Digital Forensic Case Study Analysis

Question : As part of the auditing team in capacity of a Digital Forensics expert, your task is to prepare digital forensics investigative plan to enable a systematic collection of evidence and subsequent forensic analysis of the electronic and digital data. Assuming all systems are Windows based, this plan should detail following: 1.justify why use of the digital forensic methodology and approach is warranted including procedures for corporate investigation. 2.describe the resources required to conduct a digital forensic investigation, including team member skill sets and required tools. 3.outline an approach for data/evidence identification and acquisition that would occur in order to prepare the auditors for review of the digital evidence. 4.outline an approach and steps to be taken during the analysis phase making the assumption the computer system is a Microsoft Windows-based computer. 5.create a table of contents for the investigative plan describing what the primary focus of the report would be. Answer : Executive Summary Global Finance is larger finance company, existing in Australia. Its services include investment, retirement and superannuation in the finance sectors, providing to individuals to corporate. Information technology support is taken and the company has grown globally and further challenge of information security has been a concern to achieved by the audit team in its branch office. Introduction Global Finance Company has been suspected of a compromise, in one of its branches. The case study is all about the digital forensic investigation performed by the enforced audit team and to submit the report to the information security office in the head office. Global Finance Company Global Finance Company suffers from a information in one of its branches. So, the important points of consideration about, are the following. 1. Global Finance has over 10,000 employees working in the world, in many finance sectors of interest. 2. The company stands to be an international player, globally with its finance products of investment, retirement and superannuation, provided to the individuals, larger corporate and superannuation fund investors. 3. Investment management expertise is spread to multiple sectors, property, private equity, global shares, fixed interest, credit and infrastructure. Concern of Global Finance 1. Global finance is spread its services throughout the world through information technology and misses the updates of application and update infrastructure after the year 2000. 2. The child organizations have no restrictions in terms of authorized access to access the data from the other child organization and network segmentation and firewall are poorly implemented. 3. Through there are detection implementation for intrusion and logging, these are seldom used. 4. The servers and workstations in all of its branches are Microsoft Windows based. 5. Head office in Melbourne consists of advanced technology and infrastructure to conduct forensic investigation capabilities. 6. One of its branches in Brisbane, has been suspected of a compromise of its managers computer. 7. Information security office, present in the head office has enforced an audit team for reviewing paper based documents of the branch and digital forensic. investigation in the Brisbane branch. Need for Digital Forensic Methodology The suspect of compromise can be happened for any reason, like deletion of the files, breach through network, unauthorized access or anything. So, data recovery, data forensic and network forensic along cannot suffice for complete investigation of the compromise. So, digital forensic, which consists of all these branches as sub branches methodology, is needed to applied to find the source of the compromise. Resources Digital forensic is a major task, which needs many tools and skills to perform the investigation of the source of compromise in the branch office. Apart from these skills and tools, the audit team must also have to follow certain principles towards integrity and security of the information. The following are to be understood and followed by the team. 1. Each of the members should have enough expertise to safely handle the data retrieved from the Global Finance branch office, for the investigation purpose. 2. Data retrieved from the workstations and servers should not be altered and the original has to be preserved, as is. 3. Data from each and every process must be well preserved to submit in the report. 4. All the result of the investigation is accountable by the team. Scope The scope of the investigation is the following Malicious activities identification. Security lap identification. Digital evidence identification. Impact analysis, if the compromise is true. Legal procedure identification, if the compromise is due to illegal reasons. Decision of actions after the identification of the source. Digital Forensic Approach For the Global Finance information security compromise, the approach to be followed is FSFP or Four Step Forensic Process. Figure 1: FSFP A Digital Forensic Model Need of regular evidence of document and its preservation is represented by the arrow. Preparation Process Digital forensic investigation process is executed in different phases. Phase 1 - Collection 1. Collection process is the identification of data, followed by labeling the data then recording it. 2. Forensic tool identification to collect and gather all the digital forensic data. 3. Gather all possible information from the emails, files of MS-Word, Spreadsheets, Outlook, etc. 4. Information access from routers, switches, firewalls, topology of the network, servers and diagrams of the network. 5. Network information through the live network traffic, through various tools like netmon tool, etc. 6. The managers computer must be accessed through LAN connection, so that more information can be accessed through the network traffic. 7. Microsoft Windows based tools, like cryptcat tools are useful so that the server can be accessed and heard. 8. During the data collection, the target computer should not be shut down, and keep running. Volatile Data Capture Volatile data like RAM, log data, Windows registry information and many other user account details are explored to collect the potential data from the targeted managers computer. Clipboard data is also potential data for the investigation. Managers workstation is accessed through LAN and the server port can be heard through the tool, cryptcat and the command to be executed is, cryptcat 6543 k key To capture data from the target workstation, the give the command. cryptcat -1 p 6543 k key Andd other graphical user interface tools used are, Process Explorer Rootkit Revealer Tcpview Other Windows tools to collect the data from target computers in the regional office are, HBGrays fastDump for physical local memory HBGrays F-Response for remote physical memory Ipconfig - to collect the details of subject system Netusers and qusers for identifying information about users, who are logged in Doskey - to collect command history Netfile - identifying the present services and drivers Using the combination of the above tools, the following volatile data is accessed. Running processes Network connection from running system memory Network data Forensic Imaging Non volatile data is collected from the hard drive, CD, DVD, Flash drives, USB or memory cards, portable hard drives, etc. Other non volatile data has to be collected from the sources of, Web server logs Application logs Database logs Antivirus logs Windows event log Domain controller logs Firewall logs IDS logs Forensic imaging is the copying process of non volatile data, without alterations, by using write protect or write blockers. It needs the tools like FTK, EnCase and ProDiscover. The collection of data should involve both the offline and online data collection. The above data collection is the offline data collection. And for the online data collection, ethereal and Wireshrk tools are used. After the data collection, the data must be made read only, by using the tools like, SANS, etc. Phase 2: Examination Examination of the collected information must be done using the forensic investigation tools. File System Examination Since the managers computer is Windows based system, NTFS file system has to be thoroughly examined for MFT metadata. To store Data stream file, c: echo text_mass file1.txt:file2.txt to retrieve the file c:more file1.txt:file2.txt. Windows Registry Examination Windows Registry data can reveal the time related alterations lastwrite and many more precise data about the user applications, hardware device references, in the managers computer. Windows registry has the structure with the following hives. HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_CURRENT_CONFIG HKEY_USERS HKEY_CLASSES_ROOT The keys and values like autostart, user activity, Most recent Used List from the registry are the potential investigated data for the audit team. Network Forensic Examination Since the managers computer is connected to the server in the branch office and the same branch office is connected to the other child organizations of the company, network forensic examination plays vital role about compromise, through unauthorized access of the data from his computer. Network forensic is done by the team through security related as well as the forensic data related to the laws related to the cyber crimes, enabled in Australia. Packet forensic is tracked to track the network traffic through browsing details, queries, mails, etc. Other network forensic data such as registry information, service listing, process listing, network connections, system information, registered user information and binary dump of memory are explored and examined. Packet sniffers help out the team to explore and investigate the web services, email communication, identification, mapping, fingerprinting, etc. Examination of Database Forensic Database forensic examination is done using queries for identification, preservation and analysis of the database. Data Modification Language and Data Definition Language are to be explored for identifying the transaction happened prior and after the suspect of the compromise. Customized configuration file is also used to execute DMW and DBCC commands for database forensic examination. Phase 3 - Analysis Once the examination phase is completed, all the examined data is analyzed in detail. The analysis of the data includes many of the activities done by the audit team. The activities to list out are, Unusual application request analysis Unusual and hidden file analysis and if exists, unusual open socket analysis is to be followed Analysis of unusual accounts Analysis of malicious activities during some period before and after the suspect of the compromise Updated level analysis Patching level system analysis Complete timeline activities analysis Complete file system analysis Complete memory analysis Detailed malware analysis, both in static and dynamic methods through prefetch, registry, log examinations and analysis After the detailed analysis is done, all the findings are to be clearly noted with all the necessary digital evidences. The team has to summarize the analysis points, as follows. Identification of the source of the compromise Identification of the targeted, which is managers computer, through remote access persistently by the attacker or hacker Suspected malware and its activities for compromise Patches for the operating system, in case are not installed in the target computer The source or the process of the hacker or attacker to access the data from the managers computer. Phase 4 Report By this phase, all the collection, examination and analysis of the data from the workstations and servers are done. The options of the sources of the compromise are narrowed down to find the exact source of compromise. After determining the exact source, the team has to draft and prepare the final report. The report can be made in many of the ways. Here in this case study, the report has to be created clearly as a written report. Finally, the report is submitted to the office of information security, located in the head office. Final Report Purpose The purpose of the report is digital forensic investigation to explore and submit the compromise source, if happened in the target computer. Author Audit Teams Incident Summary The compromise source is investigated through the digital forensic investigation performed in the regional branch, on all of its computers. Evidence All of the digital data is submitted, in the form of volatile and non volatile data files. Analysis The managers computer is compromised from the source1, source2, source3, etc. Conclusion Digital Forensic Investigation is performed and the sources are submitted in the report. Submitted supporting documents Supporting documents submitted in the form of Volatile and non- volatile data, registry info, network traffic report, packet sniffer report, log info, registry info and the tool generated reports and so on. Conclusion Global Finance Companys regional branch has been investigated digital forensically, to investigate the suspected sources of the compromise has been happened to the targeted managers computer from the same branch. The final report is submitted to the head offices the information security office, present in Melbourne. References Aquilina, M.J., (2003), Malware Forensics, Investigating and Analyzing Malicious Code, Syngress, Carvey, H., (2005), Windows Forensics and Incident Recovery, Boston: Pearson Education Inc. Cyber Forensic Investigation Plan, International Journal of Advance Research (2008), UOAR.org, Volume 1, Issue 1, accessed on 9 January, 2015, https://www.academia.edu/3827683/Cyber_Forensic_Investigation_Plan US-CERT, (2012), Computer Forensics, Available at https://www.us-cert.gov/reading-room/forensics.pdf, accessed on 30th December 2013. Siti Rahayu Selamat, Robiah Yusof, Shahrin Sahib (2008), Mapping Process of Digital Forensic Investigation Framework, JCSNS International Journal of Computer Science and Network Securit, Vol 8. Shiner, D.L.D., and Cross, M., (2002), Scene of the Cybercrime, 2nd edn, Syncress: Burlington. Kenneth J. Zahn (2013), Case Study: 2012 DC3 Digital Forensic Challenge Basic Malware Analysis Exercise, GIAC (FREM) Gold Certification John Ashcroft (2001), Electronic Crime Scene Investigation, A guide for First Responders, NIJ Guide M Reith, C Carr, G Gunsch (2002). "An examination of digital forensic models". International Journal of Digital Evidence Richard Brian Adams (2012), The Advanced Data Acquisition Model (ADAM): A Process Model for Digital Forensic Practice Agarwal, A., Gupta, M., Gupta, S., Gupta, S. C. (2011). Systematic Digital Forensic Investigation Model, International Journal of Computer Science and Security, 5(1), 118-130. Armstrong, C. (2003), Mastering Computer Forensics. In C. Irvine H. Armstrong, Security Education and Critical Infrastructures Kluwer Academic Publishers.

How to Write a Sample Five Paragraph Narrative Essay

How to Write a Sample Five Paragraph Narrative EssayIf you are considering how to write a sample five paragraph narrative essay, then you have come to the right place. In this article, I will give you some helpful hints and tips for writing a great essay.You must decide which paragraph divisions you are going to use. Since you're a professional, you will want to include some high quality information in the first paragraph, followed by something that makes the reader want to keep reading. The best way to accomplish this is to use a mix of two-sentence paragraphs and three-sentence paragraphs. Read through your five paragraph essay and determine the sentence that best fits your topic.I learned this technique when I worked on college and high school essays. It worked wonders for me! My essay was much better when I used this technique. Also, don't forget to fill out your time and place with a couple of extra sentences at the end.The next part of this technique is to break down your parag raphs. Write down the main idea of each paragraph. That's the first step. The next step is to write out your individual sentences.For example, the first paragraph might be about the narrator trying to organize his or her thoughts. Then the second paragraph might be about the narrator and his or her doubts about the material being the best possible way to understand the ideas presented in the first paragraph.Remember, your paragraphs are not long sentences. You have space to write down your ideas. Just write down as many ideas as you can. Don't stress about a certain way to format your paragraphs or writing them in an awkward manner.Next, repeat the paragraph a couple of times. Sometimes it is best to repeat your paragraphs several times. Your readers will understand what you're saying because you are breaking up your paragraphs.Lastly, write the conclusion of your essay using strong language. This is your opportunity to explain to your readers what they are getting out of reading yo ur essay.

The Real Price Of A College Education Essays - College,

The Real Price of a College Education So where do you plan to go to college? What college do you go to? Where did you get your degree? I am sure you have heard these questions quite a few times in your lifetime already. You have probably heard these questions from people you do not even know. For these questions to come up so often and by so many people, they must obviously relate to something rather important, a college education. Just how important to you is a college degree? I believe it should be everyone's priority to do everything they can to obtain one. Have you ever been turned down by a job, denied a promotion, or simply wondered why someone you know is making more money than you, when you know you might be better at that job? Did you ever take the time to think this might be because you do not have a college degree? As you can see today's standards for education have been raised much higher than in previous years. Years ago there were no requirements for an education. Through the years there became a demand for a high school education, now a high school education and fifty cents will get you a candy bar. In today's society a college education is needed and in most cases required. Even a full four-year college degree is becoming the bare minimum as we enter the new century. In most cases today people are choosing to continue their education beyond their four-year degree. Most people are now looking towards obtaining their masters degree in their field of study. This is showing us the competition we are facing in the working world and just how important that college diploma is. Many people will argue the fact that college costs a great deal of money, so why should they spend money when they can be earning money. My answer to that is, you have to look at the overall view and look at where you would like to be in ten years from now. I agree that college does cost a great amount of money, a state funded college such as Bloomsburg or Penn State costs about nine-thousand dollars a year for residents including room and board. A private college education such as Kings or Wilkes can cost as much as thirty-two thousand dollars per year including room and board. The money you make without a degree can look impressing at first, but that might just be because you are young. The job you obtain will not leave you with much room for advancement, whereas once you obtain a college degree you can come out and be the boss of those people who have been there for the past four years while you were in college. The money you will make at that higher position will make those years of school worth every penny you invested. Many people may argue that experience is the best education, and I agree with them to a certain extent. Experience is learning and hands on in your field, but a background education is also useful and no matter how you may feel, the way of society is what we have to follow and that piece of paper, a diploma, is what counts. Take a look at your family, friends, and people you know. Now look at which direction our world and society is turning towards. How many elderly people do you know that have gone to college? Probably not many because a college education was not important many years ago. Now look at today's adults, I think it would be safe to say about half have gone to college. This is because there was a need for one and some chose to go and others didn't. Looking at today's teens and young adults, the majority are in college, are planning to go, or have already gone. Why is this? Society's youth are going to college because they realize what they are going to face in the real world, the competition, and they want to be ready for it. Now look at today's children, how many parents want their children to go to college? I would say close to all of them. Parents want their

Converting Cubic Inches to Liters

Converting Cubic Inches to Liters This example problem demonstrates how to convert cubic inches to liters, using the real-life scenario of engine displacement, which is the combined swept displacement of all of the machines pistons in their cylinders. When someone describes the power of a car, that person might say that it has a 3.3-liter engine or some such example. Problem Many small car engines have an engine displacement of 151 cubic inches. What is this volume in liters? Working the Solution 1 inch 2.54 centimeters First, convert the measurements to cubic measurements. (1 inch)3 (2.54 cm)3 1 in3 16.387 cm3 Second, convert to cubic centimeters. Set up the conversion so that the desired unit will be canceled out. In this case, we want cubic centimeters to be the remaining unit. volume in cm3 (volume in in3) x (16.387 cm3/1 in3) volume in cm3 (151 x 16.387) cm3 volume in cm3 2,474.45 cm3 Third, convert to liters. 1 L 1,000 cm3 Set up the conversion so that the desired unit will be canceled out. In this case, we want liters to be the remaining unit. volume in L (volume in cm3) x (1 L/1,000 cm3) volume in L (2,474.45/1,000) L volume in L 2.474 L Answer A 151–cubic inch engine displaces 2.474 liters of space (or air).

ILO conventions in Malaysia and Indonesia Essay

ILO conventions in Malaysia and Indonesia - Essay Example Perhaps the foremost social responsibility levied upon private and public organisation in recent decades is the adoption of fair and just employment practices. This responsibility is being increasingly codified in law and various governmental orders. Its influence is becoming increasingly pervasive through a constant series of federal court decisions as well as steady enlargement in the size and scope of administering agencies. Despite the unjust pressure from the International agencies and Governments of the developed nations it will neither fruitful for the economy of the developing countries nor for the labour of these countries to implement these principles in shape of the social clause of WTO or the ILO directives. The developed nations argue that the ILO standards are not intended to fix a uniform wage level or to establish universal employment conditions but are intended to making the conditions of the labour better all over the world. If the Governments of the developed countries are not intended to protect their job market shocks and really want to provide the labour all over the world they can achieve their goals by providing these countries with technological and financial support. This will automatically lead to the prosperous economies of these countries in turn bettering the living standards of the labour all over the world. ILO: International Labour Organisation is an international agency, which take care of the rights of the labour all over the world. ILO presents the guidelines, which allow the workers to form their organisation in order to help them to bargain and to safeguard their rights, settled a universal standard

Design Innovation in Pakistan Textile Literature review

Design Innovation in Pakistan Textile - Literature review Example Art and craft is not schemed by the Ministry of Education, but teachers are availing lessons nowadays, with increased integration of the art and craft lessons in all levels of education curriculums in Pakistan would lead to innovations in terms of design. The textile University of Faisalabad, and University of Engineering and Technology in Lahore are the major players towards value addition in terms of textile related art and design courses. The government is obligated towards availing support to other institutions towards the textile design innovation. Hands-on or practical oriented courses are required for the art and design courses. The textile University of Faisalabad has courses in contemporary designs, Islamic arts, and various forms of designs for relevancy of their students in the job market. Other higher learning institutions as well contribute to both the Pakistan and global textile industry innovation; via design-oriented courses. The sculpturing and painting were developed in the Renaissance age. The Islamic art and designs for functionality and aesthetics were the key features in the industrialization period prior to transforming to the visual appeal art and design characteristic of the modern age. Different aspects of Islamic art features developments over the course of history were indicated. The transformation or evolution of art and design has been systematic since the stone age, early man era, through to the age of modern art. Various firms in Pakistan carry textile product design and production; this ranges from small scale to large-scale firms. Income and employment availed by the firm are some of the benefits; hence symbol of sustainability. The design and production or manufacture of the textile products via R & D production methods is yet to be fully embraced or realized, because of high initial cost of investment and high energy input costs Availability of

Fetal Genetic Disorders Lead to Abortion Essay Example for Free

Fetal Genetic Disorders Lead to Abortion Essay When a woman first finds out that they are pregnant many factors of worry are present. One is particular is the worry of a genital defect. As women age their percentile chance of having a baby with a genital defect changes drastically. Common genetic disorders are trisomy 13, Patau syndrome, trisomy 18, Edward’s syndrome, and trisomy 21, Down syndrome. Although these can be treatable if a baby lives to adult age they will have a long list of medical problems to live with. Genital defects in babies is directly linked to the rate at which abortions occur. Although it may be easier to abort a baby with a genital defect it is still as wrong no matter what the circumstances. In order for someone to fully understand what having a baby with a specific genital disorder would be like, they must first understand the effects and symptoms of these disorders. When a baby is formed they have 46 chromosomes, 23 from their mom, and 23 from their dad. When nondisjunction occurs, no full separation of a chromosome pair is when genital disorders become present. Nondisjunction of two chromosomes 18 during the formation of an egg or sperm is by far the most common cause of Edwards syndrome. † (Gale Encyclopedia of Genetic Disorders) The interesting thing is that nothing before or during pregnancy causes this and nothing can be done to prevent it. The only well supported factor is that as the mother’s age increases there is a larger chance for complications. â€Å"Unlike Down syndrome, the developmental issues caused by Trisomy 18 are associated with medical complications that are more potentially life-threatening in the early months and years of life. (Trisomy 18 Foundation) Because of this 50% of babies with Trisomy 18 taken to term will be stillborn. (Trisomy 18 Foundation) Though there have been rare cases of people living to adulthood with this disease, they face life threatening complications that will be present until the day they die. Abortion has been present since the early 1800s and is still a major issue today. The most well known case dealing with abortion is that of Roe vs. Wade. In this case Wade was fighting against Roe by saying that if they rule abortion unconstitutional they â€Å"improperly invade a right said to be ossessed by a pregnant women, to choose to terminate her pregnancy. †(Herring 86) The final ruling on this case was that women should have the legal rights to her body and should be able to choose whether or not they will terminate their pregnancy. Several factors determine why a mother would choose an abortion. Single parenthood, not enough income, just doesnt want the baby, and/or medical issues. But one of the more rising issues is the fact that women will abort babies when they get a bad diagnosis. If their baby is going to be mentally retarded then why have it, the easier thing would be to just get rid of it. This has been the growing choice among mothers these days, especially the younger ones. By age 32 a women is 67% likely to have a baby with a genital defect, and is therefore 45% more likely to have an abortion. (Herring 193) The rising controversy of abortion can be directly linked to the diagnosis of fetal genetics disorders. If a woman receives the diagnosis that her baby will be born with Down syndrome and a series of other health issues then why give birth? If the baby is not going to be perfect then there are several women out there that feel the baby has no worth living. Every fetus becomes present at conception and deserves to live whether or not they have a genital defect. Most defects are treatable today and even the ones that are not if the baby is going to die anyway then why not let it die on it’s own terms, instead of terminating it. This is the argument that has been present since the early 1800s. In Roe vs. Wade the Supreme Court ruled that they did not have the right to tell a woman what to do with her body. But murder is a capital crime as well. So the real debate should not be that abortion is legal, the real issue should be whether or not abortion is seen as murder. Webster’s dictionary defines murder as the unlawful premeditated killing of a human being by another and also defines abortion as the deliberate termination of a human pregnancy. But when is a baby considered a human? When they are conceived, or when they are born? It would be considered murder if someone killed a baby after they were born, so why is it not considered murder if someone kills a baby before they are born. This is the true underlying issue of abortion. If the legal system can realize their gaps in their logic then maybe they can figure out that murder is murder no matter how big or how small a human is. Everyone has different morals and beliefs on what they think is right or wrong. But know matter what their moral or spiritual background n one can deny a human being life. So whatever the reason for abortion there need only be one reason against abortion. It is killing plain and simple. If killing is illegal then so is abortion.