COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2...

53
COS/PSA 413 Day 8

  • date post

    21-Dec-2015

  • Category

    Documents

  • view

    218

  • download

    2

Transcript of COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2...

Page 1: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

COS/PSA 413

Day 8

Page 2: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Agenda• Questions?• Assignment 2 Corrected

– 5 A’s 2 B’s and 3 C’s• Lab 2 Write-ups Corrected

– Pay more attention to detail, answer the question!– 3 A’s, 2 B’s

• Exam 1 Corrected– 3 A’s, 5 B’s, 1 C and 1 D

• Lab tomorrow at N105– Using Accessdata’s ForensicsToolKit FTK– Project 4-1 through 4-6 in 2e

• Handouts provided– Individual labs, no teams required

• Discussion on Current Computer Forensics Tools – Chapter 6 in 1e and Chapter 4 in 2e (different!)

Page 3: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Current Computer Forensics Tools

Chapter 6

Page 4: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Learning Objectives

• Evaluate Your Computer Forensics Software Needs

• Use Command-Line Forensics Tools• Explore Graphical User Interface (GUI) Forensics

Tools• Explore Other Useful Computer Forensics Tools• Explore Computer Forensics Hardware

Page 5: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

National Institute of Standards and Technology – A unit of the U.S. Commerce Department. Formerly known as the National Bureau of Standards, NIST promotes and maintains measurement standards.

Page 6: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

Computer Forensics Tool Testing – A project crated by the National Institute of Standards and Technology (NIST) to manage research on computer forensic tools.

Page 7: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

NIST and ISO 17025 lab standards include:-Establishing categories for computer forensics tools-Identifying computer forensics category requirements-Developing test assertions-Identifying test cases-Establishing a test method-Reporting test results

Page 8: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

Forensic Software Testing Support Tools (FS-TST) – A collection of programs that analyze the capability of disk-imaging tools.

http://www.cftt.nist.gov/

http://www.cftt.nist.gov/
Page 9: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

Examples of testing programs:-DISKWIPE-BADBLOCK-BADX13-CORRUPT-ADJCMP-DISKCMP-PARTCMP-DISKHASH-SECHASH

Page 10: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

Examples of testing programs continued...-LOGCASE-LOGSETUP-PARTAB-DISKCHG-SECCMP-SECCOPY

Page 11: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

National Software Reference Library (NSRL) – A project supported by the National Institute of Justice, federal, state, and local law enforcement, and the National Institute of Standards and Technology (NIST) to promote efficient and effective use of computer technology in the investigation of crimes involving computers.

http://www.nsrl.nist.gov/

http://www.nsrl.nist.gov/
Page 12: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

Secure Hash Algorithm 1 (SHA-1) – A hash algorithm that creates a 160-bit message digest that a Digital Signature Algorithm (DSA) can process to generate or verify the signature for the message.

http://www.itl.nist.gov/fipspubs/fip180-1.htm

Page 13: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

National Institute of Justice (NIJ) – The research, development, and evaluation agency of the U.S. Department of Justice dedicated to researching crime control and justice issues.

digitalevidencemanual.pdf

Page 14: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

NIJ Publications for Electronic Crime-Managing technology in law enforcement-Investigating e-crime scenes for first responders-Analyzing computer evidence-Using technology to investigate e-crimes-Investigating technology crimes-Creating a digital evidence library-Presenting digital evidence in a courtroom-Using best practices when seizing electronic evidence

Page 15: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

Necessary items when building a test disk:•Hard Disk – Small hard disk (1-10 GB) installed with the operating system that you typically investigate.•Disk Editor – Tools such as Norton Disk Edit, Hex Workshop, or WinHex to view the raw data on a disk.•MD5 Utility – Forensic software such as DriveSpy or a disk editor such as WinHex that contains an MD5 function.

•http://computer.howstuffworks.com/encryption5.htm

http://computer.howstuffworks.com/encryption5.htm
Page 16: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

Necessary items when building a test disk: continued….

-Forensic boot floppy disk – Floppy disks that prevent booting from the hard disk.-Write-blocker device on the test disk – A write-blocker can be a physical device or software utility that prevents the system from recording data on an evidence disk. -Computer Forensic Software – The software you want to test, installed on the computing-forensics workstation.

Page 17: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

Building a Test Disk on FAT16 or FAT32- Install an OS on the test disk.- Connect the test disk to the forensic workstation.- Use a disk editor such as Norton Disk Edit to locate the file slack area.- Write sample text in the slack area.- Note the exact absolute sector and cluster location on the disk drive.- Create two or three text files containing sample text.- Close the disk editor.

Page 18: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Evaluate Your Computer Forensics Software Needs

Building a Test Disk on NTFS- Install an OS on the test hard disk.- Connect the test disk to the forensic workstation.- Use a disk editor such as WinHex or Hex.Workshop to locate disk free space.- Create a few test files.- Note the absolute sector and cluster location for each sample text file you created.- Close the disk editor.

Page 19: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Use Command-Line Forensics Tools

Exploring NTI Toolshttp://www.forensics-intl.com/tools.html

- Filter – Replaces a nonprintable characters with spaces (Char 20). - Intel – Searches for possible keyboard entries; the output for this feature can be used to create a possible password list. - Names – Locates known English surnames. - Words – Finds groups of words, typically fragments or complete sentences.

Page 20: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Use Command-Line Forensics Tools

Exploring Byte Back - Clone and image physical sectors of a disk drive. - Recover files automatically on FAT and NTFS file systems. - Rebuild partitions and disk boot records on all FAT and NTFS disks. - Wipe disks. - Edit disks by viewing and modifying disk data for FAT16 and FAT32 file systems. - Scan the surface of disk drives to diagnose problems.

Page 21: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Use Command-Line Forensics Tools

Exploring MaresWarehttp://www.dmares.com/maresware/linksto_forensic_tools.htm

- Catalog programs – CRCKIT, DISKCAT, HASH and MDS - Disk wiping program – DECLASFY - Locking boot program – DISABLE - Floppy disk imaging program – DISIMAG - CRC and MD5 hashing program – DISCK_CRC - Hex editor program – HEX_SECT

http://www.dmares.com/maresware/linksto_forensic_tools.htm
Page 22: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Use Command-Line Forensics Tools

Exploring MaresWare - Hashing compare program – HASHCMP - Multiple data stream NTFS directory program – MDIR - File and directory deletion and wiping programs – RM and RMD - Sector keyword search program – SS - Keyword search program – STRSRCH

Page 23: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore GUI Forensics Tools

Forensic Toolkit (FTK) - Text indexing to produce instant search results. - Data recovery from file systems. - E-mail recovery from leading e-mail services and products. - Data extraction from PKZip, WinZip, WinRAR, GZIP, and TAR archive files. - File filtering that eliminates known files and bad files, based on NIST, NSRL, and HashKeeper.

Page 24: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore GUI Forensics Tools

Page 25: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore GUI Forensics Tools

Exploring Guidance Software EnCase - Extracts messages from Microsoft PST files. - Spans multiple RAID volumes. - Supports NTFS compression and Access Control List (ACL) of files. - Provides advanced language support.

Page 26: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore GUI Forensics Tools

Exploring WinHex Specialist Edition - Disk cloning. - Disk sector imaging with or without compression, an encryption option, and a save and set volume size. - Saving to a separate data file all file slack space and unallocated space. - Keyword searching and text gathering.

Page 27: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore GUI Forensics Tools

Page 28: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore GUI Forensics Tools

Exploring ProDiscover DFT - Creates an image file of the suspect’s disk, and can read the image file it creates. - Reads images created with the UNIX and Linux dd command. - Accesses a suspect disk through a write-blocking device for previewing purposes. - Displays alternative data streams for Windows NT and 2000 NTFS file systems. - Integrates Bates numbers for your evidence for recovered data lists.

Page 29: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore GUI Forensics Tools

Exploring DataLifter - Disk cataloging of all files with data and time values. - Image Linker that identifies and allows you to link to any images stored on a Web site. - Internet cache and history viewer of a suspect’s Internet history file. - File signature generator. - E-Mail retriever.

Page 30: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore GUI Forensics Tools

Exploring DataLifter - Network ping, traceroute, and whois commands. - Recycle Bin history viewer. - Screen capture function. - File slack and free space acquisition tool.

Page 31: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore GUI Forensics Tools

Expert Witness for Macintosh - HFS and HFS+. - All Microsoft FAT file systems. - ISO 9960 (CDs), UFS and CDFS. - Span evidence acquisitions over several disk drives. - Generate reports. - Export data findings to Microsoft Excel to perform additional analysis.

Page 32: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore GUI Forensics Tools

SMART - All Microsoft FAT - NTFS - Linux Ext2fs and Ext3fs - Reiser - HFS

Page 33: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Other Useful Computer Forensics Tools

Exploring R-Tools - R-Studio – Recover data from all FAT, NTFS and Ext2fs disks, and recover corrupt data on RAID systems. - R-Undelete – Used to restore FAT, NTFS, and Ext2fs files. Recovers altered data streams and encrypted or compressed files.

Page 34: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Other Useful Computer Forensics Tools

Exploring R-Tools - R-Linux – For corrupted Ext2fs drives, this can be used to create a disk image. After the disk image is created you can then use R-Studio. - R-Mail – Specially designed to recover damaged .dbx folders for Microsoft Outlook. Recovers the content of the .dbx folder messages and then creates individual messages in the .eml format.

Page 35: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Other Useful Computer Forensics Tools

Using Explore2fs - Move files by dragging and dropping. - Export and import files and directories. - View and execute files. - View and create symbolic links. - Delete files and directories. - Create directories. - Rename and modify file modes. - Change the user ID and group ID of files and directories.

Page 36: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Other Useful Computer Forensics Tools

TASK - Analyze dd image files of a suspect’s drive. - Analyze all FAT, NTFS, FFS, and Ext2fs file systems. - Use fourteen command-line tools that are organized into layers to identify the tool’s function. - Create timelines of files and directories for analysis purposes.

Page 37: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Other Useful Computer Forensics Tools

Autopsy Forensic Browser - Add reference notes to any findings you encounter. - Search on keywords. - Validate using MD5 hash values. - Generates reports in ASCII format. - Inspect a UNIX system in real time.

Page 38: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Other Useful Computer Forensics Tools

Using Graphic Viewers - Quick View Plus (www.jasc.com) - Lview Pro (www.lview.com) - ACDSee (www.acdsystems.com) - ThumbsPlus (www.cerious.com) - Irfan View (www.irfanview.com)

http://www.jasc.com/
http://www.lview.com/
http://www.acdsystems.com/
http://www.cerious.com/
http://www.irfanview.com/
Page 39: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Computer Forensics Hardware

Computing-Investigation Workstations - Stationary Workstation – A tower with several bays and many peripheral devices. - Portable Workstation – Laptop computers with a built in LCD with almost as many bays and peripherals as a stationary workstation. - Lightweight Workstation – Usually a laptop computer built into a small carrying case with a small selection of peripheral options.

Page 40: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Computer Forensics Hardware

- Read-only IDE Drive Bays – A hot-swappable write-blocker device. - Drive Imaging Stations – A setup of two IDE bays, one with an integrated write-blocker and the other for reads and writes, and a 60-watt power supply with cooling fans. - Firewire – Assorted Firewire controller cards and Firewire write-blocker internal interface devices.

Page 41: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Computer Forensics Hardware

Forensic Computers - Original forensic tower - Portable forensic workhorse - Forensic steel tower - Forensic Air-Lite

Page 42: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Computer Forensics Hardware

DIBS - Forensic workstation - Mobile forensic workstation - Permanent investigation unit - Rapid action imaging device (RAID)

Page 43: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Computer Forensics Hardware

http://www.digitalintelligence.com/

Digital Intelligence - FRED – A tower PC that can be equipped with a cart for portability. - FREDDIE – A portable LCD screen equipped FRED unit. - FRED Sr – A stationary service case workstation that has three power supplies and extensive list of peripherals to meet almost any computing-investigation need. - FREDC – A modularized RAID system with up to eight separate forensic processors with up to 20 terabytes of disk space.

http://www.digitalintelligence.com/
Page 44: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Computer Forensics Hardware

Digital Intelligence - FireBlock – A Firewire IDE bay device write-blocker that can be ordered as an internal or external device with it’s own power supply. - SCSIBlock – A SCSI write-blocker device that can be ordered as an internal bay or an external bay device with its own power supply. - FireChief – A Firewire IDE dual bay external device that has an IDE write-blocker in the top bay and a read/write in the bottom bay.

Page 45: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Computer Forensics Hardware

Image MASSter Solo - Signature generator that produces a CRC-32 hash. - Ability to copy a source disk’s Host Protected Area to target disk. - Device Configuration Overlay (DCO) detection that forces a sector-by-sector copy of a suspect’s disk to target disk.

Page 46: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Computer Forensics Hardware

Page 47: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Computer Forensics Hardware

Page 48: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Explore Computer Forensics Hardware

Image MASSter Solo - CD backup and restore capability allowing you to backup and restore a disk to a CD. - Audit trail report that can be printed out to a special thermal printer from the unit.

Page 49: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Chapter Summary

- Maintaining a computing-forensics lab involves creating a software library for older versions of computing-forensics utilities, operating systems (OSs), and application programs. You should maintain all older versions of software that you have used and retired, such as older versions of Windows and Linux.

Page 50: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Chapter Summary

- Before upgrading to a new version of a computer forensics tool, you need to run validation testing on the new version. The National Institute of Standards and Technology (NIST) has standard guidelines for verifying forensic software.

Page 51: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Chapter Summary

- Many computer forensics tools run in MS-DOS, including those that find file slack and free space, recover data, and search by keyword. Most of these tools run only in MS-DOS, not an MS-DOS shell window. They are also designed to run in minimal configurations, and can fit on a bootable floppy disk. Norton Disk Edit and WinHex are MS-DOS tools that allow you to find file slack and unallocated space on a drive.

Page 52: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Chapter Summary

- In addition to the DOS and GUI tools, you can also use computer forensics tools that are available as open source, freeware, and shareware software, though some are restricted to only law enforcement use.

Page 53: COS/PSA 413 Day 8. Agenda Questions? Assignment 2 Corrected –5 A’s 2 B’s and 3 C’s Lab 2 Write-ups Corrected –Pay more attention to detail, answer the.

Chapter Summary

- Computer forensics tools that run in a Command Prompt window include DriveSpy and Image. Computing-investigation tools that run in Windows and other Graphical User Interface (GUI) environments do not require the same level of computing expertise as MS-DOS tools, and can simplify training and investigations. These GUI tools have also simplified training for beginning examiners in computer forensics.


3 B’s B4 Me

3 B’s B4 Me

Discrete Mathematics Statistics Review · Web view19. Mrs. Barber decides to curve her classes. She decided that the top 15% get As, the next 25% get B’s, the middle 20% get C’s,

Discrete Mathematics Statistics Review · Web view19. Mrs. Barber decides to curve her classes. She decided that the top 15% get As, the next 25% get B’s, the middle 20% get C’s,

COS 125 DAY 25. Agenda Assignment #7 Graded 2 A’s, 3 B’s, 2 C’s, 1 D, 2 F’s (late) and 5 non-submit Assignment # 8 Due Today Assignment #9 is posted.

COS 125 DAY 25. Agenda Assignment #7 Graded 2 A’s, 3 B’s, 2 C’s, 1 D, 2 F’s (late) and 5 non-submit Assignment # 8 Due Today Assignment #9 is posted.

Huffman Coding - ece.mcmaster.cashirani/multi10/huffman.pdf · • Adaptive Huffman: encode almost all a’s by a single digit. The b’s will be coded by two bits each, c’s and

Huffman Coding - ece.mcmaster.cashirani/multi10/huffman.pdf · • Adaptive Huffman: encode almost all a’s by a single digit. The b’s will be coded by two bits each, c’s and

COS 125 Day 17. Agenda Assignment #4 Corrected – 4 A’s, 5 B’s, 3 C’s, and 3 non-submits Assignment #5 Due Exam #3 Corrected – 5 A’s, 5 B’s, 2 C’s, 2 D’s.

COS 125 Day 17. Agenda Assignment #4 Corrected – 4 A’s, 5 B’s, 3 C’s, and 3 non-submits Assignment #5 Due Exam #3 Corrected – 5 A’s, 5 B’s, 2 C’s, 2 D’s.

Bus 411 Day 5 Copyright 2005 Prentice Hall1. Ch 1 -2 Agenda Question? Assignment 1 Corrected 3 A’s, 2 B’s, 3 C’s & 1 D We will be working a collective.

Bus 411 Day 5 Copyright 2005 Prentice Hall1. Ch 1 -2 Agenda Question? Assignment 1 Corrected 3 A’s, 2 B’s, 3 C’s & 1 D We will be working a collective.

COS 125 DAY 17. Agenda Assignment #5 Corrected 6 A’s, 2 B’s, 3 C’s 2 D’s, and 2 non-submits Next Capstone Progress Report Due April 6 Exam #3 Graded.

COS 125 DAY 17. Agenda Assignment #5 Corrected 6 A’s, 2 B’s, 3 C’s 2 D’s, and 2 non-submits Next Capstone Progress Report Due April 6 Exam #3 Graded.

Web viewThe effects / affects of the movie always effect / affect the storytelling in a highly effective ... I have five cats and 10 ... to letters grades (A’s B’s C’s)

Web viewThe effects / affects of the movie always effect / affect the storytelling in a highly effective ... I have five cats and 10 ... to letters grades (A’s B’s C’s)

COS 381 Day 18. Agenda Assignment 4 Corrected 2 A’s, 3 C’s, 1 D and 1 F nment4/answer.htm .

COS 381 Day 18. Agenda Assignment 4 Corrected 2 A’s, 3 C’s, 1 D and 1 F nment4/answer.htm .

Prentice Hall, 2003 1 ELC 200 Day 19. Prentice Hall, 2003 2 Agenda Questions from last Class? Quiz 2 rescored 5 A’s, 6 B’s, 3 C’s Assignment 5 Due April.

Prentice Hall, 2003 1 ELC 200 Day 19. Prentice Hall, 2003 2 Agenda Questions from last Class? Quiz 2 rescored 5 A’s, 6 B’s, 3 C’s Assignment 5 Due April.

CHAPTER Day 9 BUS 222. Ch 1 -2 Agenda Questions Assignment 2 Corrected – 5 A’s, 5 B’s, 4 C’s, 2 D’s, & 1 F Quiz 1 corrected – 2 A+, 2 A’s, 3 B’s, 3 C’s,

CHAPTER Day 9 BUS 222. Ch 1 -2 Agenda Questions Assignment 2 Corrected – 5 A’s, 5 B’s, 4 C’s, 2 D’s, & 1 F Quiz 1 corrected – 2 A+, 2 A’s, 3 B’s, 3 C’s,

Bus 411 Day 14 Copyright 2005 Prentice Hall 1. Ch 1 -2 Agenda Question? Assignment 4 corrected 1 A, 4 B’s, 2 C’s, 1 D and 1 F Assignment 5 posted

Bus 411 Day 14 Copyright 2005 Prentice Hall 1. Ch 1 -2 Agenda Question? Assignment 4 corrected 1 A, 4 B’s, 2 C’s, 1 D and 1 F Assignment 5 posted

Copyright 2005 Prentice Hall1 Bus 411 DAY11. Copyright 2005 Prentice Hall Ch 7-2 Agenda Assignment #3 Corrected 3 A’s, 3 B’s and 2 non-submit PUT.

Copyright 2005 Prentice Hall1 Bus 411 DAY11. Copyright 2005 Prentice Hall Ch 7-2 Agenda Assignment #3 Corrected 3 A’s, 3 B’s and 2 non-submit PUT.

Constitution and - Arizona Community College Athletic ... · Web viewExample: Team A’s record against B and C, Team B’s record against A and C, Team C’s record against A and

Constitution and - Arizona Community College Athletic ... · Web viewExample: Team A’s record against B and C, Team B’s record against A and C, Team C’s record against A and

ELC 200 Day 10. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 2 Agenda Assignment #3 Corrected –2 A’s, 10 B’s, 3 C’s, 1 D, 2 F’s and 1 non-submit.

ELC 200 Day 10. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 2 Agenda Assignment #3 Corrected –2 A’s, 10 B’s, 3 C’s, 1 D, 2 F’s and 1 non-submit.

COS 413 Day 17. Agenda Quiz 2 corrected –2 A’s, 6 B’s & 1 C Assignment 5 corrected –5 B’s, 2 C’s, 1 non-submit & 1 corrupt file that I cannot read Lab.

COS 413 Day 17. Agenda Quiz 2 corrected –2 A’s, 6 B’s & 1 C Assignment 5 corrected –5 B’s, 2 C’s, 1 non-submit & 1 corrupt file that I cannot read Lab.

Big B’s Burger Pound

Big B’s Burger Pound

COS/PSA 413 Day 9. Agenda Questions? Assignment 4 posted Quiz Corrected –3 A’s, 3 B’s, & 3 C’s Lab 3 w rite-ups corrected –7 A’s & 2 B’s –Difference between.

COS/PSA 413 Day 9. Agenda Questions? Assignment 4 posted Quiz Corrected –3 A’s, 3 B’s, & 3 C’s Lab 3 w rite-ups corrected –7 A’s & 2 B’s –Difference between.

ELC 200 Day 14. Agenda Questions? Assignment 4 not graded yet 5 missing Midterm grades posted Quiz 2 Graded 2 A+’s, 8 A’s, 2 B’s and 2 C’s Assignment.

ELC 200 Day 14. Agenda Questions? Assignment 4 not graded yet 5 missing Midterm grades posted Quiz 2 Graded 2 A+’s, 8 A’s, 2 B’s and 2 C’s Assignment.

F & B’s Daycare

F & B’s Daycare