Best Free Computer Forensics Training Materials
A long list of links to training materials.
Thursday, October 17, 2002
IACIS Home Page
IACIS is an international volunteer non-profit corporation composed of law enforcement professionals dedicated to education in the field of forensic computer science. IACIS members represent Federal, State, Local and International Law Enforcement professionals. Regular IACIS members have been trained in the forensic science of seizing and processing computer systems.
IACIS is an international volunteer non-profit corporation composed of law enforcement professionals dedicated to education in the field of forensic computer science. IACIS members represent Federal, State, Local and International Law Enforcement professionals. Regular IACIS members have been trained in the forensic science of seizing and processing computer systems.
Computer Forensic Legal Standards and Equipment
This paper addresses an issue of increasing importance to companies in this modern era. Computer Incident Response Teams (CIRTs), network security, and intellectual property (IP) security are growing in importance and are becoming many companies’ top priority in this age of increased security conscious commerce. The topic of this document focuses on the CIRT aspect of security conscious commerce, but in a less familiar role. This less familiar role of CIRT is the function of investigations and more specifically, the role of computer forensics as part of a company’s arsenal in the war on network/resource abuse and intellectual property theft. This document is not designed to provide a specific checklist of everything that a CIRT must have, or provide expert knowledge of all laws related to the handling of evidence. It does however seek to provide the reader with some of the basic considerations and tools available to make a CIRT or corporate investigator effective in gathering, preserving and analyzing computer evidence.
This paper addresses an issue of increasing importance to companies in this modern era. Computer Incident Response Teams (CIRTs), network security, and intellectual property (IP) security are growing in importance and are becoming many companies’ top priority in this age of increased security conscious commerce. The topic of this document focuses on the CIRT aspect of security conscious commerce, but in a less familiar role. This less familiar role of CIRT is the function of investigations and more specifically, the role of computer forensics as part of a company’s arsenal in the war on network/resource abuse and intellectual property theft. This document is not designed to provide a specific checklist of everything that a CIRT must have, or provide expert knowledge of all laws related to the handling of evidence. It does however seek to provide the reader with some of the basic considerations and tools available to make a CIRT or corporate investigator effective in gathering, preserving and analyzing computer evidence.
Forensic Computer and Data Investigations
Things you should consider before gathering and determining who will examine your data.
Things you should consider before gathering and determining who will examine your data.
Computer Forensic Examiners
CYBER CRIMINALS MOST WANTED, The First One-Stop Cybercrime Awareness, Prevention and Safety Website. I'm on it!
CYBER CRIMINALS MOST WANTED, The First One-Stop Cybercrime Awareness, Prevention and Safety Website. I'm on it!
Hacking Citrix Citrix is a Remote Desktop application that is becoming widely popular. It is similar to Microsoft's Terminal Services, RDP (Remote Desktop Protocol). Unlike Terminal Services, Citrixs' lines of products allow the administrator to specify
certain applications to be run on the server. This allows them to control which programs they want to allow the end user to execute. There exists an interesting gray line for the security of citrix applications due to the mixing of both
citrix technology, and microsoft technology. With an application that allows users remote access to not only published programs, but remote desktops, a serious threat arises. Microsoft Terminal Services uses RDP, whereas Citrix uses ICA
(Independent Computing Architecture).
In this paper I will be outlining how citrix works, and how to take advantage of the way citrix handles user access to programs.
certain applications to be run on the server. This allows them to control which programs they want to allow the end user to execute. There exists an interesting gray line for the security of citrix applications due to the mixing of both
citrix technology, and microsoft technology. With an application that allows users remote access to not only published programs, but remote desktops, a serious threat arises. Microsoft Terminal Services uses RDP, whereas Citrix uses ICA
(Independent Computing Architecture).
In this paper I will be outlining how citrix works, and how to take advantage of the way citrix handles user access to programs.
Tuesday, October 15, 2002
How mobile phones let spies see our every move
Government's secret Celldar project will allow surveillance of anyone, at any time and anywhere there is a phone signal.
Government's secret Celldar project will allow surveillance of anyone, at any time and anywhere there is a phone signal.
Tuesday, October 08, 2002
Wireless & Devices: Secure Your Organization's Mobile Devices
Without proper security, mobile devices can present risks to your enterprise. Discover your options for securing them.
Without proper security, mobile devices can present risks to your enterprise. Discover your options for securing them.
Friday, October 04, 2002
DNSSEC - Securing the Domain Name System
DNSSEC (short for "DNS Security") is a technique for securing the Domain System. It is a set of extensions to provide end-to-end authenticity and integrity and was designed to protect the Internet from certain attacks.
There are several distinct classes of threats to the DNS, most of which are DNS-related instances of more general problems, but a few of which are specific to peculiarities of the DNS protocol.
DNSSEC (short for "DNS Security") is a technique for securing the Domain System. It is a set of extensions to provide end-to-end authenticity and integrity and was designed to protect the Internet from certain attacks.
There are several distinct classes of threats to the DNS, most of which are DNS-related instances of more general problems, but a few of which are specific to peculiarities of the DNS protocol.
Wireless Security & Hacking
This article deals with WLAN security, explains the most common attack techniques and introduces some useful tools.
This article deals with WLAN security, explains the most common attack techniques and introduces some useful tools.
Computer Forensics Tool Testing (CFTT)
The CFTT is designed to provide a measure of assurance in the results of investigations based on automated tools used in computer forensics examinations. These tools are used by law enforcement, government, and industry organizations to examine disk drives seized in computer crime investigations and to analyze the files found. Examples of tools may include disk imaging software, password crackers, image analysis tools, and others.
The CFTT is designed to provide a measure of assurance in the results of investigations based on automated tools used in computer forensics examinations. These tools are used by law enforcement, government, and industry organizations to examine disk drives seized in computer crime investigations and to analyze the files found. Examples of tools may include disk imaging software, password crackers, image analysis tools, and others.
National Software Reference Library (NSRL)
This project is supported by the U.S. Department of Justice's National Institute of Justice (NIJ), federal, state, and local law enforcement, and the National Institute of Standards and Technology (NIST) to promote efficient and effective use of computer technology in the investigation of crimes involving computers. Numerous other sponsoring organizations from law enforcement, government, and industry are providing resources to accomplish these goals.
The National Software Reference Library (NSRL) is designed to collect software from various sources and incorporate file profiles computed from this software into a Reference Data Set (RDS) of information. The RDS can be used by law enforcement, government, and industry organizations to review files on a computer by matching file profiles in the RDS. This will help alleviate much of the effort involved in determining which files are important as evidence on computers or file systems that have been seized as part of criminal investigations.
This project is supported by the U.S. Department of Justice's National Institute of Justice (NIJ), federal, state, and local law enforcement, and the National Institute of Standards and Technology (NIST) to promote efficient and effective use of computer technology in the investigation of crimes involving computers. Numerous other sponsoring organizations from law enforcement, government, and industry are providing resources to accomplish these goals.
The National Software Reference Library (NSRL) is designed to collect software from various sources and incorporate file profiles computed from this software into a Reference Data Set (RDS) of information. The RDS can be used by law enforcement, government, and industry organizations to review files on a computer by matching file profiles in the RDS. This will help alleviate much of the effort involved in determining which files are important as evidence on computers or file systems that have been seized as part of criminal investigations.
Thursday, October 03, 2002
Unix tools track hackers
If you find you've been cracked use these old-school Unix tools to help track down the perpetrators.
If you find you've been cracked use these old-school Unix tools to help track down the perpetrators.
Tuesday, October 01, 2002
Evaluating Network Intrusion Detection Signatures
In this series of articles, we present recommendations that will help readers to evaluate the quality of network intrusion detection (NID) signatures, either through hands-on testing or through careful consideration of third-party product reviews and comparisons. The first installment discussed some of the basics of evaluating NID signature quality, as well selecting attacks to be used in testing. This article will conclude the discussion on criteria for choosing attacks and then provide recommendations for generating attacks and creating a good testing environment. We begin by discussing some methods of acquiring attacks and attack traffic.
In this series of articles, we present recommendations that will help readers to evaluate the quality of network intrusion detection (NID) signatures, either through hands-on testing or through careful consideration of third-party product reviews and comparisons. The first installment discussed some of the basics of evaluating NID signature quality, as well selecting attacks to be used in testing. This article will conclude the discussion on criteria for choosing attacks and then provide recommendations for generating attacks and creating a good testing environment. We begin by discussing some methods of acquiring attacks and attack traffic.
DFRWS
The Digital Forensic Research Workshop, or DFRWS, was initiated in August 2001 to bring academic researchers and digital forensic investigators and practitioners together for active discussion that addresses three major objectives:
Define the need and create the processes for the incorporation of a rigorous scientific method as a fundamental tenant of the evolving discipline of Digital Forensic Science
Develop a research agenda that considers practitioner requirements, multiple investigative environments and emphasizes real world usability
The discovery, explanation and presentation of conclusive, persuasive evidence that will meet the heightened scrutiny of the courts and other decision-makers in military and civilian environments
The Digital Forensic Research Workshop, or DFRWS, was initiated in August 2001 to bring academic researchers and digital forensic investigators and practitioners together for active discussion that addresses three major objectives:
Define the need and create the processes for the incorporation of a rigorous scientific method as a fundamental tenant of the evolving discipline of Digital Forensic Science
Develop a research agenda that considers practitioner requirements, multiple investigative environments and emphasizes real world usability
The discovery, explanation and presentation of conclusive, persuasive evidence that will meet the heightened scrutiny of the courts and other decision-makers in military and civilian environments
Monday, September 30, 2002
Security and Encryption Links
The following are security-related resources (aka "the crypto link farm") that I've found on the net. If there's anything which needs updating or correcting, please let me know. Because of its large size, I only update the online version of the page every few months, so please be patient when waiting for updates to reported changes to appear.
The following are security-related resources (aka "the crypto link farm") that I've found on the net. If there's anything which needs updating or correcting, please let me know. Because of its large size, I only update the online version of the page every few months, so please be patient when waiting for updates to reported changes to appear.
poorsniff - a command line windows sniffer
no pcap, winpcap, packet driver required, only a 9k executable (at present), all code public domain.
no pcap, winpcap, packet driver required, only a 9k executable (at present), all code public domain.
Sunday, September 29, 2002
Secret Service agents probe wireless networks
Secret Service agents are putting a high-tech twist on the idea of a cop walking the beat. Using a laptop computer and an antenna fashioned from a Pringles potato chip can, they are looking for security holes in wireless networks in the nation's capital.
The agency best known for protecting the president and chasing down counterfeiters has started addressing what it calls one of the most overlooked threats to computer networks.
Secret Service agents are putting a high-tech twist on the idea of a cop walking the beat. Using a laptop computer and an antenna fashioned from a Pringles potato chip can, they are looking for security holes in wireless networks in the nation's capital.
The agency best known for protecting the president and chasing down counterfeiters has started addressing what it calls one of the most overlooked threats to computer networks.
Subscribe to:
Posts (Atom)
