ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "Main Page"

From ForensicsWiki
Jump to: navigation, search
m
(Update of research section/archived previous research content to Past Selected Research page)
 
(15 intermediate revisions by 7 users not shown)
Line 7: Line 7:
  
 
==WIKI NEWS==
 
==WIKI NEWS==
 +
2016-03-30: '''Site Maintenance on 2016-04-01''' Attention Forensic Wiki community, site maintenance will be occurring on 1 April 2016 from 9AM EST to 1PM EST. During this time Forensic Wiki will not be available as it will be offline to perform environment upgrades.
 +
 +
2015-08-26: – A support email address (support AT forensicswiki.org) was created for all your forensicswiki needs.  This is a mailing list that goes to the appropriate staff that will assist with site maintenance, issues, etc.  If you have questions or issues with the site please send us an email.
 +
 +
'''2015-07-18''': Forensic Wiki has been acquired by Harris Corporation for the betterment of the community.  All licensing and data rights are staying the same, there’s just corporate funding behind the site now.  The wiki will remain as an international resource, with no editorial input from Harris whatsoever.  All of the existing editorial controls and checks and balances will remain in place.  All of the existing accounts carry forward.
 +
 
2013-05-15: You can now subscribe to Forensics Wiki Recent Changes with the [[ForensicsWiki FeedBurner Feed]]
 
2013-05-15: You can now subscribe to Forensics Wiki Recent Changes with the [[ForensicsWiki FeedBurner Feed]]
  
Line 14: Line 20:
 
<!-- Selected Forensics Research -->   
 
<!-- Selected Forensics Research -->   
 
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#ffff99; align:center; border:1px solid #ddccff;">
 
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#ffff99; align:center; border:1px solid #ddccff;">
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Research </h2>
+
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Challenge </h2>
  
<small>May 2014</small>
+
;[[Digital_Forensic_Research_Workshop|Digital Forensic Research Workshop]]
<bibtex>
+
@inproceedings{Hurley:2013:MAC:2488388.2488444,
+
author = {Hurley, Ryan and Prusty, Swagatika and Soroush, Hamed and Walls, Robert J. and Albrecht, Jeannie and Cecchet, Emmanuel and Levine, Brian Neil and Liberatore, Marc and Lynn, Brian and Wolak, Janis},
+
title = {Measurement and Analysis of Child Pornography Trafficking on P2P Networks},
+
booktitle = {Proceedings of the 22Nd International Conference on World Wide Web},
+
series = {WWW '13},
+
year = {2013},
+
isbn = {978-1-4503-2035-1},
+
location = {Rio de Janeiro, Brazil},
+
pages = {631--642},
+
numpages = {12},
+
url = {http://dl.acm.org/citation.cfm?id=2488388.2488444},
+
acmid = {2488444},
+
publisher = {International World Wide Web Conferences Steering Committee},
+
address = {Republic and Canton of Geneva, Switzerland},
+
keywords = {digital forensics, forensic triage},
+
}
+
</bibtex>
+
Peer-to-peer networks are the most popular mechanism for the criminal acquisition and distribution of child pornography (CP). In this paper, we examine observations of peers sharing known CP on the eMule and Gnutella networks, which were collected by law enforcement using forensic tools that we developed. We characterize a year's worth of network activity and evaluate different strategies for prioritizing investigators' limited resources. The highest impact research in criminal forensics works within, and is evaluated under, the constraints and goals of investigations. We follow that principle, rather than presenting a set of isolated, exploratory characterizations of users.
+
  
First, we focus on strategies for reducing the number of CP files available on the network by removing a minimal number of peers. We present a metric for peer removal that is more effective than simply selecting peers with the largest libraries or the most days online. Second, we characterize six aggressive peer subgroups, including: peers using Tor, peers that bridge multiple p2p networks, and the top 10% of peers contributing to file availability. We find that these subgroups are more active in their trafficking, having more known CP and more uptime, than the average peer. Finally, while in theory Tor presents a challenge to investigators, we observe that in practice offenders use Tor inconsistently. Over 90% of regular Tor users send traffic from a non-Tor IP at least once after first using Tor.
+
The current Digital Forensic Research Workshop (DFRWS) is about the Internet of Things (IoT). Analysis of devices and network data including a Smart TV Raspberry Pi and Amazon Echo cloud data are part of the scenario.
(See also [[Past Selected Articles]])
+
 
 +
See more about [[Digital_Forensic_Research_Workshop|DFRWS here...]]
 +
(See also [[Past Selected Articles|Past Selected Research]])
  
 
| width="40%" style="vertical-align:top" |
 
| width="40%" style="vertical-align:top" |
Line 44: Line 33:
 
<div style="margin-top:0.5em; border:2px solid #00ff00; padding:0.5em 0.5em 0.5em 0.5em; background-color:#ffeeff; align:center; border:1px solid #ffccff;">
 
<div style="margin-top:0.5em; border:2px solid #00ff00; padding:0.5em 0.5em 0.5em 0.5em; background-color:#ffeeff; align:center; border:1px solid #ffccff;">
 
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;">  Featured Article </h2>
 
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;">  Featured Article </h2>
;[[Forensic Linux Live CD issues]]
+
;[[Apple File System (APFS)]]
:Forensic Linux Live CD distributions are widely used during computer forensic investigations. Currently, many vendors of such Live CD distributions state that their Linux do not modify the contents of hard drives or employ "write protection." Testing indicates that this may not always be the case. [[Forensic Linux Live CD issues|Read More...]]
+
: APFS, or Apple File System, is the file system designed by Apple Computer to supersede HFS+ and take advantage of flash/SSD storage and native encryption support. APFS also introduced file system snapshots, support for sparse files, and greater time stamp granularity.
 +
[[Apple File System (APFS)|Read More...]]
  
 
|}
 
|}
 
  
 
<!-- This begins the two-column section -->
 
<!-- This begins the two-column section -->
Line 99: Line 88:
 
* '''[[Tools:Network_Forensics|Network Forensics]]''': [[Snort]],  [[Wireshark]], [[Kismet]],  [[NetworkMiner]]...
 
* '''[[Tools:Network_Forensics|Network Forensics]]''': [[Snort]],  [[Wireshark]], [[Kismet]],  [[NetworkMiner]]...
 
* '''[[:Category:Anti-forensics tools|Anti-Forensics]]''': [[Slacker]], [[Timestomp]], [[wipe]], [[shred]], ...
 
* '''[[:Category:Anti-forensics tools|Anti-Forensics]]''': [[Slacker]], [[Timestomp]], [[wipe]], [[shred]], ...
* '''[[Tools#Other_Tools|Other Tools]]''': [[biew]], [[hexdump]], ...
+
* '''[[Tools#Other_Tools|Other Tools]]''': [[biew]], [[hexdump]], [[MailXaminer]]...
 
</div>
 
</div>
  

Latest revision as of 19:06, 30 October 2017

This is the Forensics Wiki, a Creative Commons-licensed wiki devoted to information about digital forensics (also known as computer forensics). We currently list a total of 861 pages.

Much of computer forensics is focused on the tools and techniques used by investigators, but there are also a number of important papers, people, and organizations involved. Many of those organizations sponsor conferences throughout the year and around the world. You may also wish to examine the popular journals and some special reports.


WIKI NEWS

2016-03-30: Site Maintenance on 2016-04-01 Attention Forensic Wiki community, site maintenance will be occurring on 1 April 2016 from 9AM EST to 1PM EST. During this time Forensic Wiki will not be available as it will be offline to perform environment upgrades.

2015-08-26: – A support email address (support AT forensicswiki.org) was created for all your forensicswiki needs. This is a mailing list that goes to the appropriate staff that will assist with site maintenance, issues, etc. If you have questions or issues with the site please send us an email.

2015-07-18: Forensic Wiki has been acquired by Harris Corporation for the betterment of the community. All licensing and data rights are staying the same, there’s just corporate funding behind the site now. The wiki will remain as an international resource, with no editorial input from Harris whatsoever. All of the existing editorial controls and checks and balances will remain in place. All of the existing accounts carry forward.

2013-05-15: You can now subscribe to Forensics Wiki Recent Changes with the ForensicsWiki FeedBurner Feed

Featured Forensic Challenge

Digital Forensic Research Workshop

The current Digital Forensic Research Workshop (DFRWS) is about the Internet of Things (IoT). Analysis of devices and network data including a Smart TV Raspberry Pi and Amazon Echo cloud data are part of the scenario.

See more about DFRWS here... (See also Past Selected Research)

Featured Article

Apple File System (APFS)
APFS, or Apple File System, is the file system designed by Apple Computer to supersede HFS+ and take advantage of flash/SSD storage and native encryption support. APFS also introduced file system snapshots, support for sparse files, and greater time stamp granularity.
Read More...


Topics



You can help! We have a list of articles that need to be expanded. If you know anything about any of these topics, please feel free to chip in.