLETTER ISSUES - Items you can look forward to in future issues! 4. CONTACT US - For more information on Forensic Strategy Services. ----------------------------------------------------------------------- 1. ==== COMMENTARY ==== * COMPUTER FORENSICS 101: What is Computer Forensics? By: Scott Moulton, Computer Forensic Specialist mailto:scott@forensicfirm.com Forensics, as it relates to computers and data, is the collection and preservation of data to investigate or establish facts for any type of legal purpose. For each case, computer forensics can contain many different types of material and can be gathered from dozens of sources. Information can be limited to what exists on a hard drive and may even include data from the Internet, tapes, CDs, disks or printouts made by a specific computer. Computer forensics is an emerging specialty that has no defined criteria. This makes it difficult to find a person with the knowledge, experience and skills needed to be an expert in this area. Colleges are beginning to recognize this as a growing field and are adding degrees and certification programs to their curriculum. With the speed at which the computer industry changes, it is often a struggle for the legal profession to keep up with all of the new laws established to convict criminals who use technology as a weapon. It is equally challenging to locate a knowledgeable computer specialist that has the interest, expertise and skills in fields other than computer science. Consequently, a computer forensic specialist who has skills in other disciplines such as accounting and/or law, will deliver better results meaning more useful and credible evidence for you. Methodologies are a set of processes that can be applied to any situation. While the tools or items used to lay the groundwork for the discovery phase may vary, the methodology remains the same. Some of these methods are still being developed in the area of computer forensics. Changes are frequent because of new laws that require the way processes are completed. Other changes are due to an ever-evolving technology and the ability to completely remove two or three processes with new software or hardware. Qualified computer forensic specialists will spend considerable time staying in front of the new technology curve. It takes an extreme amount of work to keep up with the changes in the computing industry, as well as, issues involving the law. This is the type of expertise you should seek for assistance with cases requiring computer forensics. Most lawyers have little knowledge about computers and will need guidance as a case develops. They will continually need to discuss the case with a computer forensic specialist and review new material even when it seems unnecessary. When dealing with computers and data, the process of understanding what is achievable and what isn't requires an advanced understanding of technology generally not found outside the professional computer security community. Not only must the computer forensic specialist assist the attorney with what can be done but they must also stand as a credible witness under the pressure and scrutiny of cross examination. During the discovery phase of a case, being a forensic computer specialist can be compared to being a Private Investigator, only the subject matter is mainly dealing with computers and electronic data. Discovery often involves several passes at the data. As new facts are revealed about the case, the old data will need to be reviewed to see what has been discovered and how it is applicable to the case. In some cases, knowing what happened is more important than the actual data itself. Example #1: In a divorce case, a court order was given to the husband with instructions not to delete or destroy any data. The computer was to be picked up by a forensic investigator and reviewed for evidence per the court order. The husband promptly went home and deleted everything on the computer he thought would be incriminating. After examining the computer, it was proven that he purposely deleted data after the court order. Since he violated the court order, this case could have easily escalated into more than just a divorce case for the husband. When the opposing attorney confronted the husband with this fact, the husband quickly decided to settle out of court and agreed to his soon to be ex-wife's demands. Example #2: The majority of work is often discovering how to look at the information and display it so that it makes sense to laymen. This also includes educating the attorney about the technical details so they can decide how to approach the case. It is of no value if the information is so complex that it can not be explained clearly. In a recent case, a CD was stolen from a company. During the discovery period of the case, the defendant was ordered to make an EXACT copy of the original CD and deliver it to the plaintiff the same day. It was noted that one of the files had been changed on the CD. On the CD there were several files that amounted to 500 megabytes. This brand of CD was only able to hold 650 megabytes. The specific file in question was a 200 megabyte file. The defendants claim was that the CD was a CDRW (ReWritable CD) and that the file changed while viewing the CD. In this instance the changed file could not overwrite the existing file, but would be appended to the CD. As there was only 150 megabytes left, there was not enough space to append a 200 megabyte file. The defendant would have needed another 50 megabytes in order to make a change to the file on the same CD. Therefore, this was not an exact copy of the same CD that was taken. Only a computer specialist with experience with a ReWritable CD would have realized this was not possible. The opposing attorney initially accepted the explanation; however, the computer specialist on the team revealed that evidence had been tampered with. More examples and experiences will be discussed in future issues. If you are interested and would like to continue to receive our newsletter, please see our website to sign up for a FREE subscription at: http://www.forensicstrategy.com/contacts.asp ----------------------------------------------------------------------- -------- Sponsored by Varidev Technology Solutions -------------------- Varidev Technology Solutions can develop solutions to help your business operate more efficiently. Varidev is your complete business technology resource for front-end and back-end database development using Microsoft .NET Technology. Varidev has made operations much more efficient for companies like Six Flags and Georgia Pacific, and they can do it for you. Check out amazing demos at http://www.varidev.com ----------------------------------------------------------------------- 3. ==== UPCOMING NEWSLETTER ISSUES ==== * What items are usually found in data recovered * Equipment used for Forensic Storage of Data * Details of Forensic Data Gathering 4. ==== CONTACT US ==== * TECHNICAL QUESTIONS: mailto:info@forensicstrategy.com * COMMENTS OR QUESTIONS ABOUT THIS NEWSLETTER: To suggest a topic for a future issue or to send a comment to the editor email: mailto:comments@forensicstrategy.com * WEBSITE: http://www.forensicstrategy.com * MAILING ADDRESS/PHONE/FAX: Forensic Strategy Services, LLC. 601B Industrial Court Woodstock, Georgia 30189 ph: 770.926.5588 fax: 770.926.7089 * WOULD YOUR COMPANY LIKE TO SPONSOR A FORENSIC STRATEGY DATA RECOVERY NEWSLETTER? Send us an email at mailto:sponsor@forensicstrategy.com ----------------------------------------------------------------------- To receive the latest information about forensic computer technology and news SUBSCRIBE to our FREE email newsletter: http://www.forensicstrategy.com/contacts.asp Thank you for reading The Forensic Strategy Data Recovery Newsletter. __________________________________________________________ Forensic Strategy Services, LLC. 2003

1 0

GNU/LinuxTag 2003 in Karlsruhe/Germany
by Lutz Horn 14 Apr '03

14 Apr '03

Hi all, as you probably know, the GNU/LinuxTag [1] will take place in Karlsruhe, Germany from July 10th to 13th. We plan to set up a booth to present the FSFE, sell merchandising, have fun :-) We are looking for volunteers who like to staff the booth. Anybody who likes to help is welcome! Since the event lasts for four days, we need quite some manpower. Last year the booth was used in cooperation with APRIL, FFII, and other organizations that work in the field of free software. Is there anybody on this list who can speak for any of these organizations and who can tell, if this cooperation shall be repeated this year? For any general organizational details concerning the community's represantation on the GNU/LinuxTag, please read the FAQ [2] the people who run GNU/LinuxTag have set up. Regards Lutz [1] http://www.linuxtag.de/ [2] http://www.infodrom.org/Debian/events/LinuxTag2003/faq.html -- Lutz Horn (lutz-horn AT web DOT de) Phone + Fax: +49-1212-6-LUTZHORN

1 0

Was ist denn los mit Dir?
by Nicole 12 Apr '03

12 Apr '03

1 0

Fwd: Great Site
by a8aster＠yahoo.com 11 Apr '03

11 Apr '03

Hi, I just got a 30 year fixed mortgage at 4.875%. I found this website where Lenders compete for your business. I thought you may want to look at it. here's the url http://www.loanhunters.org/short/ Thanks, Peter Woods don't want anymore? then please go here. http://product-service.net/sobe/remove/ > hey man > > could you please give me that site where > I can pay a whole bunch less, even on my > mortgage repayments? my accountant > said 4.8% was the way to go. > > thanks..

1 0

Re: hey
by a8tploblaw＠email.com 10 Apr '03

10 Apr '03

1 0

need argumentation aid
by Andreas K. Foerster 09 Apr '03

09 Apr '03

Hello, I need some argumentation help. How can I convince an average user of using free software? I've already heard some arguments regarding "non-programmers", but I think, that doesn't get the point yet. What I mean with an average user is someone, who is not a programmer, who is even not interrested in getting the software changed anyhow, someone, who is not interrested in distributing the software, they just want to use it. In my particular situation, they have the option to get a proprietary program that is freeware, so that even the argument of "helping their neighbours" doesn't really fit. And this freeware program is technically much better. So what arguments are there left, to convince them, that free software is better than proprietary freeware? Well, to get concrete, what I'm talking about is a PDF viewer. Is there any free software for windows anyhow? For Unix systems there's XPDF and probably GV, but I don't know any free software solution for windows users. I just know the Acrobat Reader, which is proprietary and GSview, which is much more free, but not yet free enough to be called free software. Well, please don't say, they should run GNU GhostScript without any frontend. That's not really an option. -- Tschuess Andreas

1 0

Some actions the Bulgarian Free Software Assotiation
by Anton Zinoviev 09 Apr '03

09 Apr '03

Hi! As I announced on 22 November we (Free Software Association -- Bulgaria) and the Bulgarian Center for the Study of Democracy (this is another non-governmental organisation) were going to organise a discussion about the free software and how it can be used in the public administration. This discussion took place on 21 January and it was a success. Many decision-making officers participated as well as journalists. The discussion had effect on the press and one of the best daily papers for busyness people devoted a whole page for free software. We wrote and sent to the press official position on the Microsoft Government Security Program. We actively support a project initiated by the "Red House" and "Interspace" (these are non-governmental organisations). The project aims all non-governmental organisations in Bulgaria to use only free software. We worked together with two members of the Parliament of Bulgaria and as a result a project for a law on the free software will be discussed in the Parliament. The text of the proposed law is here: http://fsa-bg.org/pipermail/discussion/2003-April/001014.html We announce our initiative openfest.org. Each year there will be an OpenFest -- a feast of the free software. More on http://www.openfest.org. Anton Zinoviev

1 0

mailman
by Ludovic Pénet 05 Apr '03

05 Apr '03

Hello. A short mail to say that I am fed up with the way administrators do not care at all about the poor installation of mailman for fsf europe. Today, one more "membership disabled" because of bounces that happen only with FSFE... And that does not take in account the tons of dummy bounce messages that people get on the webmasters mailing list. Many people complained about that on one of the mailing lists or directly to the owners... What should we finally do to see this problem finally corrected? This situation lasts for *weeks* (maybe months)! Best regards, Ludovic

2 1

Bin Geil Heute
by Tamara 05 Apr '03

05 Apr '03

1 0

Re: Hey man
by 0a2cybermarketing＠gte.net 05 Apr '03

05 Apr '03

http://www.product-service.net/sobe/ Hi, I just got a 30 year fixed mortgage at 4.875%. I found this website where Lenders compete for your business. I thought you may want to look at it. http://www.product-service.net/sobe/ Thanks, Peter Woods Remove: http://product-service.net/sobe/remove/

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

Discussion