Title: Computer Forensics Analysis and Validation
Course: CAP 2141 Digital Forensics II

Introduction

Most law enforcement computer forensic specialists rely upon mathematical validation to verify that the restored mirror image of a computer disk drive and relevant files exactly match the contents of the original computer. Such comparisons help resolve questions that might be raised during litigation about the accuracy of the restored mirror image. They also act as a means of protection for the computer forensic specialist concerning allegations that files were altered or planted by law enforcement officials during the processing of the computer evidence. One of the most critical functions is validating evidence using hashing algorithms in forensics analysis to validate data. This chapter we learn how to refine and modify an investigation plan, use data analysis tools.

Objectives

At the end of this module the student will be able to:

- Determine what data to analyze in a computer forensics investigation
- Explain tools used to validate data
- Explain common data-hiding techniques
- Describe methods of performing a remote acquisition

Readings and Resources

- Textbook: Chapter 9 pg. 345-374
- Brute-force attack: http://en.wikipedia.org/wiki/Brute_force_attack
- Dictionary attack: http://en.wikipedia.org/wiki/Dictionary_attack