Course Material

Homework 1 - Due Day Wed, August 27 11 AM

• Homework 1

Lecture 1

• Introduction
• MD5 Summary and Computer Examination Process

Homework 2 - Due Day Wed Sept 3 - Send Power Point and Quiz Questions by e-mail to ykortsarts@mail.widener.edu by 11 AM Wed, Sept 3

• Homework 2

Lecture 2

• MD 5/ SHA Practice - MiniQuiz Preparation. MiniQuiz will be on Wed, Sept 3 IN CLASS. Duration - 15 minutes
• Review: Binary, Octal, Hexadecimal System, Little Endian/Big Endian, Practice

  QUIZ 1

• Disk Imaging:
  • NIST Computer Forensics Tool Testing Program. Disk Imaging
  • Forensics File Formats
  • FILE SIGNATURES TABLE Gary C. Kessler

Windows Registry

• Microsoft knowledge base article: 250409

• Registry Value Types

• Windows Registry from Wikipedia

• Accesss Data Suplemental Class Material

Practice Labs
• Registry Viewer Practice Lab FRIDAY - first, finish Wed lab
• Registry Viewer Practice Lab WED. DO THIS FIRST, then finish PART 2 from Monday if time permits
• Registry Viewer Practice Lab

  Graded LAB

FTK

• Access Data Login to Learning Management System
• File Signature Search
• Prefetch from ForensicsWiki
• Event Log
• Resource Interchange File Format
• Photo Dna
• Photo Dna
• DtSearch
• Credant Files
• Volatile Tab in FTK - Memory Analysis
  • Forensics Focus
  • Malware Memory Forensics
  • Analyzing a Stuxnet Infection Part 1
  • Analyzing a Stuxnet Infection Part 2
  • Analyzing a Stuxnet Infection Part 3
  • Live Memory Acquisition for Windows Operating Systems

FTK Graded Lab1

Graphics TAB in FTK

• Exchangeable image file format (EXIF)

E-MAIL Tab in FTK

• Outlook Data Files (.PST and .OST)
• Outlook Express (.DBX containers)
• AOL Mail Personal Filing Cabinet files (PFC)
• Windows Live Mail
• IBM Notes (formerly Lotus Notes)
• Forensic email analysis: browser artifacts you may find on a PC or laptop from Magnet Forensics
• Analysis of e-mail and appointment falsification on Microsoft Outlook/Exchange SANS Digital Forensics and Incident Response
• E-mail Forensics in a Corporate Exchange Environment
• Email 'Message-IDs' helpful for forensic analysis? Satheesaan Pasupatheeswaran