In this paper we discuss the potential role of virtual environments in the analysis phase of computer forensics investigations. We argue that commercial closed source computer forensics software has certain limitations, and we propose a method which may lead to gradual shift to open source software (OSS). A brief overview of virtual environments and open source software tools is presented and discussed. Further we identify current limitations of virtual environments leading to the conclusion that the method is very promising, but at this point in time it can not replace conventional techniques of computer forensics analysis. We demonstrate that using Virtual Machines (VM) in Linux environments can complement the conventional techniques, and often can bring faster and verifiable results not dependent on proprietary, close source tools.

Information system audit and computer forensics each developed its own set of standards based on a separate discipline of knowledge. In this paper we analyse the tools and methodology used by IS auditors and computer forensic experts in the contemporary world, with the focus on emerging similarities between their needs and goals. We demonstrate the benefits which could be derived from the increased convergence of tools and methodology used in both areas, and we discuss possible modifications to existing tools and methodology to fulfill this goal.

In this chapter we discuss the application of the open source software tools in computer forensics education at tertiary level. We argue that open source tools are more suitable than commercial tools, as they provide the opportunity for students to gain in-depth understanding and appreciation of the computer forensic process as opposed to familiarity with one software product, however complex and multi-functional. With the access to all source programs the students become more than just the consumers of the tools as future forensic investigators. They can also examine the code, understand the relationship between the binary images and relevant data structures, and in the process gain necessary background to become the future creators of new and improved forensic software tools. As a case study we present an advanced subject, Computer Forensics Workshop, which we designed for the Bachelor's degree in computer science at the University of Western Sydney. We based all laboratory work and the main take-home project in this subject on open source software tools. We found that without exception more than one suitable tool can be found to cover each topic in the curriculum adequately. We argue that this approach prepares students better for forensic field work, as they gain confidence to use a variety of tools, not just a single product they are familiar with.

The number of Computer Forensics related courses in Australian universities tripled in the last three years. This unprecedented growth is fuelled by the growth of the discipline itself and the increase in demand for specialists by both law enforcement agencies and business organisations. This paper presents an overview of current computer forensics education in Australian tertiary institutions. We also discuss the position of computer forensics in the body of knowledge and the issues of curriculum development, including the involvement of professional societies.

This paper describes our experience in the design and implementation of a computer forensics specialisation for the Bachelor of Computer Science degree and its capstone subject Computer Forensics Workshop. Our motivation for introducing this specialisation was to respond to the growing demand for professional services in computer forensics by the government and industry as well as to attract undergraduate students back to computing. Computer forensics is an emerging multidisciplinary field with foundations in computer science and law, and academically it is best positioned as a stream in general computer science degrees. The capstone subject in the specialisation, Computer Forensics Workshop, is practically oriented with a substantial laboratory component. The subject is taught by a team of academics, each contributing their expert knowledge in operating systems, file systems, network security and cryptography. The aim is to prepare the students to enter the job market as a professional computer forensics specialist, either in a law enforcement agency or a business organisation relying on computer information systems.

Encrypted files captured by acquiring a bit-by-bit image in the process of conventional forensic investigation are practically impossible to decrypt without knowing the key and the method of encryption. The Windows operating system provides the option to encrypt files using an encryption driver bundled with the New Technology File System (NTFS) file system, the so-called encrypting file system (EFS). EFS files can be manipulated transparently by the owner and the system administrator as long as they reside in an NTFS file system. In this article we demonstrate the methodology of extracting EFS-decrypted files from a live system. The method of extraction is built around a software utility, Robocopy, which does not modify any metadata of the file system during extraction. The hash value for the encrypted data calculated before and after the extraction is identical, so this approach can be considered to be forensically sound. We present a scenario that shows that live system investigation is indispensable in obtaining complete information about the system being examined. This information would be lost if conventional methods were applied, even when supplemented by the capture and analysis of physical memory.

In this paper we discuss the potential role of virtual environments in the analysis phase of computer forensics investigations. General concepts of virtual environments and software tools are presented and discussed. Further we identify the limitations of virtual environments leading to the conclusion that this method can not be considered to be a replacement for conventional techniques of computer evidence collection and analysis. We propose a new approach where two environments, conventional and virtual, are used independently. Further we demonstrate that this approach can considerably shorten the time of the computer forensics investigation analysis phase and it also allows for better utilisation of less qualified personnel.

This paper is a continuation of our previous work (1) in which we proposed an approach where two environments, conventional and virtual, are used independently in the forensic analysis of computer systems. We discuss the use of virtual environments in the analysis of USB flash drives in computer forensics investigations. After briefly introducing general con- cepts of a virtual environment and software tools we show how this approach can be successfully used in the analysis phase of the computer forensics investigation of portable USB flash drives. We also show why virtualisation technique can complement but not completely replace conventional methods of computer evidence analysis.

In this paper we present the results of experiments we conducted on Suse Linux and Windows XP systems to determine the age of user process data in physical memory. To be able to measure the age of pages we used an artificial load program which time-stamps data segment and block device cache pages. Our goal was to compare the behaviour of both systems and to determine whether the rate of decay for user data depends on the demand for physical memory. Our findings show that Windows and Linux systems preserve almost the same number of pages with user data, and the age distribution of these pages does not change significantly with the level of demand.

In this paper we discuss how operating system design and implementation influence the methodology for computer forensics investigations, with the focus on forensic acquisition of memory. In theory the operating system could support such investigations both in terms of tools for analysis of data and by making the system data readily accessible for analysis. Conventional operating systems such as Windows and UNIX derivatives offer some memory-related tools that are geared towards the analysis of system crashes, rather than forensic investigations. In this paper we demonstrate how techniques developed for persistent operating systems, where lifetime of data is independent of the method of its creation and storage, could support computer forensics investigations delivering higher efficiency and accuracy. It is proposed that some of the features offered by persistent systems could be built into conventional operating systems to make illicit activities easier to identify and analyse. We further propose a new technique for forensically sound acquisition of memory based on the persistence paradigm.

A selective call receiver (100) comprises means for receiving messages (104) and memory means (108) for storing the received messages. Displaying means (130) for displaying the stored messages and a predetermined number of indicators (212) representative of a corresponding predetermined number of stored messages. Means for activating (306) the indicators in a predetermined sequence of activated indicators (210) on the displaying means (130) when the received messages are stored. Means (306) wherein the activating means (306) responds to the deleting means by deactivating the indicator associated with the stored message being deleted resulting in a gap (218) being displayed in the sequence of activated indicators (210) at the position occupied by the deactivated indicator. Means for repositioning (310) the sequence of activated indicators being displayed (210) to eliminate the gap (218) in the sequence of activated indicators (210) while maintaining the positional relationship of the activated indicators being displayed (210).

In this paper we examine the methods of hiding data in the NTFS file system. Further we discuss the analysis techniques which can be applied to detect and recover data hidden using each of these methods. We focus on sophisticated data hiding where the goal is to prevent detection by forensic analysis. Obvious data hiding techniques, for example setting the hidden attribute of a file, will not be included. Hidden data can be further obfuscated by file system independent approaches like data encryption and steganography. This paper is only concerned with the methods which are made possible by the structure of the NTFS file system, and with the recovery of hidden data, not its interpretation.

Backup utilities for the Windows environment are designed to work with the NTFS file format, but they typically provide only partial compatibility with Alternate Data Streams (ADSs). In particular, computer forensics tools are typically capable of discovering ADSs in the file system under investigation, but not necessarily in the backups of such file systems. We examined a number of commonly used backup utilities, and initially classified them into two broad categories: non-ADS aware (ADS lost during backup), and ADS aware. Further, we discovered that within the "ADS aware" category different tools behave differently, provide varying amounts of information about ADSs during backup/restore process, and often lose data. We propose a new classification of backup software based on the treatment of ADSs during backup and restore operations, and discuss its implications for forensic investigation of file system backups.

In this paper we examine the emergence and evolution of computer crime and computer forensics, as well as the crisis computer forensics is now facing. We propose new directions and approaches which better reflect the current objectives of this discipline. We further discuss important challenges that this discipline will be facing in the near future, and we propose an approach more suitable to prepare for these challenges. We focus on the technical aspects, while at the same time providing insights which would be helpful to better understand the unique issues related to computer forensic evidence when presented in the court of law.