侦破计算机犯罪：电子取证介绍

《侦破计算机犯罪：电子取证介绍》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、SolvingComputerCrime:AnIntroductiontoDigitalForensicsGoldenG.RichardIII,Ph.D.Dept.ofComputerScienceGulfCoastComputerForensicsLaboratory(GCCFL)golden@cs.uno.eduDigitalForensicsDefinition:“Toolsandtechniquestorecover,preserve,andexaminedigitalevidenceonortransmittedbydi

2、gitaldevices.”Devicesincludecomputers,PDAs,cellularphones,videogameconsoles…ExamplesofDigitalEvidenceComputersincreasinglyinvolvedincriminalandcorporateinvestigationsDigitalevidencemayplayasupportingroleorbethe“smokinggun”EmailHarassmentorthreatsBlackmailIllegaltransm

3、issionofinternalcorporatedocumentsMeetingpoints/timesfordrugdealsSuicidelettersTechnicaldataforbombmakingImageordigitalvideofiles(esp.,childpornography)EvidenceofinappropriateuseofcomputerresourcesorattacksUseofamachineasaspamemailgeneratorUseofamachinetodistributeill

4、egallycopiedsoftwareMajorIssuesIdentificationofpotentialdigitalevidenceWheremighttheevidencebe?Whichdevicesdidthesuspectuse?PreservationofevidenceOnthecrimescene…First,stabilizeevidence…preventlossandcontaminationIfpossible,makeidenticalcopiesofevidenceforexaminationC

5、arefulextractionandexaminationofevidencePresentation“TheFATwasfubared,butusingahexeditorIchangedthefirstbyteofdirectoryentry13from0xEFto0x08torestore‘HITLIST.DOC’…”“ThesuspectattemptedtohidetheMicrosoftWorddocument‘HITLIST.DOC’butIwasabletorecoveritwithouttamperingwit

6、hthefilecontents.”Legal:InvestigatoryneedsmeetprivacyPreservationofEvidence:Hardlytrivial…LivingroomBasement/closetwirelessconnection“DearSusan,It’snotyourfault…Justpulltheplug?Movethemouseforaquickpeek?Tripwirestick…tick…tick…VolatilecomputingPreservation:ImagingWhen

7、makingcopiesofmediatobeinvestigated,mustpreventaccidentalmodificationordestructionofevidence!Writeblockers:Usethem.Always.ddunderLinuxDOSbootfloppiesProprietaryimagingsolutionsDrivelockwriteblockerExtractionandExaminationKnowwhereevidencecanbefoundUnderstandtechniques

8、usedtohideor“destroy”digitaldataToolboxoftechniquestodiscoverhiddendataandrecover“destroyed”dataCopewithHUGEquantitiesofdigi