Module 01: Computer Forensics in Today’s World

• Ways of Forensic Data Collection
• Objectives of Computer Forensics
• Benefits of Forensic Readiness
• Categories of Forensics Data
• Computer Facilitated Crimes
  • Type of Computer Crimes
  • Examples of Evidence
• Stages of Forensic Investigation in Tracking Cyber Criminals
• Key Steps in Forensics Investigations
• Need for Forensic Investigator
• When An Advocate Contacts The Forensic Investigator, He Specifies How To Approach
• Enterprise Theory of Investigation (ETI)
• Where and when do you use Computer Forensics
• Legal Issues
• Reporting the Results

Module 02: Law and Computer Forensics

• Privacy Issues Involved in Investigations
• Fourth Amendment Definition
• Interpol- Information Technology Crime Center
• Internet Laws and Statutes
• Intellectual Property Rights
• Cyber Stalking
• Crime Investigating Organizations
• The G8 Countries: Principles to Combat High-tech Crime
  • The G8 Countries: Action Plan to Combat High-Tech Crime (International Aspects of Computer Crime)
• United Kingdom: Police and Justice Act 2006
• Australia: The Cybercrime Act 2001
• Belgium
• European Laws
• Austrian Laws
• Brazilian Laws
• Belgium Laws
• Canadian Laws
• France Laws
• Indian Laws
• German Laws
• Italian Laws
• Greece Laws
• Denmark Laws
• Norwegian Laws
• Netherlands Laws
• Internet Crime Schemes
  • Why You Should Report Cybercrime
  • Reporting Computer-related Crimes
  • Person Assigned to Report the Crime
  • When and How to Report an Incident?
  • Who to Contact at the Law Enforcement?
  • Federal Local Agents Contact
  • More Contacts
  • Cyberthreat Report Form

Module 03: Computer Investigation Process

• Securing the Computer Evidence
• Preparation for Searches
• Chain-of Evidence Form
• Accessing the Policy Violation Case: Example
• 10 Steps to Prepare for a Computer Forensic Investigation
• Investigation Process
  • Policy and Procedure Development
  • Evidence Assessment
• Case Assessment
• Processing Location Assessment
• Legal Considerations
• Evidence Assessment
  • Evidence Acquisition
• Write Protection
• Acquire the Subject Evidence
  • Evidence Examination
• Physical Extraction
• Logical Extraction
• Analysis of Extracted Data
• Timeframe Analysis
• Data Hiding Analysis
• Application and File Analysis
• Ownership and Possession
  • Documenting and Reporting
• What Should be in the Final Report?
• Maintaining Professional Conduct

Module 04: First Responder Procedure

• Electronic Evidence
• The Forensic Process
• Types of Electronic Devices
  • Electronic Devices: Types and Collecting Potential Evidence
• Evidence Collecting Tools and Equipment
• First Response Rule
• Incident Response: Different Situations
  • First Response for System Administrators
  • First Response by Non-Laboratory Staff
  • First Response by Laboratory Forensic Staff
• Securing and Evaluating Electronic Crime Scene
• Ask These Questions When A Client Calls A Forensic Investigator
• Health and Safety Issues
• Consent
• Planning the Search and Seizure
  • Initial Search of the Scene
  • Witness Signatures
  • Conducting Preliminary Interviews
• Initial Interviews
  • Documenting Electronic Crime Scene
  • Photographing the Scene
  • Sketching the Scene
  • Collecting and Preserving Electronic Evidence
• Evidence Bag Contents List
• Order of Volatility
• Dealing with Powered OFF Computers at Seizure Time
• Dealing with a Powered ON PC
• Computers and Servers
• Collecting and Preserving Electronic Evidence
• Seizing Portable Computers
• Switched ON Portables
• Packaging Electronic Evidence
• Exhibit Numbering
  • Transporting Electronic Evidence
  • Handling and Transportation to the Forensic Laboratory
• 'Chain of Custody'
• Findings of Forensic Examination by Crime Category

Module 05 : CSIRT

• How to Prevent an Incident?
• Defining the Relationship between Incident Response, Incident Handling, and Incident Management
• Incident Response Checklist
• Incident Management
• Why don't Organizations Report Computer Crimes?
• Estimating Cost of an Incident
• Vulnerability Resources
• Category of Incidents
  • Category of Incidents: Low Level
  • Category of Incidents: Mid Level
  • Category of Incidents: High Level
• CSIRT: Goals and Strategy
  • Motivation behind CSIRTs
  • Why an Organization needs an Incident Response Team?
  • Who works in a CSIRT?
  • Staffing your Computer Security Incident Response Team: What are the Basic Skills Needed?
  • Team Models
  • CSIRT Services can be Grouped into Three Categories:
  • CSIRT Case Classification
  • Types of Incidents and Level of Support
  • Service Description Attributes
  • Incident Specific Procedures
  • How CSIRT handles Case: Steps
  • US-CERT Incident Reporting System
• CSIRT Incident Report Form
• CERT(R) Coordination Center: Incident Reporting Form
  • Limits to Effectiveness in CSIRTs
  • Working Smarter by Investing in Automated Response Capability
• World CERTs http://www.trusted-introducer.nl/teams/country.html
• http://www.first.org/about/organization/teams/
• IRTs Around the World

Module 06: Computer Forensic Lab

• Ambience of a Forensics Lab: Ergonomics
• Forensic Laboratory Requirements
  • Paraben Forensics Hardware: Handheld First Responder Kit
  • Paraben Forensics Hardware: Wireless StrongHold Bag
  • Paraben Forensics Hardware: Remote Charger
  • Paraben Forensics Hardware: Device Seizure Toolbox
  • Paraben Forensics Hardware: Wireless StrongHold Tent
  • Paraben Forensics Hardware: Passport StrongHold Bag
  • Paraben Forensics Hardware: Project-a-Phone
  • Paraben Forensics Hardware: SATA Adaptor Male/ Data cable for Nokia 7110/6210/6310/i
  • Paraben Forensics Hardware: Lockdown
  • Paraben Forensics Hardware: SIM Card Reader/ Sony Clie N & S Series Serial Data Cable
  • Paraben Forensics Hardware: USB Serial DB9 Adapter
• Portable Forensic Systems and Towers: Forensic Air-Lite VI MKII laptop
  • Portable Forensic Systems and Towers: Original Forensic Tower II
  • Portable Forensic Systems and Towers: Portable Forensic Workhorse V
  • Portable Forensic Workhorse V: Tableau 335 Forensic Drive Bay Controller
  • Portable Forensic Systems and Towers: Forensic Air-Lite IV MK II
  • Portable Forensic Systems and Towers: Forensic Tower II
• Forensic Write Protection Devices and Kits: Ultimate Forensic Write Protection Kit
  • Tableau T3u Forensic SATA Bridge Write Protection Kit
  • Tableau T8 Forensic USB Bridge Kit/Addonics Mini DigiDrive READ ONLY 12-in-1 Flash Media Reader
• Power Supplies and Switches
• DIBS® Mobile Forensic Workstation
  • DIBS® Advanced Forensic Workstation
  • DIBS® RAID: Rapid Action Imaging Device
• Forensic Archive and Restore Robotic Devices: Forensic Archive and Restore (FAR Pro)
• Forensic Workstations
• Tools: LiveWire Investigator
• Features of the Laboratory Imaging System
  • Technical Specification of the Laboratory-based Imaging System
• Computer Forensic Labs, Inc
  • Procedures at Computer Forensic Labs (CFL), Inc
• Data Destruction Industry Standards

Module 07: Understanding File Systems and Hard Disks

• Types of Hard Disk Interfaces
  • Types of Hard Disk Interfaces: SCSI
  • Types of Hard Disk Interfaces: IDE/EIDE
  • Types of Hard Disk Interfaces: USB
  • Types of Hard Disk Interfaces: ATA
  • Types of Hard Disk Interfaces: Fibre Channel
  • Disk Capacity Calculation
  • Evidor: The Evidence Collector
  • WinHex
• EFS Key
• FAT vs. NTFS
• Windows Boot Process (XP/2003)
• http://www.bootdisk.com

Module 08: Understanding Digital Media Devices

• Digital Storage Devices
• Magnetic Tape
• Floppy Disk
• Compact Disk
• CD-ROM
• DVD
  • DVD-R, DVD+R, and DVD+R(W)
  • DVD-RW, DVD+RW
  • DVD+R DL/ DVD-R DL/ DVD-RAM
  • HD-DVD (High Definition DVD)
  • HD-DVD
• Blu-Ray
• CD Vs DVD Vs Blu-Ray
• HD-DVD vs. Blu-Ray
• iPod
• Zune
• Flash Memory Cards
  • Secure Digital (SD) Memory Card
  • Compact Flash (CF) Memory Card
  • Memory Stick (MS) Memory Card
  • Multi Media Memory Card (MMC)
  • xD-Picture Card (xD)
  • SmartMedia Memory (SM) Card
• USB Flash Drives
  • USB Flash in a Pen

Module 09: Windows, Linux and Macintosh Boot Processes

• Terminologies
• Boot Loader
• Boot Sector
• Anatomy of MBR
• Basic System Boot Process
• MS-DOS Boot Process
• Windows XP Boot Process
• Common Startup Files in UNIX
• List of Important Directories in UNIX
• Linux Boot Process
• Macintosh Forensic Software by BlackBag
  • Directory Scan
  • FileSpy
  • HeaderBuilder
• Carbon Copy Cloner (CCC)
• MacDrive6

Module 10: Windows Forensics

• Windows Forensics Tool: Helix
  • Tools Present in Helix CD for Windows Forensics
  • Helix Tool: SecReport
  • Helix Tool: Windows Forensic Toolchest (WFT)
• MD5 Generator: Chaos MD5
  • Secure Hash Signature Generator
  • MD5 Generator: Mat-MD5
  • MD5 Checksum Verifier 2.1
• Registry Viewer Tool: RegScanner
• Virtual Memory
• System Scanner
• Integrated Windows Forensics Software: X-Ways Forensics
• Tool: Traces Viewer
• Investigating ADS Streams

Module 11: Linux Forensics

• File System Description
• Mount Command
• Popular Linux Forensics Tools
  • The Sleuth Kit
    • Tools Present in "The Sleuth Kit"
  • Autopsy
    • The Evidence Analysis Techniques in Autopsy
  • SMART for Linux
  • Penguin Sleuth
    • Tools Included in Penguin Sleuth Kit
  • Forensix
  • Maresware
    • Major Programs Present in Maresware
  • Captain Nemo
  • THE FARMER'S BOOT CD

Module 12: Data Acquisition and Duplication

• Mount Image Pro
• Snapshot Tool
• Snapback DatArrest
• Hardware Tool: Image MASSter Solo-3 Forensic
  • Hardware Tool: LinkMASSter-2 Forensic
  • Hardware Tool: RoadMASSter-2
• Save-N-Sync
• Hardware Tool: ImageMASSter 6007SAS
• Hardware Tool: Disk Jockey IT
• SCSIPAK
• IBM DFSMSdss
• Tape Duplication System: QuickCopy

Module 13: Computer Forensic Tools

Part I- Software Forensics Tools

• Visual TimeAnalyzer
• X-Ways Forensics
• Evidor
• Data Recovery Tools: Device Seizure 1.0
  • Data Recovery Tools: Forensic Sorter v2.0.1
  • Data Recovery Tools: Directory Snoop
• Permanent Deletion of Files: Darik's Boot and Nuke (DBAN)
• File Integrity Checker: FileMon
  • File Integrity Checker: File Date Time Extractor (FDTE)
  • File Integrity Checker: Decode - Forensic Date/Time Decoder
• Partition Managers: Partimage
• Linux/Unix Tools: Ltools and Mtools
• Password Recovery Tool: Decryption Collection Enterprise v2.5
  • Password Recovery Tool: AIM Password Decoder
  • Password Recovery Tool: MS Access Database Password Decoder
• Internet History Viewer: CookieView - Cookie Decoder
  • Internet History Viewer: Cookie Viewer
  • Internet History Viewer: Cache View
  • Internet History Viewer: FavURLView - Favourite Viewer
  • Internet History Viewer: NetAnalysis
• FTK- Forensic Toolkit
• Email Recovery Tool: E-mail Examiner
  • Email Recovery Tool: Network E-mail Examiner
• Case Agent Companion
• Chat Examiner
• Forensic Replicator
• Registry Analyzer
• SIM Card Seizure
• Text Searcher
• Autoruns
• Autostart Viewer
• Belkasoft RemovEx
• HashDig
• Inforenz Forager
• KaZAlyser
• DiamondCS OpenPorts
• Pasco
• Patchit
• PE Explorer
• Port Explorer
• PowerGREP
• Process Explorer
• PyFLAG
• Registry Analyzing Tool: Regmon
• Reverse Engineering Compiler
• SafeBack
• TapeCat
• Vision

Part II- Hardware Forensics Tools

• List of Hardware Computer Forensic Tools
  • Hard Disk Write Protection Tools: Nowrite & Firewire Drivedock
  • LockDown
  • Write Protect Card Reader
  • Drive Lock IDE
  • Serial-ATA DriveLock Kit
  • Wipe MASSter
  • ImageMASSter Solo-3 IT
  • ImageMASSter 4002i
  • ImageMasster 3002SCSI
  • Image MASSter 3004SATA

Module 14: Forensics Investigations Using Encase

• Evidence File
  • Evidence File Format
• Verifying File Integrity
• Hashing
• Acquiring Image
• Configuring Encase
  • Encase Options Screen
  • Encase Screens
  • View Menu
  • Device Tab
  • Viewing Files and Folders
  • Bottom Pane
• Viewers in Bottom Pane
  • Status Bar
• Searching
• Keywords
  • Adding Keywords
  • Grouping
  • Add multiple Keywords
• Starting the Search
  • Search Hits Tab
  • Search Hits
• Bookmarks
  • Creating Bookmarks
  • Adding Bookmarks
  • Bookmarking Selected Data
• Recovering Deleted Files/folders in FAT Partition
  • Viewing Recovered Files
  • Recovering Folders in NTFS
• Master Boot Record
• NTFS Starting Point
• Viewing Disk Geometry
• Recovering Deleted Partitions
• Hash Values
  • Creating Hash Sets
  • MD5 Hash
  • Creating Hash
• Viewers
• Signature Analysis
• Viewing the Results
• Copying Files Folders
• E-mail Recovery
• Reporting
• Encase Boot Disks
• IE Cache Images

Module 15: Recovering Deleted Files and Deleted partitions

 Part I: Recovering Deleted Files

• Deleting Files
• What happens when a File is Deleted in Windows?
• Storage Locations of Recycle Bin in FAT and NTFS System
• How The Recycle Bin Works
• Damaged or Deleted INFO File
• Damaged Files in Recycled Folder
• Damaged Recycle Folder
• Tools to Recover Deleted Files
  • Tool: Search and Recover
  • Tool: Zero Assumption Digital Image Recovery
  • Tool: PC Inspector Smart Recovery
  • Tool: Fundelete
  • Tool: RecoverPlus Pro
  • Tool: OfficeFIX
  • Tool: Recover My Files
  • Tool: Zero Assumption Recovery
  • Tool: SuperFile Recover
  • Tool: IsoBuster
  • Tool: CDRoller
  • Tool: DiskInternals Uneraser
  • Tool: DiskInternal Flash Recovery
  • Tool: DiskInternals NTFS Recovery
  • Recover Lost/Deleted/Corrupted files on CDs and DVDs
  • Tool: Undelete
  • Tool: Active@ UNDELETE
  • Data Recovery Tool: CD Data Rescue
  • Tool: File Recover
  • Tool: WinUndelete
  • Tool: R-Undelete
  • Tool: Image Recall
  • Tool: eIMAGE Recovery
  • Tool: File Scavenger
  • Tool: Recover4all Professional
  • Tool: eData Unerase
  • Tool: Easy-Undelete
  • Tool: InDisk Recovery
  • Tool: Repair My Excel
  • Tool: Repair Microsoft Word Files
  • Tool: Zip Repair
  • Tool: Canon RAW File Recovery Software

 Part II: Recovering Deleted Partitions

• Deletion of Partition
• Deletion of Partition using Windows
• Deletion of Partition using Command Line
• Recovery of Deleted Partition
• Deleted Partition Recovery Tools
  • Tool: GetDataBack
  • Tool: DiskInternals Partition Recovery
  • Tool: Active@ Partition Recovery
  • Tool: Handy Recovery
  • Tool: Acronis Recovery Expert
  • Tool: Active Disk Image
  • Tool: TestDisk
  • Tool: Recover It All!
  • Tool: Scaven
  • Tool: Partition Table Doctor
  • Tool: NTFS Deleted Partition Recovery

Module 16: Image Files Forensics

• Common Terminologies
• Understanding Image File Formats
  • GIF (Graphics Interchange Format)
  • JPEG (Joint Photographic Experts Group)
  • JPEG 2000
  • BMP (Bitmap) File
  • PNG (Portable Network Graphics)
  • Tagged Image File Format (TIFF)
  • ZIP (Zone Information Protocol)
• How File Compression Works
• Huffman Coding Algorithm
• Lempel-Ziv Coding Algorithm
• Vector Quantization
• http://www.filext.com
• Picture Viewer: AD
• Picture Viewer: Max
• FastStone Image Viewer
• XnView
• Faces – Sketch Software
• Steganalysis
  • Steganalysis Tool: Stegdetect
• Image File Forensic Tool: GFE Stealth (Graphics File Extractor)
  • Tool: ILook v8
  • Tool: P2 eXplorer

Module 17: Steganography

• Classification of Steganography
• Steganography vs. Cryptography
• Model of Stegosystem
• Model of Cryptosystem
• Introduction to Stego-Forensics
  • Important Terms in Stego-Forensics
• Steganography vs. Watermarking
  • Attacks on Watermarking
  • Application of Watermarking
  • Digimarc's Digital Watermarking
  • Watermarking – Mosaic Attack
• Mosaic Attack – Javascript code
• 2Mosaic – Watermark breaking Tool
• Steganalysis
  • Steganalysis Methods/Attacks on Steganography
• TEMPSET
• Van Eck phreaking
• Printer Forensics
  • Is Your Printer Spying On You?
  • DocuColor Tracking Dot Decoding
• Steganography Tools
  • Tool: Steganos
  • Steganography Tool: Pretty Good Envelop
  • Tool: Gifshuffle
  • Refugee
  • Tool: JPHIDE and JPSEEK
  • Tool: wbStego
  • Tool: OutGuess
  • Tool: Invisible Secrets 4
  • Tool: Masker
  • Tool: Hydan
  • Tool: Cloak
  • Tool: StegaNote
  • Tool: Stegomagic
  • Hermetic Stego
• Application of Steganography
• How to Detect Steganography?
  • Stego Suite – Steg Detection Tool
  • StegSpy

Module : 18: Application Password Crackers

• Brute Force Attack
• Dictionary Attack
• Syllable Attack/Rule-based Attack/Hybrid Attack
• Password Guessing
• Rainbow Attack
• CMOS Level Password Cracking
  • Tool CmosPwd
  • ERD Commander
  • Active Password Changer
• http://www.virus.org/index.php?
• Pdf Password Crackers
• Password Cracking Tools o
  • Tool: Cain & Abel
  • Tool: LCP
  • Tool: SID&User
  • Tool: Ophcrack 2
  • Tool: John the Ripper
  • Tool: DJohn
  • Tool: Crack
  • Tool: Brutus
  • Tool: Access PassView
  • Tool: RockXP
  • Tool: Magical Jelly Bean Keyfinder
  • Tool: PstPassword
  • Tool: Protected Storage PassView
  • Tool: Network Password Recovery
  • Tool: Mail PassView
  • Tool: Asterisk Key
  • Tool: Messenger Key
  • Tool: MessenPass
  • Tool: Password Spectator Pro
  • Tool: SniffPass
  • Tool: Asterisk Logger
  • Tool: Dialupass
  • Tool: Mail Password Recovery
  • Tool: Database Password Sleuth
  • Tool: CHAOS Generator
  • Tool: PicoZip Recovery
  • Tool: Netscapass
• Common Recommendations for Improving Password Security
• Standard Password Advice

Module 19: Network Forensics and Investigating Logs

• Introduction to Network Forensics
  • The Hacking Process
  • The Intrusion Process
• Looking for Evidence
• Log Files as Evidence
• Records of Regularly Conducted Activity
• Legality of Using Logs
• Maintaining Credible IIS Log Files
• Log File Accuracy
• Log Everything
• Keeping Time
  • UTC Time
• Use Multiple Logs as Evidence
• Avoid Missing Logs
• Log File Authenticity
• Work with Copies
• Access Control
• Chain of Custody
• Importance of Audit Logs
  • Central Logging Design
  • Steps to Implement Central Logging
  • Centralized Syslog Server
  • Syslog-ng: Security Tool
  • IIS Centralized Binary Logging
  • ODBC Logging
  • IISLogger: Development tool
  • Socklog: IDS Log Analysis Tool
  • KiwiSysLog Tool
  • Microsoft Log Parser: Forensic Analysis Tool
  • Firewall Analyzer: Log Analysis Tool
  • Adaptive Security Analyzer (ASA) Pro: Log Analysis Tool
  • GFI EventsManager
• How does GFI EventsManager work?
  • Activeworx Security Center
  • EventLog Analyzer
• Why Synchronize Computer Times?
• What is NTP Protocol?
  • NTP Stratum Levels
• NIST Time Servers
• Configuring the Windows Time Service

Module 20: Investigating Network Traffic

• Network Addressing Schemes
• Tool: Tcpdump
• CommView
• Softperfect Network Sniffer
• HTTP Sniffer
• EtherDetect Packet Sniffer
• OmniPeek
• Iris Network Traffic Analyzer
• SmartSniff
• NetSetMan Tool
• Evidence Gathering at the Data-link Layer: DHCP database
• DHCP Log
• Siemens Monitoring Center
• Netresident Tool
• eTrust Network Forensics
• IDS Policy Manager http://www.activeworx.org

Module 21: Investigating Wireless Attacks

• Association of Wireless AP and Device
• Search Warrant for Wireless Networks
• Key Points to Remember
• Points You Should Not Overlook while Testing the Wireless Network
• Methods to Access a Wireless Access Point
  • Direct-connect To the Wireless Access Point
• Nmap
• Scanning Wireless Access Points using Nmap
• Rogue Access Point
  • "Sniffing" Traffic Between the Access Point and Associated Devices
• Scanning using Airodump
• MAC Address Information
• Airodump: Points to Note
• Searching for Additional Devices
• Forcing Associated Devices to Reconnect
• Check for MAC Filtering
  • Changing the MAC Address
• Passive Attack
• Active Attacks on Wireless Networks
• Investigating Wireless Attacks

Module 22: Investigating Web Attacks

• Types of Web Attacks
  • Cross-Site Scripting (XSS)
• Investigating Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
• Anatomy of CSRF Attack
• Pen-testing CSRF Validation Fields
  • Code Injection Attack
• Investigating Code Injection Attack
  • Command Injection Attack
  • Parameter Tampering
  • Cookie Poisoning
• Investigating Cookie Poisoning Attack
  • Buffer Overflow/Cookie Snooping
• Investigating Buffer Overflow
  • DMZ Protocol Attack, Zero Day Attack
• Example of FTP Compromise
• Acunetix Web Vulnerability Scanner
  • Tools for Locating IP Address: Hide Real IP
  • Tools for Locating IP Address: www.whatismyip.com
  • Tools for Locating IP Address: IP Detective Suite
  • Tools for Locating IP Address: Enterprise IP – Address Manager
• Intrusion Detection
• CounterStorm-1: Defense against Known, Zero Day and Targeted Attacks

Module 23: Router Forensics

• Routing Information Protocol
• Hacking Routers
• Router Attack Topology
• Recording your Session
• Router Logs
• NETGEAR Router Logs
• Link Logger
• Sawmill: Linksys Router Log Analyzer
• Real Time Forensics
• Router Audit Tool (RAT)

Module 24: Investigating DoS Attacks

• DoS Attacks
• Types of DoS Attacks
  • Types of DoS Attacks: Ping of Death Attack
  • Types of DoS Attacks: Teardrop Attack
  • Types of DoS Attacks: SYN Flooding
  • Types of DoS Attacks: Land
  • Types of DoS Attacks: Smurf
  • Types of DoS Attacks: Fraggle
  • Types of DoS Attacks: Snork
  • Types of DoS Attacks: WINDOWS OUT-OF-BAND (OOB) Attack
• DDoS Attack
  • Working of DDoS Attacks (FIG)
  • Classification of DDoS Attack
• DoS Attack Modes
• Indications of a DoS/DDoS Attack
• Techniques to Detect DoS Attack
  • Techniques to Detect DoS Attack: Activity Profiling
  • Sequential Change-Point Detection
  • Wavelet-based Signal Analysis
• Challenges in the Detection of DoS Attack

Module 25: Investigating Internet Crimes

• Internet Crimes
• Internet Forensics
  • Why Internet Forensics
• IP Address
• Domain Name System (DNS)
  • DNS Record Manipulation
  • DNS Lookup
• Email Headers
  • Email Headers Forging
  • Tracing Back Spam Mails
• Switch URL Redirection
  • Sample Javascript for Page-based Redirection
  • Embedded JavaScript
• Recovering Information from Web Pages
  • Downloading a Single Page or an Entire Web Site
• Tool: Grab-a-Site
• Tool: SurfOffline 1.4
• Tool: My Offline Browser 1.0 www.newprosoft.com
• Tool: WayBack Machine
• HTTP Headers
  • Viewing Header Information
• Examining Information in Cookies
  • Viewing Cookies in Firefox
• Tracing Geographical Location of a URL: www.centralops.net
  • DNS Lookup Result: centralops.net
• NetScanTools Pro
• Tool: Privoxy http://www.privoxy.org

Module 26: Tracking E-mails and Investigating E-mail Crimes

• Client and Server in E-mail
• E-mail Client
• E-mail Server
• Real E-mail System
• Received: Headers
• Forging Headers
• List of Common Headers
• Exchange Message Tracking Center
• MailDetective Tool
  • Forensic ToolKit (FTK)
  • Tool: E-Mail Detective
  • Recover My Email for Outlook
  • Diskinternals – Outlook Recovery
  • Tool: SpamArrest
  • Tool: ID Protect - www.enom.com
• U.S. Laws Against Email Crime: CAN-SPAM Act
• U.S.C.  2252A
• U.S.C.  2252B
• Email crime law in Washington: RCW 19.190.020

Module 27: Investigating Corporate Espionage

• Introduction to Corporate Espionage
• Motives behind Corporate Espionage
• Information that Corporate Spies Seek
• Corporate Espionage: Insider/Outsider Threat
• Techniques of Spying
• Defense Against Corporate Spying
• Netspionage
• Investigating Corporate Espionage Cases
• Employee Monitoring: Activity Monitor
• Spy Tool: SpyBuddy

Module 28: Investigating Trademark and Copyright Infringement

• Characteristics of Trademarks
• Copyright
• Copyright Infringement: Plagiarism
  • Plagiarism Detection Factors
  • Plagiarism Detection Tool: Copy Protection System (COPS)
  • Plagiarism Detection Tool: SCAM (Stanford Copy Analysis Mechanism)
  • Plagiarism Detection Tool: CHECK
  • Plagiarism Detection Tool: Jplag
  • Plagiarism Detection Tool: VAST
  • Plagiarism Detection Tool: SIM
  • Plagiarism Detection Tool: PLAGUE
  • Plagiarism Detection Tool: YAP
  • Plagiarism Detection Tool: SPlaT
  • Plagiarism Detection Tool: Sherlock
  • Plagiarism Detection Tool: Urkund
  • Plagiarism Detection Tool: PRAISE
  • Plagiarism Detection Tool: FreestylerIII
  • Plagiarism Detection Tool: SafeAssignment
• http://www.ip.com
  • How it works?
• Investigating Intellectual Property
• US Laws for Trademarks and Copyright
• Indian Laws for Trademarks and Copyright
• Japanese Laws for Trademarks and Copyright
• Australia Laws For Trademarks and Copyright
• UK Laws for Trademarks and Copyright

Module 29: Investigating sexually harassment incidents

• Sexual Harassment - Introduction
• Types of Sexual Harassment
• Consequences of Sexual Harassment
• Responsibilities of Supervisors
• Responsibilities of Employees
• Complaint Procedures
• Investigation Process
• Sexual Harassment Investigations
• Sexual Harassment Policy
• Preventive Steps
• U.S Laws on Sexual Harassment
• The Laws on Sexual Harassment: Title VII of the 1964 Civil Rights Act
• The Laws on Sexual Harassment: The Civil Rights Act of 1991
• The Laws on Sexual Harassment: Equal Protection Clause of the 14th Amendment
• The Laws on Sexual Harassment: Common Law Torts
• The Laws on Sexual Harassment: State and Municipal Laws

Module 30: Investigating Child Pornography

• Introduction to Child Pornography
• People's Motive Behind Child Pornography
• People Involved in Child Pornography
• Role of Internet in Promoting Child Pornography
• Effects of Child Pornography on Children
• Measures to Prevent Dissemination of Child Pornography
• Challenges in Controlling Child Pornography
• Guidelines for Investigating Child Pornography Cases
• Sources of Digital Evidence
• Antichildporn.org
  • How to Report Antichildporn.org about Child Pornography Cases
  • Report Format of Antichildporn.org
• Tools to Protect Children from Pornography: Reveal
  • Tool: iProtectYou
  • Child Exploitation Tracking System (CETS)
• http://www.projectsafechildhood.gov/
• Innocent Images National Initiative
• Internet Crimes Against Children (ICAC)
• Reports on Child Pornography
• U.S. Laws against Child Pornography
• Australia Laws against Child Pornography
• Austria Laws against Child Pornography
• Belgium Laws against Child Pornography
• Cyprus Laws against Child Pornography
• Japan Laws against Child Pornography

Module 31: PDA Forensics

• Features
• PDA Forensics Steps
  • Investigative Methods
• Tool:
  • PDA Secure – Forensic Tool
  • EnCase – Forensic Tool

Module 32: iPod Forensics

• iPod
  • iPod Features
  • iPod as Operating System
• Apple HFS+ and FAT32
• Application Formats
• Misuse of iPod
• iPod Investigation
  • Mac Connected iPods
  • Windows Connected iPods
  • Storage
  • Lab Analysis
  • Remove Device From Packaging
• Testing Mac Version
• Full System Restore as Described in the User's Manual
• Testing Windows Version
• User Account
• Calendar and Contact Entries
• Macintosh Version
• EnCase
• Deleted Files
• Windows Version
• Registry Key Containing the iPod's USB/Firewire Serial Number
• Tool:
  • DiskInternals Music Recovery
  • Recover My iPod: Tool

Module 33: Blackberry Forensics

• Blackberry: Introduction
• BlackBerry Functions
• BlackBerry as Operating System
• How BlackBerry (RIM) Works
• BlackBerry Serial Protocol
• BlackBerry Security
• BlackBerry Wireless Security
  • BlackBerry Security for Wireless Data
  • Security for Stored Data
• Forensics
• Acquisition
• Collecting Evidence from Blackberry
  • Collecting Evidence from Blackberry: Gathering Logs
  • Collecting Evidence from Blackberry: Imaging and Profiling
• Review of Evidence
• Simulator – Screenshot
• Blackberry Attacks
• Protecting Stored Data
• Data Hiding in BlackBerry
• BlackBerry Signing Authority Tool

Module 34: Investigative Reports

• Understanding the Importance of Reports
• Investigating Report Requirements
• Sample Forensic Report
  • Sample Report
• Guidelines for Writing Reports
• Important Aspects of a Good Report
• Dos and Don'ts of Forensic Computer Investigations
• Case Report Writing and Documentation
• Create a Report to Attach to the Media Analysis Worksheet
• Investigative Procedures
  • Collecting Physical and Demonstrative Evidence
  • Collecting Testimonial Evidence
• Best Practices for Investigators

Module 35: Becoming an Expert Witness

• What is Expert Witness
• Types of Expert Witnesses
  • Computer Forensics Experts
  • Medical & Psychological Experts
  • Civil Litigation Experts
  • Construction & Architecture Experts
  • Criminal Litigation Experts
• Scope of Expert Witness Testimony
• Checklists for Processing Evidence
• Examining Computer Evidence
  • Recognizing Deposing Problems
• Dealing with Media