Forensics Wiki - User contributions [en]

Forensic corpora

2012-05-31T02:59:37Z

Rmislan: This resource has left Purdue.

This page describes large-scale corpora of forensically interesting information that are available for those involved in forensic research.

= Disk Images =

;The Real Data Corpus.
: Between 1998 and 2006, [[Simson Garfinkel|Garfinkel]] acquired 1250+ hard drives on the secondary market. These hard drive images have proven invaluable in performing a range of studies such as the developing of new forensic techniques and the sanitization practices of computer users.

: Garfinkel, S. and Shelat, A., [http://www.simson.net/clips/academic/2003.IEEE.DiskDriveForensics.pdf "Remembrance of Data Passed: A Study of Disk Sanitization Practices,"] IEEE Security and Privacy, January/February 2003.

;The Honeynet Project Forensic Challenge.
: In 2001 the Honeynet project distributed a set of disk images and asked participants to conduct a forensic analysis of a compromised computer. Entries were judged and posted for all to see. The drive and writeups are still available online.
: http://www.honeynet.org/challenge/index.html
: Other challenges were released in 2010 and 2011, and two contained partial disk images.
: [https://www.honeynet.org/challenges/2011_7_compromised_server Challenge 7: Compromised Server]
: [https://www.honeynet.org/node/751 Challenge 9: Mobile Malware]

;Honeynet Project Scans of the Month
: The Honeynet Project provided network scans in the majority of its Scan of the Month challenges. Some of the challenges provided disk images instead. The Sleuth Kit's Wiki lists Brian Carrier's responses to those challenges.
: http://wiki.sleuthkit.org/index.php?title=Case_Studies

;The [http://www.cfreds.nist.gov/ Computer Forensic Reference Data Sets] project from [[National Institute of Standards and Technology|NIST]] hosts a few sample cases that may be useful for examiners to practice with:
: http://www.cfreds.nist.gov/Hacking_Case.html

; Digital Forensics Tool Testing Images can be downloaded from Sourceforge
: http://dftt.sourceforge.net/

; Shortinfosec: computer forensics competition
: http://www.shortinfosec.net/2008/07/competition-computer-forensic.html
: In the competition, you will have to analyze a submitted disk image for incriminating evidence.
: (Note: Unfortunately, when checked in October, 2011, the disk image seemed unavailable.)

; Lance Mueller has created some disk images; they can be downloaded from his blog
: http://www.forensickb.com/search?q=practical

;The PyFlag standard test image set
: http://pyflag.sourceforge.net/Documentation/tutorials/howtos/test_image.html

;The Digital Forensic Research Workshop's Rodeos and Challenges
: Several of the Rodeos and Challenges from DFRWS released their data and scenario writeups. The following had disk images as parts of their scenario:
* [http://www.cfreds.nist.gov/dfrws/Rhino_Hunt.html 2005 Rodeo] (Hosted on CFReDS)
* [http://dfrws.org/2008/rodeo.shtml 2008 Rodeo]
* [http://dfrws.org/2009/rodeo.shtml 2009 Rodeo]
* [http://dfrws.org/2009/challenge/index.shtml 2009 Challenge]
* [http://dfrws.org/2011/challenge/index.shtml 2011 Challenge]

= Memory Images =

The [https://www.volatilesystems.com/default/volatility Volatility] FAQ provides a listing of openly-available [https://code.google.com/p/volatility/wiki/FAQ#Are_there_any_public_memory_samples_available_that_I_can_use_for memory images].

= Network Packets and Traces =

== DARPA ID Eval ==

''The DARPA Intrusion Detection Evaluation.'' In 1998, 1999 and 2000 the Information Systems Technology Group at MIT Lincoln Laboratory created a test network complete with simulated servers, clients, clerical workers, programmers, and system managers. Baseline traffic was collected. The systems on the network were then “attacked” by simulated hackers. Some of the attacks were well-known at the time, while others were developed for the purpose of the evaluation.

* [http://www.ll.mit.edu/IST/ideval/data/1998/1998_data_index.html 1998 DARPA Intrusion Detection Evaluation]
* [http://www.ll.mit.edu/IST/ideval/data/1999/1999_data_index.html 1999 DARPA Intrusion Detection Evaluation]
* [http://www.ll.mit.edu/IST/ideval/data/2000/2000_data_index.html 2000 DARPA Intrusion Detection Scenario Specific]

== WIDE==
''The [http://www.wide.ad.jp/project/wg/mawi.html MAWI Working Group] of the [http://www.wide.ad.jp/ WIDE Project]'' maintains a [http://tracer.csl.sony.co.jp/mawi/ Traffic Archive]. In it you will find:
* daily trace of a trans-Pacific T1 line;
* daily trace at an IPv6 line connected to 6Bone;
* daily trace at another trans-Pacific line (100Mbps link) in operation since 2006/07/01.

Traffic traces are made by tcpdump, and then, IP addresses in the traces are scrambled by a modified version of [[tcpdpriv]].

==Wireshark==
The open source Wireshark project (formerly known as Ethereal) has a website with many network packet captures:
* http://wiki.wireshark.org/SampleCaptures

==NFS Packets==
The Storage Networking Industry Association has a set of network file system traces that can be downloaded from:
* http://iotta.snia.org/traces
* http://tesla.hpl.hp.com/public_software/

=Email messages=

''The Enron Corpus'' of email messages that were seized by the Federal Energy Regulatory Commission during its investigation of Enron.

* http://www.cs.cmu.edu/~enron
* http://www.enronemail.com/

The NIST '''TextREtrieval Conference 2007''' has released a public Spam corpus:
* http://plg.uwaterloo.ca/~gvcormac/spam/

Email Messages Corpus Parsed from W3C Lists (for TRECENT 2005)
* http://tides.umiacs.umd.edu/webtrec/trecent/parsed_w3c_corpus.html

=Text Files=

==Log files==
[http://crawdad.cs.dartmouth.edu/index.php CRAWDAD] is a community archive for wireless data.

[http://www.caida.org/data/ CAIDA] collects a wide variety of data.

[http://www.dshield.org/howto.html DShield] asks users to submit firewall logs.

==Text for Text Retrieval==
The [http://trec.nist.gov Text REtrieval Conference (TREC)] has made available a series of [http://trec.nist.gov/data.html text collections].

==American National Corpus==
The [http://www.americannationalcorpus.org/ American National Corpus (ANC) project] is creating a massive collection of American english from 1990 onward. The goal is to create a corpus of at least 100 million words that is comparable to the British National Corpus.

==British National Corpus==
The [http://www.natcorp.ox.ac.uk/ British National Corpus (100)] is a 100 million word collection of written and spoken english from a variety of sources.

==IEEE VAST Challenges==
IEEE Visual Analytics Science & Technology Challenges
* [http://hcil.cs.umd.edu/localphp/hcil/vast/index.php 2009 Challenge]
* [http://hcil.cs.umd.edu/localphp/hcil/vast10/index.php 2010 Challenge]
* [http://hcil.cs.umd.edu/localphp/hcil/vast11/ 2011 Challenge]

=Images=
; [http://www.cs.washington.edu/research/imagedatabase] UW Image Database
: A set of freely redistributable images from all over the world, used for content-based image retrieval.

=Voice=
==CALLFRIEND==
CALLFRIEND is a database of recorded English conversations. A total of 60 recorded conversations are available from the University of Pennsylvania at a cost of $600.

==TalkBank==
TalkBank in an online database of spoken language. The project was originally funded between 1999 and 2004 by two National Science Foundation grants; ongoing support is provided by two NSF grants and one NIH grant.

==Augmented Multi-Party Interaction Corpus==
The [http://corpus.amiproject.org/ AMI Meeting Corpus] has 100 hours of meeting recordings.

==Other Corpora==
* Under an NSF grant, Kam Woods and [[Simson Garfinkel]] created a website for digital corpora [http://digitalcorpora.org]. The site includes a complete training scenario, including disk images, packet captures and exercises.

* The [http://corpus.canterbury.ac.nz/ Canterbury Corpus] is a set of files used for testing lossless compression algorithms. The corpus consists of 11 natural files, 4 artificial files, 3 large files, and a file with the first million digits of pi. You can also find a copyof the Calgaruy Corpus at the website, which was the defacto standard for testing lossless compression algorithms in the 1990s.

* The [http://traces.cs.umass.edu/index.php/Main/HomePage UMass Trace Repository] provides network, storage, and other traces to the research community for analysis. The UMass Trace Repository is supported by grant #CNS-323597 from the National Science Foundation.

* [http://arstechnica.com/science/news/2009/02/aaas-60tb-of-behavioral-data-the-everquest-2-server-logs.ars Sony has made 60TB of Everquest 2 logs available to researchers.] What's there? "everything."

SimCardPurdue

2012-05-31T02:58:10Z

Rmislan: This has been removed from Purdue

AT Commands

2012-02-09T04:10:46Z

Rmislan: /* Reference Links */

<ul><li>AT and AT+ commands can be used to manually collect simple information. This is an ideal choice for "full control" over the communications that are sent and returned from the phone. These can also be used when there is no tool available to communicate with the phone. These commands were tested using a Motorola v551 GSM phone using Bluetooth and USB data cables. It is important to note that not all of these commands are supported by all phones, but the AT+CLAC command (usually) displays all of the available commands the GSM phone can respond to.</li>
<li>With Motorola phones (and many others) there are '''NO''' AT commands that can be used to retrieve multimedia content. For these, OBEX commands must be issued to the phone to return directory contents, ringtones, pictures and video.</li><li>Samsung GSM phones, on the other hand, '''DO''' have AT commands that allow access to the multimedia content.</li></ul> 

To use these AT commands:
<ol><li> Connect the phone and determine the number of the COM port that is associated with it.</li>
<li>Open HyperTerminal, Realterm or any other terminal program that will communicate with a specified COM port.</li>
<li>With the Motorola phone, type '''AT+MODE=2'''. This prepares the phone for an extended AT+ command set. (+Cxxx and +MPxx)</li></ol> 
After following these steps, you can continue with any of the commands below.

== '''Phonebook''' ==
'''AT+CPBS=?''' 
Lists the phonebooks that the phone contains. (Choose phonebook storage) 
Returns: +CPBS: ("ME","SM","MT","ON","DC","MC","RC","EN","AD","QD","SD","FD") 

+CPBS="ME" sets the "retrieve mode" to the internal phonebook. 
+CPBS="SM" sets the "retrieve mode" to the SIM phonebook.

'''AT+CPBR=?''' 
Describes the phonebook selected above. (Simple) This gives the max number of entries the phone can contain. It also gives the maximum phone number (or email address) length and name length. 
'''NOTE:''' You can substitute +MPBR for any +CPBR command, but the phone returns a much more specific (and less intelligible) response containing more fields that may act as internal “programming” flags of some sort. 
Returns: +CPBR: (1-1000),40,24

'''AT+CPBR=[beginning index],[ending index]''' 
Returns a list of numbers with the index between the two numbers entered. Also denotes what TYPE of phonebook entry was selected. 
Returns: +CPBR: 9,"18005555555",129,"Contact Name" – 129 refers to a phone number. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name" – 128 refers to an email.

'''AT+CPBR=[index]''' 
Returns the specified index. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name"

'''AT+MPBF="Name"''' 
Searches the phonebook for the Name or string.

'''AT+MPBR=?''' 
Similar to above, but a more verbose result is displayed. 
Returns: +MPBR: 1-1000,40,24,8,0-1,50,(0,2,4,6,9-30,255),(0),(0-1),(1-30),(255),25,(0-1,255),264,(0),0,0,0,0,0,0,0
<ul><li>1-1000 denotes the number of entries that can be stored on the selected (+CPBS) phonebook.</li><li>40 represents the number of characters that the email or phone number can have.</li><li>24 indicates the number of characters the “friendly” name can have.</li><li>The 8 refers to the different “types” of phonebook entry (i.e. Mobile, Main, Email, Home, Fax, Work … etc).</li><li>The +CPBR command does not list anything after the 24 (as seen above), so there are times when the +MPBR may be useful.</li></ul>

'''AT+MPBR=[index]''' 
Returns: +MPBR: 18,"user@domain.net",128,"Contact Name",6,0,255,0,0,1,255,255,0,"",0,0,"","","","","","","",""

== '''SMS Messages''' ==
'''AT+CMGF=1''' 
This tells the phone to display the entries as text rather than binary. +CMFG=0 would display the data in binary format.

'''AT+CPMS=?''' 
This displays all of the locations in which the phone can save the SMS messages. 
Returns: +CPMS: ("MT","IM","OM","BM","DM"),("OM","DM"),("IM")

'''AT+CMGL=?''' 
Returns the options on which messages you wish to display. 
Returns: +CMGL: ("REC UNREAD", "REC READ", "STO UNSENT", "STO SENT", "ALL")

'''AT+CMGL="ALL"''' 
Selects and displays all of the SMS messages on the selected source.

'''AT#PMODE=1''' 
In order to retrieve text messages and other information, Samsung phones must be in this mode.

'''AT#PSRMR=?''' 
Returns the parameters to obtain text messages (Samsung). 
Returns: #PSRMR: (0-349)

== '''Misc. Information''' ==
'''AT&F''' 
Controls local echo which enables the user to see the text they are typing into HyperTerminal.

'''ATi0, ATi1, ATi2, ATi3, or ATi4''' 
Returns various specs about the phone. 
ATi0 Returns Manufacturer 
ATi1 Returns IMEI 
ATi2 Returns SW versions 
ATi3 Returns Make and Model 
ATi4 Returns HW Version 
ATi4 Returns HW Version

'''AT+FSCD="<DIR>"''' 
Changes to specific directories (Samsung) 
If your phone is English, then it will be /Picture

'''AT+FSDI="<DIR>"''' 
Returns directory information (Samsung)

'''AT+FSDL="<DIR>"''' 
Returns a list of directories (Samsung)

'''AT+FSFW=-1, "<FILENAME>", 0, "", <LEN>, <CRC>''' 
Send a file (Samsung)

'''AT+FSFE=0, "<FILENAME>"''' 
Delete a file (Samsung)

'''AT+CGSN''' 
Returns the IMEI of the phone. 
Returns: +CGSN: IMEI356252000861622 
Returns: +GSN: 299B5900 (Samsung)

'''AT+CGMR''' 
Returns the manufacturer’s OS revision. 
Returns: +CGMR: "R47_G_08.17.0FR_01"

'''AT+GMI''' 
Returns the manufacturer name (Samsung). 
Returns: +GMI: SAMSUNG

'''AT+CGMM''' 
Returns the make, model and capabilities of the phones. 
Returns: +CGMM: "GSM900","GSM1800","GSM1900","GSM850","MODEL=V551" 
Returns: +GMM: SCH-A670 (Samsung)

'''AT+CNUM''' 
Returns the subscriber name/number from the SIM, or internal memory for CDMA phones. 
Returns: +CNUM: Owner Name,15555555555,129

'''AT+CLAC''' 
Lists AT commands that the phone supports.

'''AT+MODE=22''' 
Prepares the phone (Motorola) for OBEX commands.

'''AT+MODE=0''' 
This returns the phone to simple AT command mode.

'''AT#PBDYN?''' 
This returns the phone number (Samsung).

== '''Reference Links''' ==

[http://jpirog.com/MOTO_AT_Commands_Reference.pdf Motorola AT Commands Reference]

[http://gatling.ikk.sztaki.hu/~kissg/gsm/index.html AT+C Command Set of GSM]

[http://www.traud.de/gsm/atex.htm Alexander Traud's GSM pages ]

[http://www.anotherurl.com/library/at_test.htm AT Test Commands]

[http://www.csparks.com/MotoBackup/MotorolaAT.xhtml AT Commands to Access the Motorola]

[http://wammu.eu/docs/manual/protocol/index.html Gammu Phone Protocols]

[http://webapp.etsi.org/key/key.asp?GSMSpecPart1=27&GSMSpecPart2=007 ETSI-3GPP Standards]

[http://wiki.forum.nokia.com/index.php/AT_Commands Nokia AT Commands]

[http://www.parallax.com/Portals/0/Education/custapps/Nokia_AThelp.pdf Support Guide for the Nokia Phones and AT Commands]

[http://www.daimi.au.dk/~jones/sms/packed/Nokia_30_AT_Command_Guide_2_0.pdf Nokia 30 GSM Connectivity Terminal AT Command Guide]

[http://nds1.nokia.com/phones/files/guides/at_commands.pdf Nokia PremiCell List of AT Commands]

[http://webpages.charter.net/hideo_a310/downs/TechNotes/a310_atcommands.txt Samsung AT Commands]

[http://ns.gentoogeek.org/portage-overlay/app-mobilephone/bitpim/bitpim-1.0.7/examples/vga1000notes.txt More Samsung AT Commands]

[http://gatling.ikk.sztaki.hu/~kissg/gsm/atscan/unprocessed/SamsungS105v1_6h.txt Even more Samsung AT Commands]

AT Commands

2012-02-09T04:08:59Z

Rmislan: /* Reference Links */

<ul><li>AT and AT+ commands can be used to manually collect simple information. This is an ideal choice for "full control" over the communications that are sent and returned from the phone. These can also be used when there is no tool available to communicate with the phone. These commands were tested using a Motorola v551 GSM phone using Bluetooth and USB data cables. It is important to note that not all of these commands are supported by all phones, but the AT+CLAC command (usually) displays all of the available commands the GSM phone can respond to.</li>
<li>With Motorola phones (and many others) there are '''NO''' AT commands that can be used to retrieve multimedia content. For these, OBEX commands must be issued to the phone to return directory contents, ringtones, pictures and video.</li><li>Samsung GSM phones, on the other hand, '''DO''' have AT commands that allow access to the multimedia content.</li></ul> 

To use these AT commands:
<ol><li> Connect the phone and determine the number of the COM port that is associated with it.</li>
<li>Open HyperTerminal, Realterm or any other terminal program that will communicate with a specified COM port.</li>
<li>With the Motorola phone, type '''AT+MODE=2'''. This prepares the phone for an extended AT+ command set. (+Cxxx and +MPxx)</li></ol> 
After following these steps, you can continue with any of the commands below.

== '''Phonebook''' ==
'''AT+CPBS=?''' 
Lists the phonebooks that the phone contains. (Choose phonebook storage) 
Returns: +CPBS: ("ME","SM","MT","ON","DC","MC","RC","EN","AD","QD","SD","FD") 

+CPBS="ME" sets the "retrieve mode" to the internal phonebook. 
+CPBS="SM" sets the "retrieve mode" to the SIM phonebook.

'''AT+CPBR=?''' 
Describes the phonebook selected above. (Simple) This gives the max number of entries the phone can contain. It also gives the maximum phone number (or email address) length and name length. 
'''NOTE:''' You can substitute +MPBR for any +CPBR command, but the phone returns a much more specific (and less intelligible) response containing more fields that may act as internal “programming” flags of some sort. 
Returns: +CPBR: (1-1000),40,24

'''AT+CPBR=[beginning index],[ending index]''' 
Returns a list of numbers with the index between the two numbers entered. Also denotes what TYPE of phonebook entry was selected. 
Returns: +CPBR: 9,"18005555555",129,"Contact Name" – 129 refers to a phone number. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name" – 128 refers to an email.

'''AT+CPBR=[index]''' 
Returns the specified index. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name"

'''AT+MPBF="Name"''' 
Searches the phonebook for the Name or string.

'''AT+MPBR=?''' 
Similar to above, but a more verbose result is displayed. 
Returns: +MPBR: 1-1000,40,24,8,0-1,50,(0,2,4,6,9-30,255),(0),(0-1),(1-30),(255),25,(0-1,255),264,(0),0,0,0,0,0,0,0
<ul><li>1-1000 denotes the number of entries that can be stored on the selected (+CPBS) phonebook.</li><li>40 represents the number of characters that the email or phone number can have.</li><li>24 indicates the number of characters the “friendly” name can have.</li><li>The 8 refers to the different “types” of phonebook entry (i.e. Mobile, Main, Email, Home, Fax, Work … etc).</li><li>The +CPBR command does not list anything after the 24 (as seen above), so there are times when the +MPBR may be useful.</li></ul>

'''AT+MPBR=[index]''' 
Returns: +MPBR: 18,"user@domain.net",128,"Contact Name",6,0,255,0,0,1,255,255,0,"",0,0,"","","","","","","",""

== '''SMS Messages''' ==
'''AT+CMGF=1''' 
This tells the phone to display the entries as text rather than binary. +CMFG=0 would display the data in binary format.

'''AT+CPMS=?''' 
This displays all of the locations in which the phone can save the SMS messages. 
Returns: +CPMS: ("MT","IM","OM","BM","DM"),("OM","DM"),("IM")

'''AT+CMGL=?''' 
Returns the options on which messages you wish to display. 
Returns: +CMGL: ("REC UNREAD", "REC READ", "STO UNSENT", "STO SENT", "ALL")

'''AT+CMGL="ALL"''' 
Selects and displays all of the SMS messages on the selected source.

'''AT#PMODE=1''' 
In order to retrieve text messages and other information, Samsung phones must be in this mode.

'''AT#PSRMR=?''' 
Returns the parameters to obtain text messages (Samsung). 
Returns: #PSRMR: (0-349)

== '''Misc. Information''' ==
'''AT&F''' 
Controls local echo which enables the user to see the text they are typing into HyperTerminal.

'''ATi0, ATi1, ATi2, ATi3, or ATi4''' 
Returns various specs about the phone. 
ATi0 Returns Manufacturer 
ATi1 Returns IMEI 
ATi2 Returns SW versions 
ATi3 Returns Make and Model 
ATi4 Returns HW Version 
ATi4 Returns HW Version

'''AT+FSCD="<DIR>"''' 
Changes to specific directories (Samsung) 
If your phone is English, then it will be /Picture

'''AT+FSDI="<DIR>"''' 
Returns directory information (Samsung)

'''AT+FSDL="<DIR>"''' 
Returns a list of directories (Samsung)

'''AT+FSFW=-1, "<FILENAME>", 0, "", <LEN>, <CRC>''' 
Send a file (Samsung)

'''AT+FSFE=0, "<FILENAME>"''' 
Delete a file (Samsung)

'''AT+CGSN''' 
Returns the IMEI of the phone. 
Returns: +CGSN: IMEI356252000861622 
Returns: +GSN: 299B5900 (Samsung)

'''AT+CGMR''' 
Returns the manufacturer’s OS revision. 
Returns: +CGMR: "R47_G_08.17.0FR_01"

'''AT+GMI''' 
Returns the manufacturer name (Samsung). 
Returns: +GMI: SAMSUNG

'''AT+CGMM''' 
Returns the make, model and capabilities of the phones. 
Returns: +CGMM: "GSM900","GSM1800","GSM1900","GSM850","MODEL=V551" 
Returns: +GMM: SCH-A670 (Samsung)

'''AT+CNUM''' 
Returns the subscriber name/number from the SIM, or internal memory for CDMA phones. 
Returns: +CNUM: Owner Name,15555555555,129

'''AT+CLAC''' 
Lists AT commands that the phone supports.

'''AT+MODE=22''' 
Prepares the phone (Motorola) for OBEX commands.

'''AT+MODE=0''' 
This returns the phone to simple AT command mode.

'''AT#PBDYN?''' 
This returns the phone number (Samsung).

== '''Reference Links''' ==

[http://jpirog.com/MOTO_AT_Commands_Reference.pdf Motorola AT Commands Reference]

[http://gatling.ikk.sztaki.hu/~kissg/gsm/index.html AT+C Command Set of GSM]

[http://www.traud.de/gsm/atex.htm Alexander Traud's GSM pages ]

[http://www.anotherurl.com/library/at_test.htm AT Test Commands]

[http://www.csparks.com/MotoBackup/MotorolaAT.xhtml AT Commands to Access the Motorola]

[http://webapp.etsi.org/key/key.asp?GSMSpecPart1=27&GSMSpecPart2=007 ETSI-3GPP Standards]

[http://wiki.forum.nokia.com/index.php/AT_Commands Nokia AT Commands]

[http://www.parallax.com/Portals/0/Education/custapps/Nokia_AThelp.pdf Support Guide for the Nokia Phones and AT Commands]

[http://www.daimi.au.dk/~jones/sms/packed/Nokia_30_AT_Command_Guide_2_0.pdf Nokia 30 GSM Connectivity Terminal AT Command Guide]

[http://nds1.nokia.com/phones/files/guides/at_commands.pdf Nokia PremiCell List of AT Commands]

[http://webpages.charter.net/hideo_a310/downs/TechNotes/a310_atcommands.txt Samsung AT Commands]

[http://ns.gentoogeek.org/portage-overlay/app-mobilephone/bitpim/bitpim-1.0.7/examples/vga1000notes.txt More Samsung AT Commands]

Forensic Training

2012-01-12T04:05:24Z

Rmislan:

This page lists vendors that offer various kinds of forensic training.

== Open for everyone ==
* [http://www.accessdata.com/training/ AccessData Training]
* [http://www.forensics-intl.com/training.html Armor Forensics (NTI - Forensics International)]
* [http://www.asrdata.com/training/ ASR Data Training]
* [http://www.blackbagtech.com/training.html BlackBag Tech Training]
* [http://www.cce-bootcamp.com/ Certified Computer Examiner BootCamp]
* [http://www.sarc-wv.com/training.aspx Certified Steganography Examiner Training]
* [http://www.cprtools.net/training.php CPR Tools Training (Basic and Advanced Data Recovery)]
* [http://www.cftco.com/ Computer Forensics Training Center On-Line]
* [http://www.e-fense.com/training.html e-fense Inc]
* [http://www.nuix.com.au/screencasts.html FBI Screencast Training]
* [http://www.for-sec.com/p38.htm For-Sec Vendor classes, Cellphone/PDA seizure, and CFR 26 rules classes]
* [http://www.guidancesoftware.com/training/index.aspx Guidance Software (EnCase) Training]
* [http://www.infosecinstitute.com/courses/security_training_courses.html InfoSec Institute]
* [http://www.crazytrain.com/training.html Linux Data Forensics Training]
* [http://www.maresware.com/maresware/training/maresware.htm Maresware Training]
* [http://www.mobileforensicstraining.com Mobile Forensics Training (Mobile Forensics Inc. Training)]
* [http://www.paraben-training.com/ Paraben Forensics Training]
* [http://www.sarc-wv.com/training.aspx Steganography Analysis and Research Center / Backbone Security]
* [http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Smart Phone Forensics)]
* [http://www.techpathways.com/DesktopDefault.aspx?tabindex=5&tabid=9 Technology Pathways Pro Discover Training]
* [http://www.vigilar.com/training.html Vigilar]
* [https://www.wetstonetech.com/trainings.html WetStone Technologies Investigator Training]
* [http://netsecurity.com/forensics/digital_computer_forensics_training.html NetSecurity Hands-On How-To Training Courses]

== Law enforcement only ==

* [http://www.fletc.gov/cfi/fy06tibsched.htm Federal Law Enforcement Training Center]
* [http://www.cops.org/ IACIS Computer Training/Certification]
* [http://nw3c.org/ocr/courses_desc.cfm National White Collar Crime Center]
* [http://www.search.org/programs/hightech/courses.asp Search.Org]

Tools

2010-11-02T01:44:29Z

Rmislan: /* Other Tools */

This is an '''overview of available tools''' for forensic [[investigator]]s. Please click on the name of any tool for more details.

'''Note: This page has gotten too big and is being broken up. See:'''

* [[:Category:Disk Imaging]]
* [[Tools:Data Recovery]] (including file [[carving]])
* [[Tools:File Analysis]]
* [[Tools:Document Metadata Extraction]]
* [[Tools:Memory Imaging]]
* [[Tools:Network Forensics]]
* [[Tools:Logfile Analysis]]
* [[:Category:Anti-forensics tools]]
* [[:Category:Secure deletion]]

= Disk Analysis Tools =
== Hard Drive Firmware and Diagnostics Tools ==
; [[PC-3000]] from [[DeepSpar Data Recovery Systems]]
: http://www.deepspar.com/products-pc-3000-drive.html
: http://www.pc-3000.com/

== Linux-based Tools ==
; [[LINReS]] by [[NII Consulting Pvt. Ltd.]]
: http://www.niiconsulting.com/innovation/linres.html

; [[SMART]] by [[ASR Data]]
: http://www.asrdata.com

== Macintosh-based Tools ==

; [[Macintosh Forensic Software]] by [[BlackBag Technologies, Inc.]]
: http://www.blackbagtech.com/software_mfs.html

; [[MacForensicsLab]] by [[Subrosasoft]]
: [http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=39&products_id=114 MacForensicLab-Subrosasoft]

; [[Mac Marshal]] by [[ATC-NY]]
: http://www.macmarshal.com/

== Windows-based Tools ==

; [[Blackthorn GPS Forensics]]
: http://www.blackthorngps.com

; [[BringBack]] by [[Tech Assist, Inc.]]
: http://www.toolsthatwork.com/bringback.htm

; [[EMail Detective - Forensic Software Tool]] by [[Hot Pepper Technology, Inc]]
; http://www.hotpepperinc.com/emd

; [[EnCase]] by [[Guidance Software]]
: http://www.guidancesoftware.com/

; [[fbi (tool)|fbi]] by [[Nuix Pty Ltd]]
: http://www.nuix.com

; [[Forensic Toolkit]] ([[FTK]]) by [[AccessData]]
: http://www.accessdata.com/products/ftk/

; [[HBGary Responder Professional]] - Windows Physical Memory Forensic Platform
:http://www.hbgary.com

; [[ILook Investigator]] by [[Elliot Spencer]] and [[Internal Revenue Service|U.S. Dept of Treasury, Internal Revenue Service - Criminal Investigation]] (IRS)
: http://www.ilook-forensics.org/

; [[Mercury Indexer]] by [[MicroForensics, Inc.]]
: http://www.MicroForensics.com/

; [[OnLineDFS]] by [[Cyber Security Technologies]]
: http://www.cyberstc.com/

; [[P2 Power Pack]] by [[Paraben]]
: https://www.paraben-forensics.com/catalog/product_info.php?cPath=25&products_id=187

; [[Prodiscover]] by [[Techpathways]]
: http://www.techpathways.com/ProDiscoverWindows.htm

; [[Safeback]] by [[NTI]] and [[Armor Forensics]]
: http://www.forensics-intl.com/safeback.html

; [[X-Ways Forensics]] by [[X-Ways AG]]
: http://www.x-ways.net/forensics/index-m.html

; [[DateDecoder]] by [[Live-Forensics]]
: http://www.live-forensics.com/dl/DateDecoder.zip
: A command line tool that decodes most encoded time/date stamps found on a windows system, and outputs the time/date in a human readable format.

; [[RecycleReader]] by [[Live-Forensics]]
: http://www.live-forensics.com/dl/RecycleReader.zip
: A command line tool that outputs the contents of the recycle bin on XP, Vista and Seven.

== Open Source Tools ==

; [[AFFLIB]]
: A library for working with [[disk image]]s. Currently AFFLIB supports raw, [[AFF]], [[AFD]], and [[EnCase]] file formats. Work to support segmented raw, [[iLook]], and other formats is ongoing.

; [[Autopsy]]
: http://www.sleuthkit.org/autopsy/desc.php

; [[Digital Forensics Framework]] (DFF)
: DFF is cross-platform and open-source, user and developers oriented. It provide many features and is very modular. Our goal is to provide a powerful framework to the forensic community, so people can use only one tool during the analysis. http://www.digital-forensic.org

; [[foremost]]
: http://foremost.sf.net/
: [[Linux]] based file carving program

; [[FTimes]]
: http://ftimes.sourceforge.net/FTimes/index.shtml
: FTimes is a system baselining and evidence collection tool.

; [[gfzip]]
: http://www.nongnu.org/gfzip/

; [[gpart]]
: http://www.stud.uni-hannover.de/user/76201/gpart/
: Tries to ''guess the primary partition table of a PC-type hard disk in case the primary partition table in sector 0 is damaged, incorrect or deleted''.

; [[Hachoir]]
: A generic framework for binary file manipulation, it supports [[FAT12]], [[FAT16]], [[FAT32]], [[ext2|ext2/ext3]], Linux swap, MSDOS partition header, etc. Recognize file type. Able to find subfiles (hachoir-subfile).

; [[magicrescue]]
: http://jbj.rapanden.dk/magicrescue/

; The [[Open Computer Forensics Architecture]]
: http://ocfa.sourceforge.net/

; [[pyflag]]
: http://www.pyflag.net/PyFlagWiki/
: Web-based, database-backed forensic and log analysis GUI written in Python.

; [[Scalpel]]
: http://www.digitalforensicssolutions.com/Scalpel/
: [[Linux]] and [[Windows]] file carving program originally based on [[foremost]].

; [[scrounge-ntfs]]
: http://memberwebs.com/nielsen/software/scrounge/

; [[Sleuthkit]]
: http://www.sleuthkit.org/

; [[The Coroner's Toolkit]] ([[TCT]])
: http://www.porcupine.org/forensics/tct.html

== [[NDA]] and [[scoped distribution]] tools ==

= Enterprise Tools (Proactive Forensics)=

; [[LiveWire Investigator 2008]] by [[WetStone Technologies]]
: http://www.wetstonetech.com/f/livewire2008.html

; [[P2 Enterprise Edition]] by [[Paraben]]
: http://www.paraben-forensics.com/enterprise_forensics.html

= Forensics Live CDs =

; [[BackTrack]]
: A [[Live CD]] built on top of [[Ubuntu]] (early version are built on top of [[Slackware]]). Latest "pre-release" has "forensics mode".
: http://remote-exploit.org/backtrack.html

; [[CAINE Live CD]]
: A forensic [[Live CD]] built on top of [[Ubuntu]].
: http://caine-live.net

; [[DEFT Linux]]
: A Live CD built on top of [[Xubuntu]] with the best tools for computer forensics and incident response.
: It's a very light and fast live system created for the Computer Forensics specialists.
: The first live CD with [[AFF]], dhash and [[Xplico]].
: http://www.deftlinux.net

; [[THE FARMER'S BOOT CD]]
: A [[Linux]] [[Live CD]], designed and optimized for previewing data in a [[forensically sound]] manner. It contains a number of programs forensic practitioners can utilize to preview both [[Windows]] and [[Linux]] systems.

; [[FCCU Gnu/Linux Boot CD]]
: A [[Live CD]] built on top of [[Debian Live]] with a lot of tools with forensic purpose.
: http://www.lnx4n6.be

; [[grml]]
: A forensic [[Live CD]] built on top of [[Debian]].
: http://grml.org

; [[Helix3]] ([[Helix3 Pro]])
: A [[Live CD]] built on top of [[Ubuntu]] with special tools for [[Incident Response|incident response]] and electronic discovery.
: http://e-fense.com

; [[MacQuisition Boot CD]]
: A forensic [[Live CD]] built for imaging [[Macintosh]] systems.

; [[Masterkey Linux]]
: A [[Linux]] [[Live CD]] built on top of [[Slackware]] featuring a wide variety of free and open source tools, focused on both Incident Response and Computer Forensic Examination.
: http://masterkeylinux.com

; [[PlainSight]]
: A forensic [[Live CD]] built on top of [[Knoppix]].
: http://www.plainsight.info

; [[Recovery Is Possible]]
: A [[Linux]] [[Live CD]] with a number of recovery applications such as [[TestDisk]], [[PhotoRec]], etc.
: http://www.tux.org/pub/people/kent-robotti/looplinux/rip/

; [[SAFE Boot Disk]]
: The first and only commercially available forensically sound Windows Boot disk.
: Includes built-in driver support, access to the NTFS file system and built-in software write blocking.
: http://www.forensicsoft.com/catalog/product.php

; [[SMART Linux]]
: Two [[Live CD | Live CDs]] built on top of [[Slackware]] and [[Ubuntu]]. Includes [[SMART]] and other forensic tools.
: http://asrdata2.com

; [[SPADA]]
: A forensic [[Live CD]] built on top of [[Knoppix]].
: http://spada-cd.info

== Out of date Live CDs ==

; [[Knoppix STD]]
: A [[Live CD]] built on top of [[Knoppix]].
: http://s-t-d.org/

; [[Penguin Sleuthkit]]
: A Linux [[Live CD]] that includes SleuthKit.
: http://penguinsleuth.org/

; [[SNARL]]
: A FreeBSD based forensics Bootable ISO (includes Autopsy and Sleuth Kit).
: http://sourceforge.net/projects/snarl/

= Personal Digital Device Tools=

== GPS Forensics ==

; [[Blackthorn GPS Forensics]]

== PDA Forensics ==
; [[Cellebrite UFED]]
; [[Paraben PDA Seizure]]
; [[Paraben PDA Seizure Toolbox]]
; [[PDD]]

== Cell Phone Forensics ==
; [[BitPIM]]
; [[Cellebrite UFED]]
; [[DataPilot Secure View]]
; [[GSM .XRY]]
; [[Fernico ZRT]]
; [[ForensicMobile]]
; [[LogiCube CellDEK]]
; [[MOBILedit!]]
; [[Oxygen Forensic Suite 2010]]
: http://www.oxygen-forensic.com
; [[Paraben's Device Seizure]] and [[Paraben's Device Seizure Toolbox]]
: http://www.paraben-forensics.com/handheld_forensics.html
; [[Serial Port Monitoring]]
; [[TULP2G]]

== SIM Card Forensics ==
; [[Cellebrite UFED]]
; [[ForensicSIM]]
; [[Paraben's SIM Card Seizure]]
: http://www.paraben-forensics.com/handheld_forensics.html
; [[SIMCon]]

== Preservation Tools ==
; [[Paraben StrongHold Bag]]
; [[Paraben StrongHold Tent]]

= Other Tools =
; Chat Sniper
: http://www.alexbarnett.com/chatsniper.htm
: A forensic software tool designed to simplify the process of on-scene evidence acquisition and analysis of logs and data left by the use of AOL, MSN (Live), or Yahoo instant messenger.

; Computer Forensics Toolkit
: http://computer-forensics.privacyresources.org
: This is a collection of resources, most of which are informational, designed specifically to guide the beginner, often in a procedural sense.

; Live View
: http://liveview.sourceforge.net/
: Live View is a graphical forensics tool that creates a [[VMware]] [[virtual machine]] out of a dd disk image or physical disk.

; Parallels VM
: http://www.parallels.com/
: http://en.wikipedia.org/wiki/Parallels_Workstation

; Microsoft Virtual PC
: http://www.microsoft.com/windows/products/winfamily/virtualpc/default.mspx
: http://en.wikipedia.org/wiki/Virtual_PC

; [[VMware]] Player
: http://www.vmware.com/products/player/
: http://en.wikipedia.org/wiki/VMware#VMware_Workstation
: A free player for [[VMware]] [[virtual machine]]s that will allow them to "play" on either [[Windows]] or [[Linux]]-based systems.

; [[VMware]] Server
: http://www.vmware.com/products/server/
: The free server product, for setting up/configuring/running [[VMware]] [[virtual machine]].Important difference being that it can run 'headless', i.e. everything in background.

; Webtracer
: http://www.forensictracer.com
: Software for forensic analysis of internet resources (IP address, e-mail address, domain name, URL, e-mail headers, log files...)

== Hex Editors ==

; [[biew]]
: http://biew.sourceforge.net/en/biew.html

; [[Okteta]]
: KDE's new cross-platform hex editor with features such as signature-matching
: http://utils.kde.org/projects/okteta/

; [[hexdump]]
: ...

; [[HexFiend]]
: A hex editor for Apple OS X
: http://ridiculousfish.com/hexfiend/

; [[Hex Workshop]]
: A hex editor from [[BreakPoint Software, Inc.]]
: http://www.bpsoft.com

; [[khexedit]]
: http://docs.kde.org/stable/en/kdeutils/khexedit/index.html

; [[WinHex]]
: Computer forensics software, data recovery software, hex editor, and disk editor from [[X-Ways]].
: http://www.x-ways.net/winhex

; [[xxd]]
: ...

; [[HexReader]]
: [[Live-Forensics]] software that reads windows files at specified offset and length and outputs results to the console.
: http://www.live-forensics.com/dl/HexReader.zip

= Telephone Scanners/War Dialers =

;PhoneSweep
:http://www.sandstorm.net/products/phonesweep/
:PhoneSweep is a commercial grade multi-line wardialer used by many security auditors to run telephone line scans in their organizations. PhoneSweep Gold is the distributed-access add-on for PhoneSweep, for organizations that need to run scans remotely.

Tools

2010-11-02T01:43:16Z

Rmislan: /* Hex Editors */

This is an '''overview of available tools''' for forensic [[investigator]]s. Please click on the name of any tool for more details.

'''Note: This page has gotten too big and is being broken up. See:'''

* [[:Category:Disk Imaging]]
* [[Tools:Data Recovery]] (including file [[carving]])
* [[Tools:File Analysis]]
* [[Tools:Document Metadata Extraction]]
* [[Tools:Memory Imaging]]
* [[Tools:Network Forensics]]
* [[Tools:Logfile Analysis]]
* [[:Category:Anti-forensics tools]]
* [[:Category:Secure deletion]]

= Disk Analysis Tools =
== Hard Drive Firmware and Diagnostics Tools ==
; [[PC-3000]] from [[DeepSpar Data Recovery Systems]]
: http://www.deepspar.com/products-pc-3000-drive.html
: http://www.pc-3000.com/

== Linux-based Tools ==
; [[LINReS]] by [[NII Consulting Pvt. Ltd.]]
: http://www.niiconsulting.com/innovation/linres.html

; [[SMART]] by [[ASR Data]]
: http://www.asrdata.com

== Macintosh-based Tools ==

; [[Macintosh Forensic Software]] by [[BlackBag Technologies, Inc.]]
: http://www.blackbagtech.com/software_mfs.html

; [[MacForensicsLab]] by [[Subrosasoft]]
: [http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=39&products_id=114 MacForensicLab-Subrosasoft]

; [[Mac Marshal]] by [[ATC-NY]]
: http://www.macmarshal.com/

== Windows-based Tools ==

; [[Blackthorn GPS Forensics]]
: http://www.blackthorngps.com

; [[BringBack]] by [[Tech Assist, Inc.]]
: http://www.toolsthatwork.com/bringback.htm

; [[EMail Detective - Forensic Software Tool]] by [[Hot Pepper Technology, Inc]]
; http://www.hotpepperinc.com/emd

; [[EnCase]] by [[Guidance Software]]
: http://www.guidancesoftware.com/

; [[fbi (tool)|fbi]] by [[Nuix Pty Ltd]]
: http://www.nuix.com

; [[Forensic Toolkit]] ([[FTK]]) by [[AccessData]]
: http://www.accessdata.com/products/ftk/

; [[HBGary Responder Professional]] - Windows Physical Memory Forensic Platform
:http://www.hbgary.com

; [[ILook Investigator]] by [[Elliot Spencer]] and [[Internal Revenue Service|U.S. Dept of Treasury, Internal Revenue Service - Criminal Investigation]] (IRS)
: http://www.ilook-forensics.org/

; [[Mercury Indexer]] by [[MicroForensics, Inc.]]
: http://www.MicroForensics.com/

; [[OnLineDFS]] by [[Cyber Security Technologies]]
: http://www.cyberstc.com/

; [[P2 Power Pack]] by [[Paraben]]
: https://www.paraben-forensics.com/catalog/product_info.php?cPath=25&products_id=187

; [[Prodiscover]] by [[Techpathways]]
: http://www.techpathways.com/ProDiscoverWindows.htm

; [[Safeback]] by [[NTI]] and [[Armor Forensics]]
: http://www.forensics-intl.com/safeback.html

; [[X-Ways Forensics]] by [[X-Ways AG]]
: http://www.x-ways.net/forensics/index-m.html

; [[DateDecoder]] by [[Live-Forensics]]
: http://www.live-forensics.com/dl/DateDecoder.zip
: A command line tool that decodes most encoded time/date stamps found on a windows system, and outputs the time/date in a human readable format.

; [[RecycleReader]] by [[Live-Forensics]]
: http://www.live-forensics.com/dl/RecycleReader.zip
: A command line tool that outputs the contents of the recycle bin on XP, Vista and Seven.

== Open Source Tools ==

; [[AFFLIB]]
: A library for working with [[disk image]]s. Currently AFFLIB supports raw, [[AFF]], [[AFD]], and [[EnCase]] file formats. Work to support segmented raw, [[iLook]], and other formats is ongoing.

; [[Autopsy]]
: http://www.sleuthkit.org/autopsy/desc.php

; [[Digital Forensics Framework]] (DFF)
: DFF is cross-platform and open-source, user and developers oriented. It provide many features and is very modular. Our goal is to provide a powerful framework to the forensic community, so people can use only one tool during the analysis. http://www.digital-forensic.org

; [[foremost]]
: http://foremost.sf.net/
: [[Linux]] based file carving program

; [[FTimes]]
: http://ftimes.sourceforge.net/FTimes/index.shtml
: FTimes is a system baselining and evidence collection tool.

; [[gfzip]]
: http://www.nongnu.org/gfzip/

; [[gpart]]
: http://www.stud.uni-hannover.de/user/76201/gpart/
: Tries to ''guess the primary partition table of a PC-type hard disk in case the primary partition table in sector 0 is damaged, incorrect or deleted''.

; [[Hachoir]]
: A generic framework for binary file manipulation, it supports [[FAT12]], [[FAT16]], [[FAT32]], [[ext2|ext2/ext3]], Linux swap, MSDOS partition header, etc. Recognize file type. Able to find subfiles (hachoir-subfile).

; [[magicrescue]]
: http://jbj.rapanden.dk/magicrescue/

; The [[Open Computer Forensics Architecture]]
: http://ocfa.sourceforge.net/

; [[pyflag]]
: http://www.pyflag.net/PyFlagWiki/
: Web-based, database-backed forensic and log analysis GUI written in Python.

; [[Scalpel]]
: http://www.digitalforensicssolutions.com/Scalpel/
: [[Linux]] and [[Windows]] file carving program originally based on [[foremost]].

; [[scrounge-ntfs]]
: http://memberwebs.com/nielsen/software/scrounge/

; [[Sleuthkit]]
: http://www.sleuthkit.org/

; [[The Coroner's Toolkit]] ([[TCT]])
: http://www.porcupine.org/forensics/tct.html

== [[NDA]] and [[scoped distribution]] tools ==

= Enterprise Tools (Proactive Forensics)=

; [[LiveWire Investigator 2008]] by [[WetStone Technologies]]
: http://www.wetstonetech.com/f/livewire2008.html

; [[P2 Enterprise Edition]] by [[Paraben]]
: http://www.paraben-forensics.com/enterprise_forensics.html

= Forensics Live CDs =

; [[BackTrack]]
: A [[Live CD]] built on top of [[Ubuntu]] (early version are built on top of [[Slackware]]). Latest "pre-release" has "forensics mode".
: http://remote-exploit.org/backtrack.html

; [[CAINE Live CD]]
: A forensic [[Live CD]] built on top of [[Ubuntu]].
: http://caine-live.net

; [[DEFT Linux]]
: A Live CD built on top of [[Xubuntu]] with the best tools for computer forensics and incident response.
: It's a very light and fast live system created for the Computer Forensics specialists.
: The first live CD with [[AFF]], dhash and [[Xplico]].
: http://www.deftlinux.net

; [[THE FARMER'S BOOT CD]]
: A [[Linux]] [[Live CD]], designed and optimized for previewing data in a [[forensically sound]] manner. It contains a number of programs forensic practitioners can utilize to preview both [[Windows]] and [[Linux]] systems.

; [[FCCU Gnu/Linux Boot CD]]
: A [[Live CD]] built on top of [[Debian Live]] with a lot of tools with forensic purpose.
: http://www.lnx4n6.be

; [[grml]]
: A forensic [[Live CD]] built on top of [[Debian]].
: http://grml.org

; [[Helix3]] ([[Helix3 Pro]])
: A [[Live CD]] built on top of [[Ubuntu]] with special tools for [[Incident Response|incident response]] and electronic discovery.
: http://e-fense.com

; [[MacQuisition Boot CD]]
: A forensic [[Live CD]] built for imaging [[Macintosh]] systems.

; [[Masterkey Linux]]
: A [[Linux]] [[Live CD]] built on top of [[Slackware]] featuring a wide variety of free and open source tools, focused on both Incident Response and Computer Forensic Examination.
: http://masterkeylinux.com

; [[PlainSight]]
: A forensic [[Live CD]] built on top of [[Knoppix]].
: http://www.plainsight.info

; [[Recovery Is Possible]]
: A [[Linux]] [[Live CD]] with a number of recovery applications such as [[TestDisk]], [[PhotoRec]], etc.
: http://www.tux.org/pub/people/kent-robotti/looplinux/rip/

; [[SAFE Boot Disk]]
: The first and only commercially available forensically sound Windows Boot disk.
: Includes built-in driver support, access to the NTFS file system and built-in software write blocking.
: http://www.forensicsoft.com/catalog/product.php

; [[SMART Linux]]
: Two [[Live CD | Live CDs]] built on top of [[Slackware]] and [[Ubuntu]]. Includes [[SMART]] and other forensic tools.
: http://asrdata2.com

; [[SPADA]]
: A forensic [[Live CD]] built on top of [[Knoppix]].
: http://spada-cd.info

== Out of date Live CDs ==

; [[Knoppix STD]]
: A [[Live CD]] built on top of [[Knoppix]].
: http://s-t-d.org/

; [[Penguin Sleuthkit]]
: A Linux [[Live CD]] that includes SleuthKit.
: http://penguinsleuth.org/

; [[SNARL]]
: A FreeBSD based forensics Bootable ISO (includes Autopsy and Sleuth Kit).
: http://sourceforge.net/projects/snarl/

= Personal Digital Device Tools=

== GPS Forensics ==

; [[Blackthorn GPS Forensics]]

== PDA Forensics ==
; [[Cellebrite UFED]]
; [[Paraben PDA Seizure]]
; [[Paraben PDA Seizure Toolbox]]
; [[PDD]]

== Cell Phone Forensics ==
; [[BitPIM]]
; [[Cellebrite UFED]]
; [[DataPilot Secure View]]
; [[GSM .XRY]]
; [[Fernico ZRT]]
; [[ForensicMobile]]
; [[LogiCube CellDEK]]
; [[MOBILedit!]]
; [[Oxygen Forensic Suite 2010]]
: http://www.oxygen-forensic.com
; [[Paraben's Device Seizure]] and [[Paraben's Device Seizure Toolbox]]
: http://www.paraben-forensics.com/handheld_forensics.html
; [[Serial Port Monitoring]]
; [[TULP2G]]

== SIM Card Forensics ==
; [[Cellebrite UFED]]
; [[ForensicSIM]]
; [[Paraben's SIM Card Seizure]]
: http://www.paraben-forensics.com/handheld_forensics.html
; [[SIMCon]]

== Preservation Tools ==
; [[Paraben StrongHold Bag]]
; [[Paraben StrongHold Tent]]

= Other Tools =

; Computer Forensics Toolkit
: http://computer-forensics.privacyresources.org
: This is a collection of resources, most of which are informational, designed specifically to guide the beginner, often in a procedural sense.

; Live View
: http://liveview.sourceforge.net/
: Live View is a graphical forensics tool that creates a [[VMware]] [[virtual machine]] out of a dd disk image or physical disk.

; Parallels VM
: http://www.parallels.com/
: http://en.wikipedia.org/wiki/Parallels_Workstation

; Microsoft Virtual PC
: http://www.microsoft.com/windows/products/winfamily/virtualpc/default.mspx
: http://en.wikipedia.org/wiki/Virtual_PC

; [[VMware]] Player
: http://www.vmware.com/products/player/
: http://en.wikipedia.org/wiki/VMware#VMware_Workstation
: A free player for [[VMware]] [[virtual machine]]s that will allow them to "play" on either [[Windows]] or [[Linux]]-based systems.

; [[VMware]] Server
: http://www.vmware.com/products/server/
: The free server product, for setting up/configuring/running [[VMware]] [[virtual machine]].Important difference being that it can run 'headless', i.e. everything in background.

; Webtracer
: http://www.forensictracer.com
: Software for forensic analysis of internet resources (IP address, e-mail address, domain name, URL, e-mail headers, log files...)

== Hex Editors ==

; [[biew]]
: http://biew.sourceforge.net/en/biew.html

; [[Okteta]]
: KDE's new cross-platform hex editor with features such as signature-matching
: http://utils.kde.org/projects/okteta/

; [[hexdump]]
: ...

; [[HexFiend]]
: A hex editor for Apple OS X
: http://ridiculousfish.com/hexfiend/

; [[Hex Workshop]]
: A hex editor from [[BreakPoint Software, Inc.]]
: http://www.bpsoft.com

; [[khexedit]]
: http://docs.kde.org/stable/en/kdeutils/khexedit/index.html

; [[WinHex]]
: Computer forensics software, data recovery software, hex editor, and disk editor from [[X-Ways]].
: http://www.x-ways.net/winhex

; [[xxd]]
: ...

; [[HexReader]]
: [[Live-Forensics]] software that reads windows files at specified offset and length and outputs results to the console.
: http://www.live-forensics.com/dl/HexReader.zip

= Telephone Scanners/War Dialers =

;PhoneSweep
:http://www.sandstorm.net/products/phonesweep/
:PhoneSweep is a commercial grade multi-line wardialer used by many security auditors to run telephone line scans in their organizations. PhoneSweep Gold is the distributed-access add-on for PhoneSweep, for organizations that need to run scans remotely.

Conferences

2010-01-06T03:51:43Z

Rmislan: /* Training Conferences */

This is a list of '''conferences''' in the [[computer forensics]] field, and was originally taken from [[Brian Carrier]]'s list of conferences and journals at http://www.digital-evidence.org/publish/index.html and used with his permission. Brian no longer maintains those listings and points back to this Wiki.

For Dates and Locations of upcoming conferences and training events, see the pages titled [[Upcoming events]] (Calls for papers, Conferences and On-Demand Training) and [[Scheduled Training Courses]] (Training Classes/Courses scheduled for specific dates/locations).

=Research Conferences and Workshops=

Research conferences that are related to digital investigation and forensics.

;American Academy of Forensic Science
:http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting

;Australian Digital Forensics Conference
:http://scissec.scis.ecu.edu.au/conferences2008/index.php?cf=2

;BlackHat Japan Briefings & Training
:http://japan.blackhat.com/

;BlackHat Federal Briefings & Training
:http://www.blackhat.com/html/bh-link/briefings.html

;CanSecWest
:http://cansecwest.com/

;Computer Security Institute NetSec
:http://www.gocsi.com/netsec/

;Conference on Digital Forensics, Security and Law
:http://www.digitalforensics-conference.org/

;CyberCrime Summit
:http://www.cybercrimesummit.com/index.htm

;Department of Defense CyberCrime Conference
:http://www.dodcybercrime.com/

;Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)
:http://www.gi-ev.de/fachbereiche/sicherheit/fg/sidar/dimva/

;e-Forensics
:http://www.e-forensics.eu/

;E-Crime and Computer Evidence (NOTE - Can't find any since 2006)
:http://www.ecce-conference.com

;EuSecWest
:http://eusecwest.com/

;FIRST Conference
:http://www.first.org/conference

;French-Speaking Days on Digital Investigations - Journées Francophones de l'Investigation Numérique
:http://www.afsin.org/

;IFIP International Information Security Conference
:http://sec2008.dti.unimi.it/index.php

;IFIP WG 11.9 International Conference on Digital Forensics
:http://www.ifip119.org/Conferences/

;International Conference on Availability, Reliability and Security
:http://www.ares-conference.eu/conf/

;International Conference on IT-Incident Management & IT-Forensics
:http://www.imf-conference.org

;International Symposium on Recent Advances in Intrusion Detection
:http://www.ll.mit.edu/IST/RAID2008/

;Mobile Forensics World
:http://www.MobileForensicsWorld.org/

;Open Source Software for Computer and Network Forensics
:http://conferenze.dei.polimi.it/ossconf/index.php

;Open Web Application Security Project
:http://www.owasp.org/index.php/Main_Page

;PacSec Conference
:http://pacsec.jp/

;SANS WhatWorks Summit in Forensics and Incident Response
:http://www.sans.org/forensics09_summit/index.php

;Security OPUS Information Security Conference
:http://www.securityopus.com/index.php

;Systematic Approaches to Digital Forensic Engineering (SADFE)
:http://conf.ncku.edu.tw/sadfe/

;USENIX Annual Technical Conference
:http://www.usenix.org/events/

;USENIX Security Symposium
:http://www.usenix.org/events/

;Virus Bulletin Conference
:http://www.virusbtn.com/conference/index

= Training Conferences =

;ChicagoCon - White Hats Come Together in Defense of the Digital Frontier
:http://www.chicagocon.com

;Computer and Enterprise Investigations Conference (CEIC)
:http://www.ceicconference.com/

;HTCIA International Training Conference and Expo
:http://www.htcia.org/index.shtml

;IACIS Computer Forensic Training Event
:http://www.cops.org/training

;Mobile Forensics World Training
:http://www.MobileForensicsWorld.org/Training.aspx

;Regional Computer Forensics Group Conference (RCFG)
:http://www.rcfg.org

;SANS Computer Forensics, Investigation, and Response
:http://forensics.sans.org/events/

;Techno Forensics Conference
:http://www.techsec.com/

;Techno-Security Conference
:http://www.techsec.com/

= See also =

* [[Upcoming events]]
* [[Journals]]

Conferences

2010-01-06T03:49:44Z

Rmislan: /* Research Conferences and Workshops */

This is a list of '''conferences''' in the [[computer forensics]] field, and was originally taken from [[Brian Carrier]]'s list of conferences and journals at http://www.digital-evidence.org/publish/index.html and used with his permission. Brian no longer maintains those listings and points back to this Wiki.

For Dates and Locations of upcoming conferences and training events, see the pages titled [[Upcoming events]] (Calls for papers, Conferences and On-Demand Training) and [[Scheduled Training Courses]] (Training Classes/Courses scheduled for specific dates/locations).

=Research Conferences and Workshops=

Research conferences that are related to digital investigation and forensics.

;American Academy of Forensic Science
:http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting

;Australian Digital Forensics Conference
:http://scissec.scis.ecu.edu.au/conferences2008/index.php?cf=2

;BlackHat Japan Briefings & Training
:http://japan.blackhat.com/

;BlackHat Federal Briefings & Training
:http://www.blackhat.com/html/bh-link/briefings.html

;CanSecWest
:http://cansecwest.com/

;Computer Security Institute NetSec
:http://www.gocsi.com/netsec/

;Conference on Digital Forensics, Security and Law
:http://www.digitalforensics-conference.org/

;CyberCrime Summit
:http://www.cybercrimesummit.com/index.htm

;Department of Defense CyberCrime Conference
:http://www.dodcybercrime.com/

;Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)
:http://www.gi-ev.de/fachbereiche/sicherheit/fg/sidar/dimva/

;e-Forensics
:http://www.e-forensics.eu/

;E-Crime and Computer Evidence (NOTE - Can't find any since 2006)
:http://www.ecce-conference.com

;EuSecWest
:http://eusecwest.com/

;FIRST Conference
:http://www.first.org/conference

;French-Speaking Days on Digital Investigations - Journées Francophones de l'Investigation Numérique
:http://www.afsin.org/

;IFIP International Information Security Conference
:http://sec2008.dti.unimi.it/index.php

;IFIP WG 11.9 International Conference on Digital Forensics
:http://www.ifip119.org/Conferences/

;International Conference on Availability, Reliability and Security
:http://www.ares-conference.eu/conf/

;International Conference on IT-Incident Management & IT-Forensics
:http://www.imf-conference.org

;International Symposium on Recent Advances in Intrusion Detection
:http://www.ll.mit.edu/IST/RAID2008/

;Mobile Forensics World
:http://www.MobileForensicsWorld.org/

;Open Source Software for Computer and Network Forensics
:http://conferenze.dei.polimi.it/ossconf/index.php

;Open Web Application Security Project
:http://www.owasp.org/index.php/Main_Page

;PacSec Conference
:http://pacsec.jp/

;SANS WhatWorks Summit in Forensics and Incident Response
:http://www.sans.org/forensics09_summit/index.php

;Security OPUS Information Security Conference
:http://www.securityopus.com/index.php

;Systematic Approaches to Digital Forensic Engineering (SADFE)
:http://conf.ncku.edu.tw/sadfe/

;USENIX Annual Technical Conference
:http://www.usenix.org/events/

;USENIX Security Symposium
:http://www.usenix.org/events/

;Virus Bulletin Conference
:http://www.virusbtn.com/conference/index

= Training Conferences =

;ChicagoCon - White Hats Come Together in Defense of the Digital Frontier
:http://www.chicagocon.com

;Computer and Enterprise Investigations Conference (CEIC)
:http://www.ceicconference.com/

;HTCIA International Training Conference and Expo
:http://www.htcia.org/index.shtml

;IACIS Computer Forensic Training Event
:http://www.cops.org/training

;Mobile Forensics World Training
:http://www.MobileForensicsWorld.com/Training.aspx

;Regional Computer Forensics Group Conference (RCFG)
:http://www.rcfg.org

;SANS Computer Forensics, Investigation, and Response
:http://forensics.sans.org/events/

;Techno Forensics Conference
:http://www.techsec.com/

;Techno-Security Conference
:http://www.techsec.com/

= See also =

* [[Upcoming events]]
* [[Journals]]

AT Commands

2009-04-24T13:46:57Z

Rmislan: /* Reference Links */

<ul><li>AT and AT+ commands can be used to manually collect simple information. This is an ideal choice for "full control" over the communications that are sent and returned from the phone. These can also be used when there is no tool available to communicate with the phone. These commands were tested using a Motorola v551 GSM phone using Bluetooth and USB data cables. It is important to note that not all of these commands are supported by all phones, but the AT+CLAC command (usually) displays all of the available commands the GSM phone can respond to.</li>
<li>With Motorola phones (and many others) there are '''NO''' AT commands that can be used to retrieve multimedia content. For these, OBEX commands must be issued to the phone to return directory contents, ringtones, pictures and video.</li><li>Samsung GSM phones, on the other hand, '''DO''' have AT commands that allow access to the multimedia content.</li></ul> 

To use these AT commands:
<ol><li> Connect the phone and determine the number of the COM port that is associated with it.</li>
<li>Open HyperTerminal, Realterm or any other terminal program that will communicate with a specified COM port.</li>
<li>With the Motorola phone, type '''AT+MODE=2'''. This prepares the phone for an extended AT+ command set. (+Cxxx and +MPxx)</li></ol> 
After following these steps, you can continue with any of the commands below.

== '''Phonebook''' ==
'''AT+CPBS=?''' 
Lists the phonebooks that the phone contains. (Choose phonebook storage) 
Returns: +CPBS: ("ME","SM","MT","ON","DC","MC","RC","EN","AD","QD","SD","FD") 

+CPBS="ME" sets the "retrieve mode" to the internal phonebook. 
+CPBS="SM" sets the "retrieve mode" to the SIM phonebook.

'''AT+CPBR=?''' 
Describes the phonebook selected above. (Simple) This gives the max number of entries the phone can contain. It also gives the maximum phone number (or email address) length and name length. 
'''NOTE:''' You can substitute +MPBR for any +CPBR command, but the phone returns a much more specific (and less intelligible) response containing more fields that may act as internal “programming” flags of some sort. 
Returns: +CPBR: (1-1000),40,24

'''AT+CPBR=[beginning index],[ending index]''' 
Returns a list of numbers with the index between the two numbers entered. Also denotes what TYPE of phonebook entry was selected. 
Returns: +CPBR: 9,"18005555555",129,"Contact Name" – 129 refers to a phone number. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name" – 128 refers to an email.

'''AT+CPBR=[index]''' 
Returns the specified index. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name"

'''AT+MPBF="Name"''' 
Searches the phonebook for the Name or string.

'''AT+MPBR=?''' 
Similar to above, but a more verbose result is displayed. 
Returns: +MPBR: 1-1000,40,24,8,0-1,50,(0,2,4,6,9-30,255),(0),(0-1),(1-30),(255),25,(0-1,255),264,(0),0,0,0,0,0,0,0
<ul><li>1-1000 denotes the number of entries that can be stored on the selected (+CPBS) phonebook.</li><li>40 represents the number of characters that the email or phone number can have.</li><li>24 indicates the number of characters the “friendly” name can have.</li><li>The 8 refers to the different “types” of phonebook entry (i.e. Mobile, Main, Email, Home, Fax, Work … etc).</li><li>The +CPBR command does not list anything after the 24 (as seen above), so there are times when the +MPBR may be useful.</li></ul>

'''AT+MPBR=[index]''' 
Returns: +MPBR: 18,"user@domain.net",128,"Contact Name",6,0,255,0,0,1,255,255,0,"",0,0,"","","","","","","",""

== '''SMS Messages''' ==
'''AT+CMGF=1''' 
This tells the phone to display the entries as text rather than binary. +CMFG=0 would display the data in binary format.

'''AT+CPMS=?''' 
This displays all of the locations in which the phone can save the SMS messages. 
Returns: +CPMS: ("MT","IM","OM","BM","DM"),("OM","DM"),("IM")

'''AT+CMGL=?''' 
Returns the options on which messages you wish to display. 
Returns: +CMGL: ("REC UNREAD", "REC READ", "STO UNSENT", "STO SENT", "ALL")

'''AT+CMGL="ALL"''' 
Selects and displays all of the SMS messages on the selected source.

'''AT#PMODE=1''' 
In order to retrieve text messages and other information, Samsung phones must be in this mode.

'''AT#PSRMR=?''' 
Returns the parameters to obtain text messages (Samsung). 
Returns: #PSRMR: (0-349)

== '''Misc. Information''' ==
'''AT&F''' 
Controls local echo which enables the user to see the text they are typing into HyperTerminal.

'''ATi0, ATi1, ATi2, ATi3, or ATi4''' 
Returns various specs about the phone. 
ATi0 Returns Manufacturer 
ATi1 Returns IMEI 
ATi2 Returns SW versions 
ATi3 Returns Make and Model 
ATi4 Returns HW Version 
ATi4 Returns HW Version

'''AT+FSCD="<DIR>"''' 
Changes to specific directories (Samsung) 
If your phone is English, then it will be /Picture

'''AT+FSDI="<DIR>"''' 
Returns directory information (Samsung)

'''AT+FSDL="<DIR>"''' 
Returns a list of directories (Samsung)

'''AT+FSFW=-1, "<FILENAME>", 0, "", <LEN>, <CRC>''' 
Send a file (Samsung)

'''AT+FSFE=0, "<FILENAME>"''' 
Delete a file (Samsung)

'''AT+CGSN''' 
Returns the IMEI of the phone. 
Returns: +CGSN: IMEI356252000861622 
Returns: +GSN: 299B5900 (Samsung)

'''AT+CGMR''' 
Returns the manufacturer’s OS revision. 
Returns: +CGMR: "R47_G_08.17.0FR_01"

'''AT+GMI''' 
Returns the manufacturer name (Samsung). 
Returns: +GMI: SAMSUNG

'''AT+CGMM''' 
Returns the make, model and capabilities of the phones. 
Returns: +CGMM: "GSM900","GSM1800","GSM1900","GSM850","MODEL=V551" 
Returns: +GMM: SCH-A670 (Samsung)

'''AT+CNUM''' 
Returns the subscriber name/number from the SIM. 
Returns: +CNUM: Owner Name,15555555555,129

'''AT+CLAC''' 
Lists AT commands that the phone supports.

'''AT+MODE=22''' 
Prepares the phone (Motorola) for OBEX commands.

'''AT+MODE=0''' 
This returns the phone to simple AT command mode.

'''AT#PBDYN?''' 
This returns the phone number (Samsung).

== '''Reference Links''' ==

[http://gatling.ikk.sztaki.hu/~kissg/gsm/index.html AT+C Command Set of GSM]

[http://www.traud.de/gsm/atex.htm Alexander Traud's GSM pages ]

[http://www.anotherurl.com/library/at_test.htm AT Test Commands]

[http://www.csparks.com/MotoBackup/MotorolaAT.xhtml AT Commands to Access the Motorola]

[http://webapp.etsi.org/key/key.asp?GSMSpecPart1=27&GSMSpecPart2=007 ETSI-3GPP Standards]

[http://wiki.forum.nokia.com/index.php/AT_Commands Nokia AT Commands]

[http://www.parallax.com/Portals/0/Education/custapps/Nokia_AThelp.pdf Support Guide for the Nokia Phones and AT Commands]

[http://www.daimi.au.dk/~jones/sms/packed/Nokia_30_AT_Command_Guide_2_0.pdf Nokia 30 GSM Connectivity Terminal AT Command Guide]

[http://nds1.nokia.com/phones/files/guides/at_commands.pdf Nokia PremiCell List of AT Commands]

[http://webpages.charter.net/hideo_a310/downs/TechNotes/a310_atcommands.txt Samsung AT Commands]

Personal Digital Devices

2009-04-01T14:46:57Z

Rmislan:

'''Personal Digital Devices''' are becoming more pervasive and more important for forensic [[investigator]]s.

== Personal Digital Devices ==

* [[Cell phones]]
* [[SmartPhones]]
* [[PDAs]]
* [http://www.forensicswiki.org/wiki/GPS Global Position Systems]
* [[Audio Devices]]
* [[Video Devices]]
* [[Unusual Devices]]
* [[Other]]

Personal Digital Devices

2009-04-01T14:46:43Z

Rmislan:

'''Personal Digital Devices''' are becoming more pervasive and more important for forensic [[investigator]]s.

== Personal Digital Devices ==

* [[Cell phones]]
* [[SmartPhones]]
* [[PDAs]]
* [[http://www.forensicswiki.org/wiki/GPS Global Position Systems]]
* [[Audio Devices]]
* [[Video Devices]]
* [[Unusual Devices]]
* [[Other]]

Personal Digital Devices

2009-04-01T14:45:51Z

Rmislan: /* Personal Digital Devices */

'''Personal Digital Devices''' are becoming more pervasive and more important for forensic [[investigator]]s.

== Personal Digital Devices ==

* [[Cell phones]]
* [[SmartPhones]]
* [[PDAs]]
* [[Global Position Systems]]
* [[Audio Devices]]
* [[Video Devices]]
* [[Unusual Devices]]
* [[Other]]

AT Commands

2009-03-27T02:54:08Z

Rmislan: /* Misc. Information */

<ul><li>AT and AT+ commands can be used to manually collect simple information. This is an ideal choice for "full control" over the communications that are sent and returned from the phone. These can also be used when there is no tool available to communicate with the phone. These commands were tested using a Motorola v551 GSM phone using Bluetooth and USB data cables. It is important to note that not all of these commands are supported by all phones, but the AT+CLAC command (usually) displays all of the available commands the GSM phone can respond to.</li>
<li>With Motorola phones (and many others) there are '''NO''' AT commands that can be used to retrieve multimedia content. For these, OBEX commands must be issued to the phone to return directory contents, ringtones, pictures and video.</li><li>Samsung GSM phones, on the other hand, '''DO''' have AT commands that allow access to the multimedia content.</li></ul> 

To use these AT commands:
<ol><li> Connect the phone and determine the number of the COM port that is associated with it.</li>
<li>Open HyperTerminal, Realterm or any other terminal program that will communicate with a specified COM port.</li>
<li>With the Motorola phone, type '''AT+MODE=2'''. This prepares the phone for an extended AT+ command set. (+Cxxx and +MPxx)</li></ol> 
After following these steps, you can continue with any of the commands below.

== '''Phonebook''' ==
'''AT+CPBS=?''' 
Lists the phonebooks that the phone contains. (Choose phonebook storage) 
Returns: +CPBS: ("ME","SM","MT","ON","DC","MC","RC","EN","AD","QD","SD","FD") 

+CPBS="ME" sets the "retrieve mode" to the internal phonebook. 
+CPBS="SM" sets the "retrieve mode" to the SIM phonebook.

'''AT+CPBR=?''' 
Describes the phonebook selected above. (Simple) This gives the max number of entries the phone can contain. It also gives the maximum phone number (or email address) length and name length. 
'''NOTE:''' You can substitute +MPBR for any +CPBR command, but the phone returns a much more specific (and less intelligible) response containing more fields that may act as internal “programming” flags of some sort. 
Returns: +CPBR: (1-1000),40,24

'''AT+CPBR=[beginning index],[ending index]''' 
Returns a list of numbers with the index between the two numbers entered. Also denotes what TYPE of phonebook entry was selected. 
Returns: +CPBR: 9,"18005555555",129,"Contact Name" – 129 refers to a phone number. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name" – 128 refers to an email.

'''AT+CPBR=[index]''' 
Returns the specified index. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name"

'''AT+MPBF="Name"''' 
Searches the phonebook for the Name or string.

'''AT+MPBR=?''' 
Similar to above, but a more verbose result is displayed. 
Returns: +MPBR: 1-1000,40,24,8,0-1,50,(0,2,4,6,9-30,255),(0),(0-1),(1-30),(255),25,(0-1,255),264,(0),0,0,0,0,0,0,0
<ul><li>1-1000 denotes the number of entries that can be stored on the selected (+CPBS) phonebook.</li><li>40 represents the number of characters that the email or phone number can have.</li><li>24 indicates the number of characters the “friendly” name can have.</li><li>The 8 refers to the different “types” of phonebook entry (i.e. Mobile, Main, Email, Home, Fax, Work … etc).</li><li>The +CPBR command does not list anything after the 24 (as seen above), so there are times when the +MPBR may be useful.</li></ul>

'''AT+MPBR=[index]''' 
Returns: +MPBR: 18,"user@domain.net",128,"Contact Name",6,0,255,0,0,1,255,255,0,"",0,0,"","","","","","","",""

== '''SMS Messages''' ==
'''AT+CMGF=1''' 
This tells the phone to display the entries as text rather than binary. +CMFG=0 would display the data in binary format.

'''AT+CPMS=?''' 
This displays all of the locations in which the phone can save the SMS messages. 
Returns: +CPMS: ("MT","IM","OM","BM","DM"),("OM","DM"),("IM")

'''AT+CMGL=?''' 
Returns the options on which messages you wish to display. 
Returns: +CMGL: ("REC UNREAD", "REC READ", "STO UNSENT", "STO SENT", "ALL")

'''AT+CMGL="ALL"''' 
Selects and displays all of the SMS messages on the selected source.

== '''Misc. Information''' ==
'''AT&F''' 
Controls Local echo.

'''ATi0, ATi1, ATi2, ATi3, or ATi4''' 
Returns various specs about the phone. 
ATi0 Returns Manufacturer 
ATi1 Returns IMEI 
ATi2 Returns SW versions 
ATi3 Returns Make and Model 
ATi4 Returns HW Version 
ATi4 Returns HW Version

'''AT+CGSN''' 
Returns the IMEI of the phone. 
Returns: +CGSN: IMEI356252000861622 
Returns: +GSN: 299B5900 (Samsung)

'''AT+CGMR''' 
Returns the manufacturer’s OS revision. 
Returns: +CGMR: "R47_G_08.17.0FR_01"

'''AT+GMI''' 
Returns the manufacturer name (Samsung). 
Returns: +GMI: SAMSUNG

'''AT+CGMM''' 
Returns the make, model and capabilities of the phones. 
Returns: +CGMM: "GSM900","GSM1800","GSM1900","GSM850","MODEL=V551" 
Returns: +GMM: SCH-A670 (Samsung)

'''AT+CNUM''' 
Returns the subscriber name/number from the SIM. 
Returns: +CNUM: Owner Name,15555555555,129

'''AT+CLAC''' 
Lists AT commands that the phone supports.

'''AT+MODE=22''' 
Prepares the phone (Motorola) for OBEX commands.

'''AT+MODE=0''' 
This returns the phone to simple AT command mode.

== '''Reference Links''' ==

[http://gatling.ikk.sztaki.hu/~kissg/gsm/index.html AT+C Command Set of GSM]

[http://www.traud.de/gsm/atex.htm Alexander Traud's GSM pages ]

[http://www.anotherurl.com/library/at_test.htm AT Test Commands]

[http://www.csparks.com/MotoBackup/MotorolaAT.xhtml AT Commands to Access the Motorola]

[http://webapp.etsi.org/key/key.asp?GSMSpecPart1=27&GSMSpecPart2=007 ETSI-3GPP Standards]

[http://wiki.forum.nokia.com/index.php/AT_Commands Nokia AT Commands]

[http://www.parallax.com/Portals/0/Education/custapps/Nokia_AThelp.pdf Support Guide for the Nokia Phones and AT Commands]

[http://www.daimi.au.dk/~jones/sms/packed/Nokia_30_AT_Command_Guide_2_0.pdf Nokia 30 GSM Connectivity Terminal AT Command Guide]

[http://nds1.nokia.com/phones/files/guides/at_commands.pdf Nokia PremiCell List of AT Commands]

AT Commands

2009-03-27T02:45:05Z

Rmislan: /* Reference Links */

<ul><li>AT and AT+ commands can be used to manually collect simple information. This is an ideal choice for "full control" over the communications that are sent and returned from the phone. These can also be used when there is no tool available to communicate with the phone. These commands were tested using a Motorola v551 GSM phone using Bluetooth and USB data cables. It is important to note that not all of these commands are supported by all phones, but the AT+CLAC command (usually) displays all of the available commands the GSM phone can respond to.</li>
<li>With Motorola phones (and many others) there are '''NO''' AT commands that can be used to retrieve multimedia content. For these, OBEX commands must be issued to the phone to return directory contents, ringtones, pictures and video.</li><li>Samsung GSM phones, on the other hand, '''DO''' have AT commands that allow access to the multimedia content.</li></ul> 

To use these AT commands:
<ol><li> Connect the phone and determine the number of the COM port that is associated with it.</li>
<li>Open HyperTerminal, Realterm or any other terminal program that will communicate with a specified COM port.</li>
<li>With the Motorola phone, type '''AT+MODE=2'''. This prepares the phone for an extended AT+ command set. (+Cxxx and +MPxx)</li></ol> 
After following these steps, you can continue with any of the commands below.

== '''Phonebook''' ==
'''AT+CPBS=?''' 
Lists the phonebooks that the phone contains. (Choose phonebook storage) 
Returns: +CPBS: ("ME","SM","MT","ON","DC","MC","RC","EN","AD","QD","SD","FD") 

+CPBS="ME" sets the "retrieve mode" to the internal phonebook. 
+CPBS="SM" sets the "retrieve mode" to the SIM phonebook.

'''AT+CPBR=?''' 
Describes the phonebook selected above. (Simple) This gives the max number of entries the phone can contain. It also gives the maximum phone number (or email address) length and name length. 
'''NOTE:''' You can substitute +MPBR for any +CPBR command, but the phone returns a much more specific (and less intelligible) response containing more fields that may act as internal “programming” flags of some sort. 
Returns: +CPBR: (1-1000),40,24

'''AT+CPBR=[beginning index],[ending index]''' 
Returns a list of numbers with the index between the two numbers entered. Also denotes what TYPE of phonebook entry was selected. 
Returns: +CPBR: 9,"18005555555",129,"Contact Name" – 129 refers to a phone number. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name" – 128 refers to an email.

'''AT+CPBR=[index]''' 
Returns the specified index. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name"

'''AT+MPBF="Name"''' 
Searches the phonebook for the Name or string.

'''AT+MPBR=?''' 
Similar to above, but a more verbose result is displayed. 
Returns: +MPBR: 1-1000,40,24,8,0-1,50,(0,2,4,6,9-30,255),(0),(0-1),(1-30),(255),25,(0-1,255),264,(0),0,0,0,0,0,0,0
<ul><li>1-1000 denotes the number of entries that can be stored on the selected (+CPBS) phonebook.</li><li>40 represents the number of characters that the email or phone number can have.</li><li>24 indicates the number of characters the “friendly” name can have.</li><li>The 8 refers to the different “types” of phonebook entry (i.e. Mobile, Main, Email, Home, Fax, Work … etc).</li><li>The +CPBR command does not list anything after the 24 (as seen above), so there are times when the +MPBR may be useful.</li></ul>

'''AT+MPBR=[index]''' 
Returns: +MPBR: 18,"user@domain.net",128,"Contact Name",6,0,255,0,0,1,255,255,0,"",0,0,"","","","","","","",""

== '''SMS Messages''' ==
'''AT+CMGF=1''' 
This tells the phone to display the entries as text rather than binary. +CMFG=0 would display the data in binary format.

'''AT+CPMS=?''' 
This displays all of the locations in which the phone can save the SMS messages. 
Returns: +CPMS: ("MT","IM","OM","BM","DM"),("OM","DM"),("IM")

'''AT+CMGL=?''' 
Returns the options on which messages you wish to display. 
Returns: +CMGL: ("REC UNREAD", "REC READ", "STO UNSENT", "STO SENT", "ALL")

'''AT+CMGL="ALL"''' 
Selects and displays all of the SMS messages on the selected source.

== '''Misc. Information''' ==
'''AT+CGSN''' 
Returns the IMEI of the phone. 
Returns: +CGSN: IMEI356252000861622 
Returns: +GSN: 299B5900 (Samsung)

'''AT+CGMR''' 
Returns the manufacturer’s OS revision. 
Returns: +CGMR: "R47_G_08.17.0FR_01"

'''AT+GMI''' 
Returns the manufacturer name (Samsung). 
Returns: +GMI: SAMSUNG

'''AT+CGMM''' 
Returns the make, model and capabilities of the phones. 
Returns: +CGMM: "GSM900","GSM1800","GSM1900","GSM850","MODEL=V551" 
Returns: +GMM: SCH-A670 (Samsung)

'''AT+CNUM''' 
Returns the subscriber name/number from the SIM. 
Returns: +CNUM: Owner Name,15555555555,129

'''AT+CLAC''' 
Lists AT commands that the phone supports.

'''AT+MODE=22''' 
Prepares the phone (Motorola) for OBEX commands.

'''AT+MODE=0''' 
This returns the phone to simple AT command mode.

== '''Reference Links''' ==

[http://gatling.ikk.sztaki.hu/~kissg/gsm/index.html AT+C Command Set of GSM]

[http://www.traud.de/gsm/atex.htm Alexander Traud's GSM pages ]

[http://www.anotherurl.com/library/at_test.htm AT Test Commands]

[http://www.csparks.com/MotoBackup/MotorolaAT.xhtml AT Commands to Access the Motorola]

[http://webapp.etsi.org/key/key.asp?GSMSpecPart1=27&GSMSpecPart2=007 ETSI-3GPP Standards]

[http://wiki.forum.nokia.com/index.php/AT_Commands Nokia AT Commands]

[http://www.parallax.com/Portals/0/Education/custapps/Nokia_AThelp.pdf Support Guide for the Nokia Phones and AT Commands]

[http://www.daimi.au.dk/~jones/sms/packed/Nokia_30_AT_Command_Guide_2_0.pdf Nokia 30 GSM Connectivity Terminal AT Command Guide]

[http://nds1.nokia.com/phones/files/guides/at_commands.pdf Nokia PremiCell List of AT Commands]

AT Commands

2009-03-27T02:42:54Z

Rmislan: /* Reference Links */

<ul><li>AT and AT+ commands can be used to manually collect simple information. This is an ideal choice for "full control" over the communications that are sent and returned from the phone. These can also be used when there is no tool available to communicate with the phone. These commands were tested using a Motorola v551 GSM phone using Bluetooth and USB data cables. It is important to note that not all of these commands are supported by all phones, but the AT+CLAC command (usually) displays all of the available commands the GSM phone can respond to.</li>
<li>With Motorola phones (and many others) there are '''NO''' AT commands that can be used to retrieve multimedia content. For these, OBEX commands must be issued to the phone to return directory contents, ringtones, pictures and video.</li><li>Samsung GSM phones, on the other hand, '''DO''' have AT commands that allow access to the multimedia content.</li></ul> 

To use these AT commands:
<ol><li> Connect the phone and determine the number of the COM port that is associated with it.</li>
<li>Open HyperTerminal, Realterm or any other terminal program that will communicate with a specified COM port.</li>
<li>With the Motorola phone, type '''AT+MODE=2'''. This prepares the phone for an extended AT+ command set. (+Cxxx and +MPxx)</li></ol> 
After following these steps, you can continue with any of the commands below.

== '''Phonebook''' ==
'''AT+CPBS=?''' 
Lists the phonebooks that the phone contains. (Choose phonebook storage) 
Returns: +CPBS: ("ME","SM","MT","ON","DC","MC","RC","EN","AD","QD","SD","FD") 

+CPBS="ME" sets the "retrieve mode" to the internal phonebook. 
+CPBS="SM" sets the "retrieve mode" to the SIM phonebook.

'''AT+CPBR=?''' 
Describes the phonebook selected above. (Simple) This gives the max number of entries the phone can contain. It also gives the maximum phone number (or email address) length and name length. 
'''NOTE:''' You can substitute +MPBR for any +CPBR command, but the phone returns a much more specific (and less intelligible) response containing more fields that may act as internal “programming” flags of some sort. 
Returns: +CPBR: (1-1000),40,24

'''AT+CPBR=[beginning index],[ending index]''' 
Returns a list of numbers with the index between the two numbers entered. Also denotes what TYPE of phonebook entry was selected. 
Returns: +CPBR: 9,"18005555555",129,"Contact Name" – 129 refers to a phone number. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name" – 128 refers to an email.

'''AT+CPBR=[index]''' 
Returns the specified index. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name"

'''AT+MPBF="Name"''' 
Searches the phonebook for the Name or string.

'''AT+MPBR=?''' 
Similar to above, but a more verbose result is displayed. 
Returns: +MPBR: 1-1000,40,24,8,0-1,50,(0,2,4,6,9-30,255),(0),(0-1),(1-30),(255),25,(0-1,255),264,(0),0,0,0,0,0,0,0
<ul><li>1-1000 denotes the number of entries that can be stored on the selected (+CPBS) phonebook.</li><li>40 represents the number of characters that the email or phone number can have.</li><li>24 indicates the number of characters the “friendly” name can have.</li><li>The 8 refers to the different “types” of phonebook entry (i.e. Mobile, Main, Email, Home, Fax, Work … etc).</li><li>The +CPBR command does not list anything after the 24 (as seen above), so there are times when the +MPBR may be useful.</li></ul>

'''AT+MPBR=[index]''' 
Returns: +MPBR: 18,"user@domain.net",128,"Contact Name",6,0,255,0,0,1,255,255,0,"",0,0,"","","","","","","",""

== '''SMS Messages''' ==
'''AT+CMGF=1''' 
This tells the phone to display the entries as text rather than binary. +CMFG=0 would display the data in binary format.

'''AT+CPMS=?''' 
This displays all of the locations in which the phone can save the SMS messages. 
Returns: +CPMS: ("MT","IM","OM","BM","DM"),("OM","DM"),("IM")

'''AT+CMGL=?''' 
Returns the options on which messages you wish to display. 
Returns: +CMGL: ("REC UNREAD", "REC READ", "STO UNSENT", "STO SENT", "ALL")

'''AT+CMGL="ALL"''' 
Selects and displays all of the SMS messages on the selected source.

== '''Misc. Information''' ==
'''AT+CGSN''' 
Returns the IMEI of the phone. 
Returns: +CGSN: IMEI356252000861622 
Returns: +GSN: 299B5900 (Samsung)

'''AT+CGMR''' 
Returns the manufacturer’s OS revision. 
Returns: +CGMR: "R47_G_08.17.0FR_01"

'''AT+GMI''' 
Returns the manufacturer name (Samsung). 
Returns: +GMI: SAMSUNG

'''AT+CGMM''' 
Returns the make, model and capabilities of the phones. 
Returns: +CGMM: "GSM900","GSM1800","GSM1900","GSM850","MODEL=V551" 
Returns: +GMM: SCH-A670 (Samsung)

'''AT+CNUM''' 
Returns the subscriber name/number from the SIM. 
Returns: +CNUM: Owner Name,15555555555,129

'''AT+CLAC''' 
Lists AT commands that the phone supports.

'''AT+MODE=22''' 
Prepares the phone (Motorola) for OBEX commands.

'''AT+MODE=0''' 
This returns the phone to simple AT command mode.

== '''Reference Links''' ==

[http://gatling.ikk.sztaki.hu/~kissg/gsm/index.html AT+C Command Set of GSM]

[http://www.traud.de/gsm/atex.htm Alexander Traud's GSM pages ]

[http://www.anotherurl.com/library/at_test.htm AT Test Commands]

[http://www.csparks.com/MotoBackup/MotorolaAT.xhtml AT Commands to Access the Motorola]

[http://webapp.etsi.org/key/key.asp?GSMSpecPart1=27&GSMSpecPart2=007 ETSI-3GPP Standards]

[http://wiki.forum.nokia.com/index.php/AT_Commands Nokia AT Commands]

[http://www.parallax.com/Portals/0/Education/custapps/Nokia_AThelp.pdf Support Guide for the Nokia Phones and AT Commands]

[http://www.daimi.au.dk/~jones/sms/packed/Nokia_30_AT_Command_Guide_2_0.pdf Nokia 30 GSM Connectivity Terminal AT Command Guide]

Upcoming events

2008-12-05T16:05:55Z

Rmislan: /* Conferences */

PLEASE READ BEFORE YOU EDIT THE LISTS BELOW 
Events should be posted in the correct section, and in date order. An event should NEVER be listed in more than one section (i.e. Ongoing/Continuous events should not be listed in Scheduled Training). When events begin the same day, events of a longer length should be listed first. New postings of events with the same date(s) as other events should be added after events already in the list. If a provider offers the same event at several locations simultaneously, the listing should have a single (ONE) entry in the list with the date(s) and ALL locations for the event. Please use three-letter month abbreviations (i.e. Sep, NOT Sept. or September), use two digit dates (i.e. Jan 01 NOT Jan 1), and use date ranges rather than listing every date during an event(i.e. Jan 02-05, NOT Jan 02, 03, 04, 05). 
Some events may be limited to Law Enforcement Only or to a specific audience. Such restrictions should be noted when known.

This is a BY DATE listing of upcoming events relevant to [[digital forensics]]. It is not an all inclusive list, but includes most well-known activities. Some events may duplicate events on the generic [[conferences]] page, but entries in this list have specific dates and locations for the upcoming event.

This listing is divided into four sections (described as follows): 
<ol><li>Calls For Papers - Calls for papers for either Journals or for Conferences, relevant to Digital Forensics (Name, Closing Date, URL)</li> 
<li>Conferences - Conferences relevant for Digital Forensics (Name, Date, Location, URL)</li> 
<li>On-Going / Continuous Training - Training opportunities that are either always available online/distance learning format (start anytime) or that are offered the same time every month (Name, date-if applicable, URL)</li> 
<li>[[Scheduled Training Courses]] - Training Classes/Courses that are scheduled for specific dates/locations. This would include online (or distance learning format) courses which begin on specific dates, instead of the "start anytime" courses listed in the previous section. (Provider, URL) (''note: this has been moved to its own page.'') </li></ol>

The Conference and Training List is provided by the American Academy of Forensic Sciences (AAFS) Digital and Multimedia Sciences Section Listserv.
 (Subscribe by sending an email to listserv@lists.mitre.org with message body containing SUBSCRIBE AAFS-DIGITAL-MULTIMEDIA-LIST)
Requests for additions, deletions or corrections to this list may be sent by email to David Baker (bakerd AT mitre.org).

== Calls For Papers ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! width="30%|Title
! width="15%"|Due Date
! width="15%"|Notification Date
! width="40%"|Website
|-
|ShmooCon 2009
|Dec 01, 2008
|Jan 01, 2009
|http://www.shmoocon.org/cfp.html
|-
|Security Opus
|Dec 01, 2008
|Jan 31, 2009
|http://www.securityopus.com/SORpapers.php
|-
|AusCERT Conference 2009
|Dec 05, 2008
|Jan 30, 2009
|http://conference.auscert.org.au/conf2009/cfp2009.html
|-
|Blackhat Briefings - Washington DC
|Jan 01, 2009
|Jan 16, 1009
|https://www.blackhat.com/html/bh-dc-09/bh-dc-09-cfp.html
|-
|Hacker Halted USA 2009
|Jan 15, 2009
|Feb 15, 2009
|http://www.eccouncil.org/hhusa/papers/page6.html
|-
|3rd Edition of Small Scale Digital Device Forensics Journal
|Jan 31, 2009
|
|http://www.ssddfj.org/Call.asp
|-
|4rd International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE-2009)
|Feb 01, 2009
|
|http://conf.ncku.edu.tw/sadfe/sadfe09/
|-
|Blackhat Briefings - Europe
|Feb 01, 2009
|Feb 15, 2009
|https://www.blackhat.com/html/bh-europe-09/bh-eu-09-cfp.html.
|-
|Usenix Security 2009
|Feb 04, 2009
|Apr 13, 2009
|http://www.usenix.org/events/sec09/cfp
|-
|2009 ADFSL Conference on Digital Forensics, Security and Law
|Feb 20, 2009
|
|http://www.digitalforensics-conference.org/callforpapers.htm
|-
|KDDD 2009
|Feb 02, 2009
|Apr 10, 2009
|http://www.sigkdd.org/kdd2009/
|-
|DFRWS 2009
|Mar 16, 2009
|Apr 28, 2009
|http://www.dfrws.org/2009/cfp.shtml
|-
|ACM CCS 2009
|Apr 2009
|
|http://www.sigsac.org/ccs
|-
|New Security Paradigms Conference 2009
|Apr 2009
|
|http://www.nspw.org/current/
|-
|IEEE Symposium on Security and Privacy 2010
|Nov 2009
|
|
|-
|}

== Conferences ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! width="40%"|Title
! width="20%"|Date/Location
! width="40%"|Website
|-
|6th Australian Digital Forensics Conference
|Dec 01-03 Mount Lawley, WA, Australia
|http://scissec.scis.ecu.edu.au/conferences2008/index.php?cf=2
|-
|Pacific Information Security Forum
|Dec 02-03 San Francisco, CA
|http://www.ianetsec.com/forums/event_summary.html?label=45
|-
|IEEE International Workshop on Information and Data Assurance
|Dec 07 Austin, TX
|http://ipccc.org/ipccc2008/main.php?page=6#workshop3
|-
|Digital Forensics Forum Arabia 2008
|Dec 15-17 Manama, Bahrain
|http://dff-worldwide.com/index.php?page=dff-arabia-2008-conference&hl=en_US
|-
|e-Forensics 2009
|Jan 19-21 Adelaide, Australia
|http://www.e-forensics.eu/
|-
|2009 DoD Cyber Crime Conference
|Jan 24-30 St. Louis, MO
|http://www.dodcybercrime.com/
|-
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
|Jan 25-28 Orlando, FL
|http://www.ifip119.org/Conferences/
|-
|ShmooCon 2009
|Feb 06-08 Washington, DC
|http://www.shmoocon.org/
|-
|American Academy of Forensic Sciences Annual Meeting
|Feb 16-21 Denver, CO
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
|-
|Blackhat DC
|Feb 16-19 Washington, DC
|https://www.blackhat.com/html/bh-dc-09/bh-dc-09-main.html
|-
|24th Annual ACM Symposium on Applied Computing - Computer Forensics Track
|Mar 08-12 Honolulu, HI
|http://www.acm.org/conferences/sac/sac2009
|-
|ARES 2009 Conference
|Mar 16-19 Fukuoka, Japan
|http://www.ares-conference.eu/conf/
|-
|Security Opus
|Mar 17-18 San Francisco, CA
|http://www.securityopus.com
|-
|e-Crime Congress 2009
|Mar 24-25 London, United Kingdom
|http://www.e-crimecongress.org/ecrime2009/
|-
|Blackhat Europe
|Apr 14-17 Amsterdam, The Netherlands
|https://www.blackhat.com/html/bh-europe-09/bh-eu-09-main.html
|-
|AusCERT2009
|May 17-22 Gold Coast, Australia
|http://conference.auscert.org.au/conf2009/
|-
|Computer Security Institute: Security Exchange
|May 17-22 Las Vegas, NV
|http://www.csisx.com/
|-
|ADFSL 2009 Conference on Digital Forensics, Security and Law
|May 20-22 Burlington, VT
|http://www.digitalforensics-conference.org
|-
|Fourth International Workshop on Systematic Approaches to Digital Forensic Engineering
|May 22 Oakland, CA
|http://conf.ncku.edu.tw/sadfe/sadfe09/
|-
|Mobile Forensics World 2009
|May 26-30 Chicago, IL
|http://www.mobileforensicsworld.com
|-
|2009 Techno Security Conference
|May 31-Jun 03 Myrtle Beach, SC
|http://www.techsec.com/index.html
|-
|IEEE ICC Communication and Information Systems Security (CISS) Symposium
|Jun 14-18 Dresden, Germany
|http://www.ieee-icc.org/2009/
|-
|Blackhat USA 2009
|Jul 25-30 Las Vegas, NV
|https://www.blackhat.com/
|-
|DefCon 17
|Jul 31-Aug 02 Las Vegas, NV
|http://www.defcon.org/
|-
|Usenix Security Sypmosium
|Aug 10-14 Montreal, Quebec, Canada
|http://www.usenix.org/events/sec09/
|-
|Digital Forensic Research Workshop
|Aug 17-19 Montreal, Quebec, Canada
|http://www.dfrws.org
|-
|Triennial Meeting of the European Academy of Forensic Science
|Sep 08-11 Glasgow, Scotland, UK
|http://www.eafs2009.com/
|-
|Hacker Halted USA 2009
|Sep 20-24 Miami, FL
|http://www.hackerhalted.com/usa
|-
|}

== On-going / Continuous Training ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! width="40%"|Title
! width="20%"|Date/Location
! width="40%"|Website
|-
| ----DISTANCE LEARNING----
|-
|Basic Computer Examiner Course - Computer Forensic Training Online
|Distance Learning Format
|http://www.cftco.com
|-
|Linux Data Forensics Training
|Distance Learning Format
|http://www.crazytrain.com/training.html
|-
|SANS On-Demand Training
|Distance Learning Format
|http://www.sans.org/ondemand/?portal=69456f95660ade45be29c00b0c14aea1
|-
| ----RECURRING TRAINING----
|-
|MaresWare Suite Training
|First full week every month Atlanta, GA
|http://www.maresware.com/maresware/training/maresware.htm
|-
|Evidence Recovery for Windows Vista™
|First full week every month Brunswick, GA
|http://www.internetcrimes.net
|-
|Evidence Recovery for Windows Server® 2003 R2
|Second full week every month Brunswick, GA
|http://www.internetcrimes.net
|-
|Evidence Recovery for the Windows XP™ operating system
|Third full week every month Brunswick, GA
|http://www.internetcrimes.net
|-
|Computer Forensics Training and CCE™ Testing for Litigation Support Professionals
|Third weekend of every month(Fri-Mon) Dallas, TX
|http://www.md5group.com
|-
|}
==See Also==
* [[Scheduled Training Courses]]
==References==
* [http://faculty.cs.tamu.edu/guofei/sec_conf_stat.htm Computer Security Conference Ranking and Statistic]
* [http://www.kdnuggets.com/meetings/ Meetings and Conferences in Data Mining and Discovery]
* http://www.conferencealerts.com/data.htm Data Mining Conferences World-Wide]

Cell phones

2008-09-17T03:34:35Z

Rmislan: /* Tools */

'''Cell phones''' or '''mobile phones''' are an important target for [[forensic investigator]]s.

== Technologies ==

* [[CDMA]]
* [[TDMA]]
* [[GSM]]
* [[iDEN]]
* [[EDGE]]
* [[GPRS]]
* [[UMTS]]

== Hardware ==

* [[RIM BlackBerry]]
* [[T-Mobile Sidekick ]]
* [[SIM Cards]]

== Operating Systems ==

* [[Microsoft PocketPC]]
* [[Microsoft Windows Mobile]]
* [[Palm]]
* [[RIM BlackBerry]]
* [[Symbian]]
* [[Linux]]

== Forensics ==

'''Procedures'''

* [[Cell Phone Forensics]]
* [[SIM Card Forensics]]
* [[External Memory Card Forensics]]

== Tools ==

'''Flashers'''
* [[UFS Tornado]]

'''Hardware'''
* [[Azimuth RadioProof™ Enclosures]]
* [[Cellebrite UFED]]
* [[LogiCube CellDEK]]
* [[LogiCube CellDEK TEK]]
* [[MicroSystemation RoadWarrior]]
* [[Network Security Solutions Secure Tents]]
* [[Network Security Solutions Seizure Bags for Cell Phones/PDAs/Laptops]]
* [[Paraben CSI Stick]]
* [[Paraben Device Seizure Toolbox]]
* [[Paraben Handheld First Responder Kit]]
* [[Paraben StrongHold Bag]]
* [[Radio Frequency (RF) Jammers]]
* [[Radio Tactics Acesso]]
* [[Radio Tactics Apollo]]
* [[Radio Tactics Athena]]
* [[SIM Card Readers]]

'''Software'''
* [[BitPIM]]
* [[BK Forensics Cell Phone Analyzer]]
* [[FloAt's Mobile Agent]]
* [[ForensicMobile]]
* [[ForensicSIM]]
* [[Guidance Software Neutrino]]
* [[iDEN Companion Pro]]
* [[iDEN Media Downloader]]
* [[iDEN Phonebook Manager]]
* [[MicroSystemation .XRY]]
* [[MOBILedit!]]
* [[Oxygen PM II]]
* [[Paraben Device Seizure]]
* [[Paraben SIM Seizure]]
* [[Pandora's Box]]
* [[Quantaq USIMdetective]]
* [[Quantaq USIMcommander]]
* [[Quantaq USIMdetective]]
* [[Quantaq USIMexplorer]]
* [[Quantaq USIMprofiler]]
* [[Quantaq USIMregistrar]]
* [[Susteen Secure View]]
* [[TULP2G]]
* [[WOLF]]

Upcoming events

2008-09-04T05:23:20Z

Rmislan: /* Conferences */

PLEASE READ BEFORE YOU EDIT THE LISTS BELOW 
Events should be posted in the correct section, and in date order. An event should NEVER be listed in more than one section (i.e. Ongoing/Continuous events should not be listed in Scheduled Training). When events begin the same day, events of a longer length should be listed first. New postings of events with the same date(s) as other events should be added after events already in the list. If a provider offers the same event at several locations simultaneously, the listing should have a single (ONE) entry in the list with the date(s) and ALL locations for the event. Please use three-letter month abbreviations (i.e. Sep, NOT Sept. or September), use two digit dates (i.e. Jan 01 NOT Jan 1), and use date ranges rather than listing every date during an event(i.e. Jan 02-05, NOT Jan 02, 03, 04, 05). 
Some conferences or training opportunities may be limited to Law Enforcement Only or to a specific audience. Such restrictions should be noted when known.

This is a BY DATE listing of upcoming conferences and training events relevant to [[digital forensics]]. It is not an all inclusive list, but includes most well-known activities. Some events may duplicate events on the generic [[conferences]] page, but entries in this list have specific dates and locations for the upcoming event.

This listing is divided into four sections (described as follows): 
<ol><li>Calls For Papers - Calls for papers for either Journals or for Conferences, relevant to Digital Forensics (Name, Closing Date, URL)</li> 
<li>Conferences - Conferences relevant for Digital Forensics (Name, Date, Location, URL)</li> 
<li>On-Going / Continuous Training - Training opportunities that are either always available online/distance learning format or that are offered the same time every month (Name, date-if applicable, URL)</li> 
<li>[[Scheduled Training Courses]] - Training Classes/Courses that are scheduled for specific dates/locations. This would include online (or distance learning format) courses which begin on specific dates, instead of the "start anytime" courses listed in the previous section. (Name, Date(s), Location(s), URL) (''note: this has been moved to its own page.'') </li></ol>

The Conference and Training List is provided by the American Academy of Forensic Sciences (AAFS) Digital and Multimedia Sciences Section Listserv.
 (Subscribe by sending an email to listserv@lists.mitre.org with message body containing SUBSCRIBE AAFS-DIGITAL-MULTIMEDIA-LIST)
Requests for additions, deletions or corrections to this list may be sent by email to David Baker (bakerd AT mitre.org).

== Calls For Papers ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Due Date
! Website
|-
|Digital Forensics Forum Arabia 2008
|Aug 31, 2008
|http://dff-worldwide.com/index.php?page=call-for-papers&hl=en_US
|-
|IEEE ICC Communication and Information Systems Security (CISS) Symposium
|Sep 8, 2008
|http://www.ieee-icc.org/2009/cfp.html
|-
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
|Oct 15, 2008
|http://www.ifip119.org/Conferences/WG11-9-CFP-2009.pdf
|-
|3rd Edition of Small Scale Digital Device Forensics Journal
|Jan 31, 2009
|http://www.ssddfj.org/Call.asp
|-
|}

== Conferences ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Date/Location
! Website
|-
|2nd French-Speaking Days on Digital Investigations - Journées Francophones de l'Investigation Numérique 2008
|Sep 03-05, Vandoeuvre-lès-Nancy, France
|http://www.afsin.org/
|-
|1st Workshop on Open Source Software for Computer and Network Forensics
|Sep 07-10, Milan Italy
|http://conferenze.dei.polimi.it/ossconf/index.php
|-
|11th International Symposium on Recent Advances in Intrusion Detection
|Sep 15-17, Cambridge, MA
|http://www.ll.mit.edu/IST/RAID2008/
|-
|4th International Conference on IT Incident Management & IT Forensics
|Sep 23-25, Mannheim, Germany
|http://www.imf-conference.org/
|-
|Open Web Application Security Project (OWASP) AppSec 2008 Conference
|Sep 24-25, New York City, NY
|http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference
|-
|VB2008 anti-malware conference
|Oct 01-03, Ottawa, Canada
|http://www.virusbtn.com/conference/vb2008/
|-
|ENFSI Forensic IT Working Group meeting Limited to law enforcement
|Oct 01-03, Madrid, Spain
|http://www.enfsi.eu/page.php?uid=2
|-
|ANZFSS - 19th International Symposium on the Forensic Sciences
|Oct 06-09, Melbourne, Australia
|http://www.anzfss2008.org.au/
|-
|13th European Symposium on Research in Computer Security
|Oct 06-08, Malaga, Spain
|http://www.isac.uma.es/esorics08/
|-
|Economic and High Tech Crime Summit 2008
|Oct 07-08, Memphis, TN
|http://summit.nw3c.org/
|-
|First Eurasian Congress of Forensic Sciences
|Oct 08-11, Istanbul, Turkey
|http://www.adlitip2008.com/indexen.asp
|-
|3nd International Annual Workshop on Digital Forensics & Incident Analysis
|Oct 09, Malaga, Spain
|http://www.icsd.aegean.gr/wdfia08/
|-
|Anti-Phishing Working Group eCrime Researchers Summit
|Oct 15-16, Atlanta, GA
|http://www.ecrimeresearch.org/
|-
|2008 HTCIA International Training Conference
|Oct 22-28, Atlantic City, NJ
|http://www.htcia.org/conference.shtml
|-
|2008 International Video Evidence Symposium and Training Conference
|Oct 22-24, Orlando, FL
|http://leva.org/index.php?option=com_content&task=view&id=56&Itemid=98
|-
|Paraben Forensics Innovation Conference
|Nov 09-12, Park City, UT
|http://www.pfic2008.com/
|-
|DeepSec 2008
|Nov 11-14, Vienna, Austria
|https://deepsec.net/
|-
|Digital Forensics Forum Arabia 2008
|Dec 15-17, Manama, Bahrain
|http://dff-worldwide.com/index.php?page=dff-arabia-2008-conference&hl=en_US
|-
|2009 DoD Cyber Crime Conference
|Jan 24-30, St. Louis, MO
|http://www.dodcybercrime.com/
|-
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
|Jan 25-28, Orlando, FL
|http://www.ifip119.org/Conferences/
|-
|American Academy of Forensic Sciences Annual Meeting
|Feb 16-21, Denver, CO
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
|-
|24th Annual ACM Symposium on Applied Computing - Computer Forensics Track
|Mar 08-12, Honolulu, HI
|http://www.acm.org/conferences/sac/sac2009
|-
|2009 Techno Security Conference
|May 31- Jun 03, Myrtle Beach, SC
|http://www.techsec.com/index.html
|-
|Mobile Forensics World 2009
|Jun 03 - Jun 06, Chicago, IL
|http://www.mobileforensicsworld.com
|-
|IEEE ICC Communication and Information Systems Security (CISS) Symposium
|Jun 14-18, Dresden, Germany
|http://www.ieee-icc.org/2009/
|-
|Digital Forensic Research Workshop
|Aug 17-19, Montreal, Quebec, Canada
|http://www.dfrws.org
|-
|}

== On-going / Continuous Training ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Date/Location or Venue
! Website
|-
|Basic Computer Examiner Course - Computer Forensic Training Online
|Distance Learning Format
|http://www.cftco.com
|-
|Computer Forensics Training and CCE™ Testing for Litigation Support Professionals
|Third weekend of every month (Fri-Mon), Dallas, TX
|http://www.md5group.com
|-
|Evidence Recovery for Windows Vista™
|First full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Evidence Recovery for Windows Server® 2003 R2
|Second full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Evidence Recovery for the Windows XP™ operating system
|Third full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Linux Data Forensics Training
|Distance Learning Format
|http://www.crazytrain.com/training.html
|-
|MaresWare Suite Training
|First full week every month, Atlanta, GA
|http://www.maresware.com/maresware/training/maresware.htm
|-
|SANS On-Demand Training
|Distance Learning Format
|http://www.sans.org/ondemand/?portal=69456f95660ade45be29c00b0c14aea1
|-
|}

==[[Scheduled Training Courses]]==

Upcoming events

2008-07-01T04:26:48Z

Rmislan: /* Calls For Papers */

PLEASE READ BEFORE YOU EDIT THE LISTS BELOW 
Events should be posted in the correct section, and in date order. An event should NEVER be listed in more than one section (i.e. Ongoing/Continuous events should not be listed in Scheduled Training). When events begin the same day, events of a longer length should be listed first. New postings of events with the same date(s) as other events should be added after events already in the list. If a provider offers the same event at several locations simultaneously, the listing should have a single (ONE) entry in the list with the date(s) and ALL locations for the event. Please use three-letter month abbreviations (i.e. Sep, NOT Sept. or September), use two digit dates (i.e. Jan 01 NOT Jan 1), and use date ranges rather than listing every date during an event(i.e. Jan 02-05, NOT Jan 02, 03, 04, 05). 
Some conferences or training opportunities may be limited to Law Enforcement Only or to a specific audience. Such restrictions should be noted when known.

This is a BY DATE listing of upcoming conferences and training events relevant to [[digital forensics]]. It is not an all inclusive list, but includes most well-known activities. Some events may duplicate events on the generic [[conferences]] page, but entries in this list have specific dates and locations for the upcoming event.

This listing is divided into four sections (described as follows): 
<ol><li>Calls For Papers - Calls for papers for either Journals or for Conferences, relevant to Digital Forensics (Name, Closing Date, URL)</li> 
<li>Conferences - Conferences relevant for Digital Forensics (Name, Date, Location, URL)</li> 
<li>On-Going / Continuous Training - Training opportunities that are either always available online/distance learning format or that are offered the same time every month (Name, date-if applicable, URL)</li> 
<li>[[Scheduled Training Courses]] - Training Classes/Courses that are scheduled for specific dates/locations. This would include online (or distance learning format) courses which begin on specific dates, instead of the "start anytime" courses listed in the previous section. (Name, Date(s), Location(s), URL) (''note: this has been moved to its own page.'') </li></ol>

The Conference and Training List is provided by the American Academy of Forensic Sciences (AAFS) Digital and Multimedia Sciences Section Listserv.
 (Subscribe by sending an email to listserv@lists.mitre.org with message body containing SUBSCRIBE AAFS-DIGITAL-MULTIMEDIA-LIST)
Requests for additions, deletions or corrections to this list may be sent by email to David Baker (bakerd AT mitre.org).

== Calls For Papers ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Due Date
! Website
|-
|Call for Chapter: Handbook of Research on Computational Forensics, Digital Crime and Investigation: Methods and Solutions
|Jun 30, 2008
|http://www.dcs.warwick.ac.uk/~ctli/Call_For_Chapters_2.html
|-
|2009 DOD Cyber Crime Conference
|Jul 01, 2008
|http://www.dodcybercrime.com/9CC/call_for_papers.asp
|-
|ANZFSS - 19th International Symposium on the Forensic Sciences
|Jul 06, 2008
|http://www.anzfss2008.org.au/content/view/56/63/
|-
|DeepSec 2008
|Jul 15, 2008
|https://deepsec.net/cfp/
|-
|American Academy of Forensic Sciences Annual Meeting
|Aug 01, 2008
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
|-
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
|Oct 15, 2008
|http://www.ifip119.org/Conferences/WG11-9-CFP-2009.pdf
|-
|-
|3rd Edition of Small Scale Digital Device Forensics Journal
|Jan 31, 2009
|http://www.ssddfj.org/Call.asp
|}

== Conferences ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Date/Location
! Website
|-
|International Association of Forensic Sciences Annual Meeting
|Jul 21-26, New Orleans, LA
|http://www.iafs2008.com/
|-
|17th USENIX Security Symposium
|Jul 28-Aug 01, San Jose, CA
|http://www.usenix.org/events/sec08/
|-
|Blackhat USA 2008 Briefings & Training
|Aug 02-07, Las Vegas, NV
|http://www.blackhat.com/html/bh-link/briefings.html
|-
|2nd International Workshop on Computational Forensics
|Aug 07-08, Washington, DC
|http://iwcf08.arsforensica.org
|-
|Defcon 16
|Aug 08-10, Las Vegas, NV
|http://www.defcon.org
|-
|Digital Forensic Research Workshop
|Aug 11-13, Baltimore, MD
|http://www.dfrws.org
|-
|International Workshop on Digital Crime and Forensics in conjunction w/4th International Conference on Intelligent Information Hiding and Multimedia Signal Processing
|Aug 15-17, Harbin, China
|http://www.dcs.warwick.ac.uk/~ctli/CFP_IWDCF2008.html
|-
|2nd French-Speaking Days on Digital Investigations - Journées Francophones de l'Investigation Numérique 2008
|Sep 03-05, Vandoeuvre-lès-Nancy, France
|http://www.afsin.org/
|-
|1st Workshop on Open Source Software for Computer and Network Forensics
|Sep 07-10, Milan Italy
|http://conferenze.dei.polimi.it/ossconf/index.php
|-
|11th International Symposium on Recent Advances in Intrusion Detection
|Sep 15-17, Cambridge, MA
|http://www.ll.mit.edu/IST/RAID2008/
|-
|4th International Conference on IT Incident Management & IT Forensics
|Sep 23-25, Mannheim, Germany
|http://www.imf-conference.org/
|-
|VB2008 anti-malware conference
|Oct 01-03, Ottawa, Canada
|http://www.virusbtn.com/conference/vb2008/
|-
|ANZFSS - 19th International Symposium on the Forensic Sciences
|Oct 06-09, Melbourne, Australia
|http://www.anzfss2008.org.au/
|-
|13th European Symposium on Research in Computer Security
|Oct 06-08, Malaga, Spain
|http://www.isac.uma.es/esorics08/
|-
|Economic and High Tech Crime Summit 2008
|Oct 07-08, Memphis, TN
|http://summit.nw3c.org/
|-
|3nd International Annual Workshop on Digital Forensics & Incident Analysis
|Oct 09, Malaga, Spain
|http://www.icsd.aegean.gr/wdfia08/
|-
|Anti-Phishing Working Group eCrime Researchers Summit
|Oct 15-16, Atlanta, GA
|http://www.ecrimeresearch.org/
|-
|2008 HTCIA International Training Conference
|Oct 22-28, Atlantic City, NJ
|http://www.htcia.org/conference.shtml
|-
|DeepSec 2008
|Nov 11-14, Vienna, Austria
|https://deepsec.net/
|-
|2009 DoD Cyber Crime Conference
|Jan 24-30, St. Louis, MO
|http://www.dodcybercrime.com/
|-
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
|Jan 25-28, Orlando, FL
|http://www.ifip119.org/Conferences/
|-
|American Academy of Forensic Sciences Annual Meeting
|Feb 16-21, Denver, CO
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
|-
|2009 Techno Security Conference
|May 31- Jun 03, Myrtle Beach, SC
|http://www.techsec.com/index.html
|-
|-
|Mobile Forensics World 2009
|Jun 01 - Jun 06, Chicago, IL
|http://www.mobileforensicsworld.com
|}

== On-going / Continuous Training ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Date/Location or Venue
! Website
|-
|Basic Computer Examiner Course - Computer Forensic Training Online
|Distance Learning Format
|http://www.cftco.com
|-
|Computer Forensics Training and CCE™ Testing for Litigation Support Professionals
|Third weekend of every month (Fri-Mon), Dallas, TX
|http://www.md5group.com
|-
|Evidence Recovery for Windows Vista™
|First full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Evidence Recovery for Windows Server® 2003 R2
|Second full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Evidence Recovery for the Windows XP™ operating system
|Third full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Linux Data Forensics Training
|Distance Learning Format
|http://www.crazytrain.com/training.html
|-
|MaresWare Suite Training
|First full week every month, Atlanta, GA
|http://www.maresware.com/maresware/training/maresware.htm
|-
|SANS On-Demand Training
|Distance Learning Format
|http://www.sans.org/ondemand/?portal=69456f95660ade45be29c00b0c14aea1
|-
|Smart Phone Forensics Training Investigative Support
|Monthly (Various Locations)
|http://www.SmartPhoneForensics.com
|-
|}

==[[Scheduled Training Courses]]==

Upcoming events

2008-07-01T04:24:27Z

Rmislan: /* On-going / Continuous Training */

PLEASE READ BEFORE YOU EDIT THE LISTS BELOW 
Events should be posted in the correct section, and in date order. An event should NEVER be listed in more than one section (i.e. Ongoing/Continuous events should not be listed in Scheduled Training). When events begin the same day, events of a longer length should be listed first. New postings of events with the same date(s) as other events should be added after events already in the list. If a provider offers the same event at several locations simultaneously, the listing should have a single (ONE) entry in the list with the date(s) and ALL locations for the event. Please use three-letter month abbreviations (i.e. Sep, NOT Sept. or September), use two digit dates (i.e. Jan 01 NOT Jan 1), and use date ranges rather than listing every date during an event(i.e. Jan 02-05, NOT Jan 02, 03, 04, 05). 
Some conferences or training opportunities may be limited to Law Enforcement Only or to a specific audience. Such restrictions should be noted when known.

This is a BY DATE listing of upcoming conferences and training events relevant to [[digital forensics]]. It is not an all inclusive list, but includes most well-known activities. Some events may duplicate events on the generic [[conferences]] page, but entries in this list have specific dates and locations for the upcoming event.

This listing is divided into four sections (described as follows): 
<ol><li>Calls For Papers - Calls for papers for either Journals or for Conferences, relevant to Digital Forensics (Name, Closing Date, URL)</li> 
<li>Conferences - Conferences relevant for Digital Forensics (Name, Date, Location, URL)</li> 
<li>On-Going / Continuous Training - Training opportunities that are either always available online/distance learning format or that are offered the same time every month (Name, date-if applicable, URL)</li> 
<li>[[Scheduled Training Courses]] - Training Classes/Courses that are scheduled for specific dates/locations. This would include online (or distance learning format) courses which begin on specific dates, instead of the "start anytime" courses listed in the previous section. (Name, Date(s), Location(s), URL) (''note: this has been moved to its own page.'') </li></ol>

The Conference and Training List is provided by the American Academy of Forensic Sciences (AAFS) Digital and Multimedia Sciences Section Listserv.
 (Subscribe by sending an email to listserv@lists.mitre.org with message body containing SUBSCRIBE AAFS-DIGITAL-MULTIMEDIA-LIST)
Requests for additions, deletions or corrections to this list may be sent by email to David Baker (bakerd AT mitre.org).

== Calls For Papers ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Due Date
! Website
|-
|Call for Chapter: Handbook of Research on Computational Forensics, Digital Crime and Investigation: Methods and Solutions
|Jun 30, 2008
|http://www.dcs.warwick.ac.uk/~ctli/Call_For_Chapters_2.html
|-
|2009 DOD Cyber Crime Conference
|Jul 01, 2008
|http://www.dodcybercrime.com/9CC/call_for_papers.asp
|-
|ANZFSS - 19th International Symposium on the Forensic Sciences
|Jul 06, 2008
|http://www.anzfss2008.org.au/content/view/56/63/
|-
|DeepSec 2008
|Jul 15, 2008
|https://deepsec.net/cfp/
|-
|American Academy of Forensic Sciences Annual Meeting
|Aug 01, 2008
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
|-
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
|Oct 15, 2008
|http://www.ifip119.org/Conferences/WG11-9-CFP-2009.pdf
|-
|}

== Conferences ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Date/Location
! Website
|-
|International Association of Forensic Sciences Annual Meeting
|Jul 21-26, New Orleans, LA
|http://www.iafs2008.com/
|-
|17th USENIX Security Symposium
|Jul 28-Aug 01, San Jose, CA
|http://www.usenix.org/events/sec08/
|-
|Blackhat USA 2008 Briefings & Training
|Aug 02-07, Las Vegas, NV
|http://www.blackhat.com/html/bh-link/briefings.html
|-
|2nd International Workshop on Computational Forensics
|Aug 07-08, Washington, DC
|http://iwcf08.arsforensica.org
|-
|Defcon 16
|Aug 08-10, Las Vegas, NV
|http://www.defcon.org
|-
|Digital Forensic Research Workshop
|Aug 11-13, Baltimore, MD
|http://www.dfrws.org
|-
|International Workshop on Digital Crime and Forensics in conjunction w/4th International Conference on Intelligent Information Hiding and Multimedia Signal Processing
|Aug 15-17, Harbin, China
|http://www.dcs.warwick.ac.uk/~ctli/CFP_IWDCF2008.html
|-
|2nd French-Speaking Days on Digital Investigations - Journées Francophones de l'Investigation Numérique 2008
|Sep 03-05, Vandoeuvre-lès-Nancy, France
|http://www.afsin.org/
|-
|1st Workshop on Open Source Software for Computer and Network Forensics
|Sep 07-10, Milan Italy
|http://conferenze.dei.polimi.it/ossconf/index.php
|-
|11th International Symposium on Recent Advances in Intrusion Detection
|Sep 15-17, Cambridge, MA
|http://www.ll.mit.edu/IST/RAID2008/
|-
|4th International Conference on IT Incident Management & IT Forensics
|Sep 23-25, Mannheim, Germany
|http://www.imf-conference.org/
|-
|VB2008 anti-malware conference
|Oct 01-03, Ottawa, Canada
|http://www.virusbtn.com/conference/vb2008/
|-
|ANZFSS - 19th International Symposium on the Forensic Sciences
|Oct 06-09, Melbourne, Australia
|http://www.anzfss2008.org.au/
|-
|13th European Symposium on Research in Computer Security
|Oct 06-08, Malaga, Spain
|http://www.isac.uma.es/esorics08/
|-
|Economic and High Tech Crime Summit 2008
|Oct 07-08, Memphis, TN
|http://summit.nw3c.org/
|-
|3nd International Annual Workshop on Digital Forensics & Incident Analysis
|Oct 09, Malaga, Spain
|http://www.icsd.aegean.gr/wdfia08/
|-
|Anti-Phishing Working Group eCrime Researchers Summit
|Oct 15-16, Atlanta, GA
|http://www.ecrimeresearch.org/
|-
|2008 HTCIA International Training Conference
|Oct 22-28, Atlantic City, NJ
|http://www.htcia.org/conference.shtml
|-
|DeepSec 2008
|Nov 11-14, Vienna, Austria
|https://deepsec.net/
|-
|2009 DoD Cyber Crime Conference
|Jan 24-30, St. Louis, MO
|http://www.dodcybercrime.com/
|-
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
|Jan 25-28, Orlando, FL
|http://www.ifip119.org/Conferences/
|-
|American Academy of Forensic Sciences Annual Meeting
|Feb 16-21, Denver, CO
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
|-
|2009 Techno Security Conference
|May 31- Jun 03, Myrtle Beach, SC
|http://www.techsec.com/index.html
|-
|-
|Mobile Forensics World 2009
|Jun 01 - Jun 06, Chicago, IL
|http://www.mobileforensicsworld.com
|}

== On-going / Continuous Training ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Date/Location or Venue
! Website
|-
|Basic Computer Examiner Course - Computer Forensic Training Online
|Distance Learning Format
|http://www.cftco.com
|-
|Computer Forensics Training and CCE™ Testing for Litigation Support Professionals
|Third weekend of every month (Fri-Mon), Dallas, TX
|http://www.md5group.com
|-
|Evidence Recovery for Windows Vista™
|First full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Evidence Recovery for Windows Server® 2003 R2
|Second full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Evidence Recovery for the Windows XP™ operating system
|Third full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Linux Data Forensics Training
|Distance Learning Format
|http://www.crazytrain.com/training.html
|-
|MaresWare Suite Training
|First full week every month, Atlanta, GA
|http://www.maresware.com/maresware/training/maresware.htm
|-
|SANS On-Demand Training
|Distance Learning Format
|http://www.sans.org/ondemand/?portal=69456f95660ade45be29c00b0c14aea1
|-
|Smart Phone Forensics Training Investigative Support
|Monthly (Various Locations)
|http://www.SmartPhoneForensics.com
|-
|}

==[[Scheduled Training Courses]]==

Upcoming events

2008-07-01T04:22:46Z

Rmislan: /* Conferences */

PLEASE READ BEFORE YOU EDIT THE LISTS BELOW 
Events should be posted in the correct section, and in date order. An event should NEVER be listed in more than one section (i.e. Ongoing/Continuous events should not be listed in Scheduled Training). When events begin the same day, events of a longer length should be listed first. New postings of events with the same date(s) as other events should be added after events already in the list. If a provider offers the same event at several locations simultaneously, the listing should have a single (ONE) entry in the list with the date(s) and ALL locations for the event. Please use three-letter month abbreviations (i.e. Sep, NOT Sept. or September), use two digit dates (i.e. Jan 01 NOT Jan 1), and use date ranges rather than listing every date during an event(i.e. Jan 02-05, NOT Jan 02, 03, 04, 05). 
Some conferences or training opportunities may be limited to Law Enforcement Only or to a specific audience. Such restrictions should be noted when known.

This is a BY DATE listing of upcoming conferences and training events relevant to [[digital forensics]]. It is not an all inclusive list, but includes most well-known activities. Some events may duplicate events on the generic [[conferences]] page, but entries in this list have specific dates and locations for the upcoming event.

This listing is divided into four sections (described as follows): 
<ol><li>Calls For Papers - Calls for papers for either Journals or for Conferences, relevant to Digital Forensics (Name, Closing Date, URL)</li> 
<li>Conferences - Conferences relevant for Digital Forensics (Name, Date, Location, URL)</li> 
<li>On-Going / Continuous Training - Training opportunities that are either always available online/distance learning format or that are offered the same time every month (Name, date-if applicable, URL)</li> 
<li>[[Scheduled Training Courses]] - Training Classes/Courses that are scheduled for specific dates/locations. This would include online (or distance learning format) courses which begin on specific dates, instead of the "start anytime" courses listed in the previous section. (Name, Date(s), Location(s), URL) (''note: this has been moved to its own page.'') </li></ol>

The Conference and Training List is provided by the American Academy of Forensic Sciences (AAFS) Digital and Multimedia Sciences Section Listserv.
 (Subscribe by sending an email to listserv@lists.mitre.org with message body containing SUBSCRIBE AAFS-DIGITAL-MULTIMEDIA-LIST)
Requests for additions, deletions or corrections to this list may be sent by email to David Baker (bakerd AT mitre.org).

== Calls For Papers ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Due Date
! Website
|-
|Call for Chapter: Handbook of Research on Computational Forensics, Digital Crime and Investigation: Methods and Solutions
|Jun 30, 2008
|http://www.dcs.warwick.ac.uk/~ctli/Call_For_Chapters_2.html
|-
|2009 DOD Cyber Crime Conference
|Jul 01, 2008
|http://www.dodcybercrime.com/9CC/call_for_papers.asp
|-
|ANZFSS - 19th International Symposium on the Forensic Sciences
|Jul 06, 2008
|http://www.anzfss2008.org.au/content/view/56/63/
|-
|DeepSec 2008
|Jul 15, 2008
|https://deepsec.net/cfp/
|-
|American Academy of Forensic Sciences Annual Meeting
|Aug 01, 2008
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
|-
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
|Oct 15, 2008
|http://www.ifip119.org/Conferences/WG11-9-CFP-2009.pdf
|-
|}

== Conferences ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Date/Location
! Website
|-
|International Association of Forensic Sciences Annual Meeting
|Jul 21-26, New Orleans, LA
|http://www.iafs2008.com/
|-
|17th USENIX Security Symposium
|Jul 28-Aug 01, San Jose, CA
|http://www.usenix.org/events/sec08/
|-
|Blackhat USA 2008 Briefings & Training
|Aug 02-07, Las Vegas, NV
|http://www.blackhat.com/html/bh-link/briefings.html
|-
|2nd International Workshop on Computational Forensics
|Aug 07-08, Washington, DC
|http://iwcf08.arsforensica.org
|-
|Defcon 16
|Aug 08-10, Las Vegas, NV
|http://www.defcon.org
|-
|Digital Forensic Research Workshop
|Aug 11-13, Baltimore, MD
|http://www.dfrws.org
|-
|International Workshop on Digital Crime and Forensics in conjunction w/4th International Conference on Intelligent Information Hiding and Multimedia Signal Processing
|Aug 15-17, Harbin, China
|http://www.dcs.warwick.ac.uk/~ctli/CFP_IWDCF2008.html
|-
|2nd French-Speaking Days on Digital Investigations - Journées Francophones de l'Investigation Numérique 2008
|Sep 03-05, Vandoeuvre-lès-Nancy, France
|http://www.afsin.org/
|-
|1st Workshop on Open Source Software for Computer and Network Forensics
|Sep 07-10, Milan Italy
|http://conferenze.dei.polimi.it/ossconf/index.php
|-
|11th International Symposium on Recent Advances in Intrusion Detection
|Sep 15-17, Cambridge, MA
|http://www.ll.mit.edu/IST/RAID2008/
|-
|4th International Conference on IT Incident Management & IT Forensics
|Sep 23-25, Mannheim, Germany
|http://www.imf-conference.org/
|-
|VB2008 anti-malware conference
|Oct 01-03, Ottawa, Canada
|http://www.virusbtn.com/conference/vb2008/
|-
|ANZFSS - 19th International Symposium on the Forensic Sciences
|Oct 06-09, Melbourne, Australia
|http://www.anzfss2008.org.au/
|-
|13th European Symposium on Research in Computer Security
|Oct 06-08, Malaga, Spain
|http://www.isac.uma.es/esorics08/
|-
|Economic and High Tech Crime Summit 2008
|Oct 07-08, Memphis, TN
|http://summit.nw3c.org/
|-
|3nd International Annual Workshop on Digital Forensics & Incident Analysis
|Oct 09, Malaga, Spain
|http://www.icsd.aegean.gr/wdfia08/
|-
|Anti-Phishing Working Group eCrime Researchers Summit
|Oct 15-16, Atlanta, GA
|http://www.ecrimeresearch.org/
|-
|2008 HTCIA International Training Conference
|Oct 22-28, Atlantic City, NJ
|http://www.htcia.org/conference.shtml
|-
|DeepSec 2008
|Nov 11-14, Vienna, Austria
|https://deepsec.net/
|-
|2009 DoD Cyber Crime Conference
|Jan 24-30, St. Louis, MO
|http://www.dodcybercrime.com/
|-
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
|Jan 25-28, Orlando, FL
|http://www.ifip119.org/Conferences/
|-
|American Academy of Forensic Sciences Annual Meeting
|Feb 16-21, Denver, CO
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
|-
|2009 Techno Security Conference
|May 31- Jun 03, Myrtle Beach, SC
|http://www.techsec.com/index.html
|-
|-
|Mobile Forensics World 2009
|Jun 01 - Jun 06, Chicago, IL
|http://www.mobileforensicsworld.com
|}

== On-going / Continuous Training ==
{| border="0" cellpadding="2" cellspacing="2" align="top"
|- style="background:#bfbfbf; font-weight: bold"
! Title
! Date/Location or Venue
! Website
|-
|Basic Computer Examiner Course - Computer Forensic Training Online
|Distance Learning Format
|http://www.cftco.com
|-
|Linux Data Forensics Training
|Distance Learning Format
|http://www.crazytrain.com/training.html
|-
|SANS On-Demand Training
|Distance Learning Format
|http://www.sans.org/ondemand/?portal=69456f95660ade45be29c00b0c14aea1
|-
|MaresWare Suite Training
|First full week every month, Atlanta, GA
|http://www.maresware.com/maresware/training/maresware.htm
|-
|Evidence Recovery for Windows Vista™
|First full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Evidence Recovery for Windows Server® 2003 R2
|Second full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Evidence Recovery for the Windows XP™ operating system
|Third full week every month, Brunswick, GA
|http://www.internetcrimes.net
|-
|Computer Forensics Training and CCE™ Testing for Litigation Support Professionals
|Third weekend of every month (Fri-Mon), Dallas, TX
|http://www.md5group.com
|-
|}
==[[Scheduled Training Courses]]==

Cell Phone Forensics

2008-02-21T02:42:01Z

Rmislan:

== Guidelines ==

# If on, switch it off. If off, leave off.

#* Note only under exceptional circumstances should the handset be left switched on and in any case every precaution to prevent the handset connecting with the Communication Service Provider should be made. Consider use of one of many [[wireless preservation]] or [[RF isolation]] techniques. Note that the slightest signal leakage will allow an overwriting text message through even if a phone call can't get through.

#* Instead of switching off, it may be better to remove the battery. Phones run a different part of their program when they are turned off. You may wish to avoid having this part of the program run.

#* Note that removing the battery or powering off a mobile phone may introduce a handset unlock code upon powering the device on.

# Collect and preserve other surrounding and related devices. Be especially careful to collect the power charger. The phone's battery will only last a certain amount of time. When it dies, much of the data on the device may go too!

# Plug the phone in, preferably in the evidence room, as soon as possible.
# Retain [[search warrant]] (if necessary - [[LE]]).
# Return device to forensic lab if able.
# Use [[forensically sound]] tools for processing. However, also remember ACPO Principle 2 says: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.

== Notes ==

Expand on as to what to collect:

* [[ESN]],
* [[IMEI]],
* [[Carrier]],
* Manufacturer,
* Model Number,
* Color, and
* Other information related to [[Cell Phone]] and [[SIM Card]]...

Process:
# Photograph the [[Cell Phone]] screen during power up.
# Research the [[Cell Phone]] for technical specifications.
# Research the [[Cell Phone]] for forensic information.
# Based on phone type [[GSM]], [[CDMA]], [[iDEN]], or [[Pay As You Go]] determine acquisition tools

GSM:
# Phone and SIM Card
# SIM Card

CDMA:
# Phone

iDEN:
# Three major tools exist for iDEN Phones:
* iDEN Companion Pro
* iDEN Media Downloader
* iDEN Phonebook Manager

Pay As You Go:
# Phone

== External Links ==

Articles and Reference Materials
*[http://www.e-evidence.info/cellarticles.html E-Evidence.Info Articles, Papers, Presentations, etc.]
*[http://esm.cis.unisa.edu.au/new_esml/resources/publications/forensic%20analysis%20of%20mobile%20phones.pdf Forensic Analysis of Mobile Phones]
*[http://www.ijde.org/docs/03_spring_art1.pdf Forensics and the GSM Mobile Telephone System]
*[http://www.cl.cam.ac.uk/~fms27/persec-2006/goodies/2006-Naccache-forensic.pdf Law Enforcement, Forensics and Mobile Communications]
*[http://www.forensics.nl/mobile-pda-forensics Mobile Phone Forensics & PDA Forensics Links]
*[http://www.holmes.nl/MPF/FlowChartForensicMobilePhoneExamination.htm Netherlands Forensic Institute: Mobile Phone Forensics Examination - Basic Workflow and Preservation]
*[http://csrc.nist.gov/mobilesecurity/publications.html#MF U.S. National Institute of Standards and Technology Documents]

Conferences
*[http://www.MobileForensicsWorld.com/ Mobile Forensics World]

Investigative Support
*[http://www.search.org/files/pdf/CellphoneInvestToolkit-0806.pdf Creating a Cell Phone Investigation Toolkit: Basic Hardware and Software Specifications]
*[http://www.e-evidence.info/cellular.html E-Evidence.Info Mobile Forensic Tools]
*[http://www.forensicfocus.com ForensicFocus.com(Practitioners Forum)]
*[http://www.hex-dump.com Hex-Dump.com(Advanced Forum for Hex Dump and Memory Analysis)]
*[http://www.Mobile-Examiner.com Mobile-Examiner.com (Forum for Practitioners)]
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
*[http://www.mfi-training.com Mobile Forensics Training Forum (Mobile Device Investigative Support and Training)]
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]
*[http://www.Phone-Forensics.com Phone-Forensics.com (Advanced Forum for Practitioners)]
*[http://trewmte.blogspot.com TREW Mobile Telephone Evidence (Mobile Telephone Evidence Practitioner Site)]

Phone Research
*[http://www.GSMArena.com GSMArena.com (Technical information regarding GSM Cell Phones)]
*[http://www.MobileForensicsCentral.com MobileForensicsCentral.com (Information regarding Cell Phone Forensic Applications)]
*[http://www.PhoneScoop.com PhoneScoop.com (Technical information regarding all Cell Phones)]
*[http://www.ssddforensics.com/ Small Scale Digital Device Forensics Information]

Training
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
*[http://www.MobileForensicsWorld.com/Training.aspx Mobile Forensics World Training]
*[http://www.mobileforensicstraining.com Mobile Forensics Training (Mobile Forensics Inc. Training Class site)]
*[http://www.paraben-training.com/training.html Paraben-Forensics.com (Paraben's Handheld Forensic Training Classes)]
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]

Cell Phone Forensics

2008-02-21T02:41:13Z

Rmislan: Update for Conference

== Guidelines ==

# If on, switch it off. If off, leave off.

#* Note only under exceptional circumstances should the handset be left switched on and in any case every precaution to prevent the handset connecting with the Communication Service Provider should be made. Consider use of one of many [[wireless preservation]] or [[RF isolation]] techniques. Note that the slightest signal leakage will allow an overwriting text message through even if a phone call can't get through.

#* Instead of switching off, it may be better to remove the battery. Phones run a different part of their program when they are turned off. You may wish to avoid having this part of the program run.

#* Note that removing the battery or powering off a mobile phone may introduce a handset unlock code upon powering the device on.

# Collect and preserve other surrounding and related devices. Be especially careful to collect the power charger. The phone's battery will only last a certain amount of time. When it dies, much of the data on the device may go too!

# Plug the phone in, preferably in the evidence room, as soon as possible.
# Retain [[search warrant]] (if necessary - [[LE]]).
# Return device to forensic lab if able.
# Use [[forensically sound]] tools for processing. However, also remember ACPO Principle 2 says: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.

== Notes ==

Expand on as to what to collect:

* [[ESN]],
* [[IMEI]],
* [[Carrier]],
* Manufacturer,
* Model Number,
* Color, and
* Other information related to [[Cell Phone]] and [[SIM Card]]...

Process:
# Photograph the [[Cell Phone]] screen during power up.
# Research the [[Cell Phone]] for technical specifications.
# Research the [[Cell Phone]] for forensic information.
# Based on phone type [[GSM]], [[CDMA]], [[iDEN]], or [[Pay As You Go]] determine acquisition tools

GSM:
# Phone and SIM Card
# SIM Card

CDMA:
# Phone

iDEN:
# Three major tools exist for iDEN Phones:
* iDEN Companion Pro
* iDEN Media Downloader
* iDEN Phonebook Manager

Pay As You Go:
# Phone

== External Links ==

Articles and Reference Materials
*[http://www.e-evidence.info/cellarticles.html E-Evidence.Info Articles, Papers, Presentations, etc.]
*[http://esm.cis.unisa.edu.au/new_esml/resources/publications/forensic%20analysis%20of%20mobile%20phones.pdf Forensic Analysis of Mobile Phones]
*[http://www.ijde.org/docs/03_spring_art1.pdf Forensics and the GSM Mobile Telephone System]
*[http://www.cl.cam.ac.uk/~fms27/persec-2006/goodies/2006-Naccache-forensic.pdf Law Enforcement, Forensics and Mobile Communications]
*[http://www.forensics.nl/mobile-pda-forensics Mobile Phone Forensics & PDA Forensics Links]
*[http://www.holmes.nl/MPF/FlowChartForensicMobilePhoneExamination.htm Netherlands Forensic Institute: Mobile Phone Forensics Examination - Basic Workflow and Preservation]
*[http://csrc.nist.gov/mobilesecurity/publications.html#MF U.S. National Institute of Standards and Technology Documents]

Conferences
*[http://www.MobileForensicsWorld.com/#Mobile Forensics World]

Investigative Support
*[http://www.search.org/files/pdf/CellphoneInvestToolkit-0806.pdf Creating a Cell Phone Investigation Toolkit: Basic Hardware and Software Specifications]
*[http://www.e-evidence.info/cellular.html E-Evidence.Info Mobile Forensic Tools]
*[http://www.forensicfocus.com ForensicFocus.com(Practitioners Forum)]
*[http://www.hex-dump.com Hex-Dump.com(Advanced Forum for Hex Dump and Memory Analysis)]
*[http://www.Mobile-Examiner.com Mobile-Examiner.com (Forum for Practitioners)]
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
*[http://www.mfi-training.com Mobile Forensics Training Forum (Mobile Device Investigative Support and Training)]
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]
*[http://www.Phone-Forensics.com Phone-Forensics.com (Advanced Forum for Practitioners)]
*[http://trewmte.blogspot.com TREW Mobile Telephone Evidence (Mobile Telephone Evidence Practitioner Site)]

Phone Research
*[http://www.GSMArena.com GSMArena.com (Technical information regarding GSM Cell Phones)]
*[http://www.MobileForensicsCentral.com MobileForensicsCentral.com (Information regarding Cell Phone Forensic Applications)]
*[http://www.PhoneScoop.com PhoneScoop.com (Technical information regarding all Cell Phones)]
*[http://www.ssddforensics.com/ Small Scale Digital Device Forensics Information]

Training
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
*[http://www.MobileForensicsWorld.com/Training.aspx#Mobile Forensics World Training]
*[http://www.mobileforensicstraining.com Mobile Forensics Training (Mobile Forensics Inc. Training Class site)]
*[http://www.paraben-training.com/training.html Paraben-Forensics.com (Paraben's Handheld Forensic Training Classes)]
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]

Conferences

2008-02-21T02:38:18Z

Rmislan: /* Training Conferences */

This is a list of '''conferences''' in the [[computer forensics]] field.

[[Brian Carrier]] keeps a list of conferences and journals at http://www.digital-evidence.org/publish/index.html. This list was originally taken from Brian's and used with his permission.

For Dates and Locations of upcoming conferences and training events, see the pages titled [[Upcoming events]] (Calls for papers, Conferences and On-Demand Training) and [[Scheduled Training Courses]] (Training Classes/Courses scheduled for specific dates/locations).

=Annual Conferences and Workshops=

Research (not training) conferences that are interested in digital investigation and forensics.

;American Academy of Forensic Science
:http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting

;Australian Digital Forensics Conference
:http://scissec.scis.ecu.edu.au/conferences2006/index.php?cf=3

;BlackHat Japan Briefings & Training
:http://japan.blackhat.com/

;BlackHat Federal Briefings & Training
:http://www.blackhat.com/html/bh-link/briefings.html

;CanSecWest
:http://cansecwest.com/

;Computer Security Institute NetSec
:http://www.gocsi.com/netsec/

;Conference on Digital Forensics, Security and Law
:http://www.digitalforensics-conference.org/

;CyberCrime Summit
:http://www.cybercrimesummit.com/index.htm

;Department of Defense CyberCrime Conference
:http://www.dodcybercrime.com/

;Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)
:http://www.gi-ev.de/fachbereiche/sicherheit/fg/sidar/dimva/

;E-Crime and Computer Evidence
:http://www.ecce-conference.com

;FIRST Conference
:http://www.first.org/conference/2007/

;IFIP International Information Security Conference
:http://www.sbs.co.za/ifipsec2007/

;IFIP WG 11.9 International Conference on Digital Forensics
:http://www.cis.utulsa.edu/ifip119/Conferences/WG11-9CallForPapers.asp

;International Conference on IT-Incident Management & IT-Forensics
:http://www.imf-conference.org

;Mobile Forensics World
:http://www.MobileForensicsWorld.com/

;PacSec Conference
:http://pacsec.jp/

;Security OPUS Information Security Conference
:http://www.securityopus.com/index.php

;Techno Forensics Conference
:http://www.techsec.com/html/TechnoForensics2006.htm

;Techno-Security Conference
:http://www.techsec.com/html/Techno2007.html

;USENIX Annual Technical Conference
:http://www.usenix.org/events/

;USENIX Security Symposium
:http://www.usenix.org/events/

= Training Conferences =

;ChicagoCon - White Hats Come Together in Defense of the Digital Frontier
:http://www.chicagocon.com

;Computer and Enterprise Investigations Conference (CEIC)
:http://www.ceic2007.com/

;HTCIA International Training Conference and Expo
:http://www.ohiohtcia.org/conf_main.html

;IACIS Computer Forensic Training Event
:http://www.iacis.com/iacisv2/pages/training.php

;IACIS Training - Germany
:http://www.iacis.com/iacisv2/pages/training.php

;Mobile Forensics World Training
:http://www.MobileForensicsWorld.com/Training.aspx

;Regional Computer Forensics Group Conference (RCFG)
:http://www.rcfg.org

;SANS System Forensics, Investigation & Response
:http://www.sans.org/training/description.php?mid=98&portal=7b06ddbc6d2924557f88c17e78348310

= See also =

* [[Upcoming events]].
* [[Upcoming Conference Deadlines]]

Cell Phone Forensics

2007-10-30T02:04:40Z

Rmislan: Additional Links added....in alpha order...

== Guidelines ==

# If on, switch it off. If off, leave off.

#* Note only under exceptional circumstances should the handset be left switched on and in any case every precaution to prevent the handset connecting with the Communication Service Provider should be made. Consider use of one of many [[wireless preservation]] or [[RF isolation]] techniques. Note that the slightest signal leakage will allow an overwriting text message through even if a phone call can't get through.

#* Instead of switching off, it may be better to remove the battery. Phones run a different part of their program when they are turned off. You may wish to avoid having this part of the program run.

#* Note that removing the battery or powering off a mobile phone may introduce a handset unlock code upon powering the device on.

# Collect and preserve other surrounding and related devices. Be especially careful to collect the power charger. The phone's battery will only last a certain amount of time. When it dies, much of the data on the device may go too!

# Plug the phone in, preferably in the evidence room, as soon as possible.
# Retain [[search warrant]] (if necessary - [[LE]]).
# Return device to forensic lab if able.
# Use [[forensically sound]] tools for processing. However, also remember ACPO Principle 2 says: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.

== Notes ==

Expand on as to what to collect:

* [[ESN]],
* [[IMEI]],
* [[Carrier]],
* Manufacturer,
* Model Number,
* Color, and
* Other information related to [[Cell Phone]] and [[SIM Card]]...

Process:
# Photograph the [[Cell Phone]] screen during power up.
# Research the [[Cell Phone]] for technical specifications.
# Research the [[Cell Phone]] for forensic information.
# Based on phone type [[GSM]], [[CDMA]], [[iDEN]], or [[Pay As You Go]] determine acquisition tools

GSM:
# Phone and SIM Card
# SIM Card

CDMA:
# Phone

iDEN:
# Three major tools exist for iDEN Phones:
* iDEN Companion Pro
* iDEN Media Downloader
* iDEN Phonebook Manager

Pay As You Go:
# Phone

== External Links ==

Articles and Reference Materials
*[http://www.e-evidence.info/cellarticles.html E-Evidence.Info Articles, Papers, Presentations, etc.]
*[http://esm.cis.unisa.edu.au/new_esml/resources/publications/forensic%20analysis%20of%20mobile%20phones.pdf Forensic Analysis of Mobile Phones]
*[http://www.ijde.org/docs/03_spring_art1.pdf Forensics and the GSM Mobile Telephone System]
*[http://www.cl.cam.ac.uk/~fms27/persec-2006/goodies/2006-Naccache-forensic.pdf Law Enforcement, Forensics and Mobile Communications]
*[http://www.forensics.nl/mobile-pda-forensics Mobile Phone Forensics & PDA Forensics Links]
*[http://www.holmes.nl/MPF/FlowChartForensicMobilePhoneExamination.htm Netherlands Forensic Institute: Mobile Phone Forensics Examination - Basic Workflow and Preservation]
*[http://csrc.nist.gov/mobilesecurity/publications.html#MF U.S. National Institute of Standards and Technology Documents]

Investigative Support
*[http://www.search.org/files/pdf/CellphoneInvestToolkit-0806.pdf Creating a Cell Phone Investigation Toolkit: Basic Hardware and Software Specifications]
*[http://www.e-evidence.info/cellular.html E-Evidence.Info Mobile Forensic Tools]
*[http://www.forensicfocus.com ForensicFocus.com(Practitioners Forum)]
*[http://www.hex-dump.com Hex-Dump.com(Advanced Forum for Hex Dump and Memory Analysis)]
*[http://www.Mobile-Examiner.com Mobile-Examiner.com (Forum for Practitioners)]
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
*[http://www.mfi-training.com Mobile Forensics Training Forum (Mobile Device Investigative Support and Training)]
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]
*[http://www.Phone-Forensics.com Phone-Forensics.com (Advanced Forum for Practitioners)]
*[http://trewmte.blogspot.com TREW Mobile Telephone Evidence (Mobile Telephone Evidence Practitioner Site)]

Phone Research
*[http://www.GSMArena.com GSMArena.com (Technical information regarding GSM Cell Phones)]
*[http://www.MobileForensicsCentral.com MobileForensicsCentral.com (Information regarding Cell Phone Forensic Applications)]
*[http://www.PhoneScoop.com PhoneScoop.com (Technical information regarding all Cell Phones)]
*[http://www.ssddforensics.com/ Small Scale Digital Device Forensics Information]

Training
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
*[http://www.mobileforensicstraining.com Mobile Forensics Training (Mobile Forensics Inc. Training Class site)]
*[http://www.paraben-training.com/training.html Paraben-Forensics.com (Paraben's Handheld Forensic Training Classes)]
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]

Cell Phone Forensics

2007-10-30T01:58:57Z

Rmislan: /* External Links */

== Guidelines ==

# If on, switch it off. If off, leave off.

#* Note only under exceptional circumstances should the handset be left switched on and in any case every precaution to prevent the handset connecting with the Communication Service Provider should be made. Consider use of one of many [[wireless preservation]] or [[RF isolation]] techniques. Note that the slightest signal leakage will allow an overwriting text message through even if a phone call can't get through.

#* Instead of switching off, it may be better to remove the battery. Phones run a different part of their program when they are turned off. You may wish to avoid having this part of the program run.

#* Note that removing the battery or powering off a mobile phone may introduce a handset unlock code upon powering the device on.

# Collect and preserve other surrounding and related devices. Be especially careful to collect the power charger. The phone's battery will only last a certain amount of time. When it dies, much of the data on the device may go too!

# Plug the phone in, preferably in the evidence room, as soon as possible.
# Retain [[search warrant]] (if necessary - [[LE]]).
# Return device to forensic lab if able.
# Use [[forensically sound]] tools for processing. However, also remember ACPO Principle 2 says: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.

== Notes ==

Expand on as to what to collect:

* [[ESN]],
* [[IMEI]],
* [[Carrier]],
* Manufacturer,
* Model Number,
* Color, and
* Other information related to [[Cell Phone]] and [[SIM Card]]...

Process:
# Photograph the [[Cell Phone]] screen during power up.
# Research the [[Cell Phone]] for technical specifications.
# Research the [[Cell Phone]] for forensic information.
# Based on phone type [[GSM]], [[CDMA]], [[iDEN]], or [[Pay As You Go]] determine acquisition tools

GSM:
# Phone and SIM Card
# SIM Card

CDMA:
# Phone

iDEN:
# Three major tools exist for iDEN Phones:
* iDEN Companion Pro
* iDEN Media Downloader
* iDEN Phonebook Manager

Pay As You Go:
# Phone

== External Links ==

Articles and Reference Materials
*[http://esm.cis.unisa.edu.au/new_esml/resources/publications/forensic%20analysis%20of%20mobile%20phones.pdf Forensic Analysis of Mobile Phones]
*[http://www.ijde.org/docs/03_spring_art1.pdf Forensics and the GSM Mobile Telephone System]
*[http://www.cl.cam.ac.uk/~fms27/persec-2006/goodies/2006-Naccache-forensic.pdf Law Enforcement, Forensics and Mobile Communications]
*[http://www.forensics.nl/mobile-pda-forensics Mobile Phone Forensics & PDA Forensics Links]
*[http://www.holmes.nl/MPF/FlowChartForensicMobilePhoneExamination.htm Netherlands Forensic Institute: Mobile Phone Forensics Examination - Basic Workflow and Preservation]
*[http://csrc.nist.gov/mobilesecurity/publications.html#MF U.S. National Institute of Standards and Technology Documents]

Investigative Support
*[http://www.search.org/files/pdf/CellphoneInvestToolkit-0806.pdf Creating a Cell Phone Investigation Toolkit: Basic Hardware and Software Specifications]
*[http://www.forensicfocus.com ForensicFocus.com(Practitioners Forum)]
*[http://www.hex-dump.com Hex-Dump.com(Advanced Forum for Hex Dump and Memory Analysis)]
*[http://www.Mobile-Examiner.com Mobile-Examiner.com (Forum for Practitioners)]
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
*[http://www.mfi-training.com Mobile Forensics Training Forum (Mobile Device Investigative Support and Training)]
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]
*[http://www.Phone-Forensics.com Phone-Forensics.com (Advanced Forum for Practitioners)]
*[http://trewmte.blogspot.com TREW Mobile Telephone Evidence (Mobile Telephone Evidence Practitioner Site)]

Phone Research
*[http://www.GSMArena.com GSMArena.com (Technical information regarding GSM Cell Phones)]
*[http://www.MobileForensicsCentral.com MobileForensicsCentral.com (Information regarding Cell Phone Forensic Applications)]
*[http://www.PhoneScoop.com PhoneScoop.com (Technical information regarding all Cell Phones)]

Training
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
*[http://www.mobileforensicstraining.com Mobile Forensics Training (Mobile Forensics Inc. Training Class site)]
*[http://www.paraben-training.com/training.html Paraben-Forensics.com (Paraben's Handheld Forensic Training Classes)]
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]

Cell Phone Forensics

2007-10-30T01:57:05Z

Rmislan: Adding & Updating links, cleaning up, and alphabetizing

== Guidelines ==

# If on, switch it off. If off, leave off.

#* Note only under exceptional circumstances should the handset be left switched on and in any case every precaution to prevent the handset connecting with the Communication Service Provider should be made. Consider use of one of many [[wireless preservation]] or [[RF isolation]] techniques. Note that the slightest signal leakage will allow an overwriting text message through even if a phone call can't get through.

#* Instead of switching off, it may be better to remove the battery. Phones run a different part of their program when they are turned off. You may wish to avoid having this part of the program run.

#* Note that removing the battery or powering off a mobile phone may introduce a handset unlock code upon powering the device on.

# Collect and preserve other surrounding and related devices. Be especially careful to collect the power charger. The phone's battery will only last a certain amount of time. When it dies, much of the data on the device may go too!

# Plug the phone in, preferably in the evidence room, as soon as possible.
# Retain [[search warrant]] (if necessary - [[LE]]).
# Return device to forensic lab if able.
# Use [[forensically sound]] tools for processing. However, also remember ACPO Principle 2 says: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.

== Notes ==

Expand on as to what to collect:

* [[ESN]],
* [[IMEI]],
* [[Carrier]],
* Manufacturer,
* Model Number,
* Color, and
* Other information related to [[Cell Phone]] and [[SIM Card]]...

Process:
# Photograph the [[Cell Phone]] screen during power up.
# Research the [[Cell Phone]] for technical specifications.
# Research the [[Cell Phone]] for forensic information.
# Based on phone type [[GSM]], [[CDMA]], [[iDEN]], or [[Pay As You Go]] determine acquisition tools

GSM:
# Phone and SIM Card
# SIM Card

CDMA:
# Phone

iDEN:
# Three major tools exist for iDEN Phones:
* iDEN Companion Pro
* iDEN Media Downloader
* iDEN Phonebook Manager

Pay As You Go:
# Phone

== External Links ==

Articles and Reference Materials
*[http://esm.cis.unisa.edu.au/new_esml/resources/publications/forensic%20analysis%20of%20mobile%20phones.pdf Forensic Analysis of Mobile Phones]
*[http://www.ijde.org/docs/03_spring_art1.pdf Forensics and the GSM Mobile Telephone System]
*[http://www.cl.cam.ac.uk/~fms27/persec-2006/goodies/2006-Naccache-forensic.pdf Law Enforcement, Forensics and Mobile Communications]
*[http://www.forensics.nl/mobile-pda-forensics Mobile Phone Forensics & PDA Forensics Links]
*[http://www.holmes.nl/MPF/FlowChartForensicMobilePhoneExamination.htm Netherlands Forensic Institute: Mobile Phone Forensics Examination - Basic Workflow and Preservation]
*[http://csrc.nist.gov/mobilesecurity/publications.html#MF U.S. National Institute of Standards and Technology Documents]

Investigative Support
*[http://www.forensicfocus.com ForensicFocus.com(Practitioners Forum)]
*[http://www.hex-dump.com Hex-Dump.com(Advanced Forum for Hex Dump and Memory Analysis)]
*[http://www.Mobile-Examiner.com Mobile-Examiner.com (Forum for Practitioners)]
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
*[http://www.mfi-training.com Mobile Forensics Training Forum (Mobile Device Investigative Support and Training)]
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]
*[http://www.Phone-Forensics.com Phone-Forensics.com (Advanced Forum for Practitioners)]
*[http://trewmte.blogspot.com TREW Mobile Telephone Evidence (Mobile Telephone Evidence Practitioner Site)]

Phone Research
*[http://www.GSMArena.com GSMArena.com (Technical information regarding GSM Cell Phones)]
*[http://www.MobileForensicsCentral.com MobileForensicsCentral.com (Information regarding Cell Phone Forensic Applications)]
*[http://www.PhoneScoop.com PhoneScoop.com (Technical information regarding all Cell Phones)]

Training
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
*[http://www.mobileforensicstraining.com Mobile Forensics Training (Mobile Forensics Inc. Training Class site)]
*[http://www.paraben-training.com/training.html Paraben-Forensics.com (Paraben's Handheld Forensic Training Classes)]
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]

Vendors

2007-10-30T01:47:51Z

Rmislan: Alphabetizing...

= Software Vendors =

; [[AccessData]] - [[Forensic Toolkit]] ([[FTK]])
: http://www.accessdata.com/products/

; [[ASR Data]] - [[SMART]]
: http://www.asrdata.com/SMART/

; [[BlackBag Technologies]]
: http://www.blackbagtech.com/software.html

; [[Computer Forensic Analysis]]
: http://www.porcupine.org/forensics/

; [[Computer Cop Forensic Examiner]]
: http://www.computercop.com/examiner.html

; [[CPR Tools]]
: http://www.cprtools.net
: Data Recovery, Data Security and Development Tools

; [[Forensic and Security Services, Inc.]] - [[Rainbow Tables]]
: http://www.For-Sec.com
; Hub/MO/VO VAR for

: AccessData
: Paraben
: Wetstone
: DiskJockey forensic
: Objectif Securite - Rainbow Tables for - LM and NT hashes and MS Office documents

; [[Guidance Software]] - [[EnCase]]
: http://www.guidancesoftware.com/products/index.asp

; [[MaresWare Software]]
: http://www.maresware.com/maresware/software.htm

; [[NTI - Forensics International]] Division of Armor Forensics
: http://www.forensics-intl.com/tools.html

; [[Nuix Pty Ltd]] - [[FBI]]
: http://www.nuix.com.au

; [[Paraben Forensics]]
: http://www.paraben-forensics.com/

; [[PyFlag]]
: http://pyflag.sourceforge.net/

; [[Steganography Analysis and Research Center / Backbone Security]]
: General Product Information http://www.sarc-wv.com/products.aspx
: Backbone Security http://www.backbonesecurity.com
: Steganography Application Fingerprint Database (SAFDB) http://www.sarc-wv.com/safdb.aspx
: Steganography Analyzer Artifact Scanner (StegAlyzerAS) http://www.sarc-wv.com/stegalyzeras.aspx
: Steganography Analyzer Signature Scanner (StegAlyzerSS) http://www.sarc-wv.com/stegalyzerss.aspx
: Steganography Analyzer Real-Time Scanner (StegAlyzerRTS) http://www.sarc-wv.com/stegalyzerrts.aspx

; [[Tech Assist, Inc.]]
: http://www.toolsthatwork.com/

; [[Technology Pathways]] - [[Pro Discover]]
: http://www.techpathways.com/

; [[Wetstone Technologies]]
:http://www.wetstonetech.com/page/page/3004314.htm

; [[X-Ways Software]]
: http://www.x-ways.net/

= Hardware Vendors =
; [[BlackBag Technologies]]
: http://www.blackbagtech.com/hardware.html
: [[Write Blockers]]

; [[CPR Tools]]
: [[Media Research and Data Recovery]]
: http://www.cprtools.net
: [[Adapters]], [[Imaging Hardware]], [[Field Kits]], [[Data Recovery tools]]

; [[Digital Intelligence]]
: http://www.digitalintelligence.com/forensichardware.php
: [[Write Blockers]], [[forensic field kit]]s, etc.

; [[Forensic and Security Services, Inc.]] - [[Field kits, write blockers]]
: http://www.For-Sec.com
; Hub/MO/VO VAR for

: AccessData
: Paraben
: Wetstone
: DiskJockey forensic

; [[Forensic-Computers]]
: http://www.forensic-computers.com/
: Various systems, [[Write Blockers]], [[forensic field kit]]s, etc.

; [[ForensicPC]]
: http://www.forensicpc.com/
: Various [[Write Blockers]], [[forensic field kit]]s, forensics software, etc.

; [[MyKey Tech]]
: http://www.mykeytech.com/
: [[Write Blockers]]

; [[Paraben Forensics]]
: http://www.paraben-forensics.com/catalog/index.php?cPath=26
: [[Write Blockers]], [[forensic field kit]]s, etc.

; [[Technology Pathways]]
: http://www.techpathways.com/
: [[Write Blockers]]

; [[Wiebetech]]
: http://wiebetech.com/
: Various [[Write Blockers]], [[forensic field kit]]s, etc.

= Training =

== Open for everyone ==
* [http://www.accessdata.com/training/ AccessData Training]
* [http://www.forensics-intl.com/training.html Armor Forensics (NTI - Forensics International)]
* [http://www.asrdata.com/training/ ASR Data Training]
* [http://www.blackbagtech.com/training.html BlackBag Tech Training]
* [http://www.cce-bootcamp.com/ Certified Computer Examiner BootCamp]
* [http://www.cprtools.net/training.php CPR Tools Training (Basic and Advanced Data Recovery)]
* [http://www.cftco.com/ Computer Forensics Training Center On-Line]
* [http://www.e-fense.com/training.html e-fense Inc]
* [http://www.nuix.com.au/screencasts.html FBI Screencast Training]
* [http://www.for-sec.com/p38.htm For-Sec Vendor classes, Cellphone/PDA seizure, and CFR 26 rules classes]
* [http://www.guidancesoftware.com/training/index.asp Guidance Software (EnCase) Training]
* [http://www.infosecinstitute.com/courses/security_training_courses.html InfoSec Institute]
* [http://www.crazytrain.com/training.html Linux Data Forensics Training]
* [http://www.maresware.com/maresware/training/maresware.htm Maresware Training]
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
* [http://www.mobileforensicstraining.com Mobile Forensics Training (Mobile Forensics Inc. Training)]
* [http://www.paraben-training.com/ Paraben Forensics Training]
* [http://www.sarc-wv.com/training.aspx Steganography Analysis and Research Center / Backbone Security]
* [http://www.techpathways.com/DesktopDefault.aspx?tabindex=5&tabid=9 Technology Pathways Pro Discover Training]
* [http://www.vigilar.com/training.html Vigilar]
* [http://www.wetstonetech.com/page/page/3004314.htm Wetstone Technologies]

== Law enforcement only ==

* [http://www.fletc.gov/cfi/fy06tibsched.htm Federal Law Enforcement Training Center]
* [http://www.cops.org/ IACIS Computer Training/Certification]
* [http://nw3c.org/ocr/courses_desc.cfm National White Collar Crime Center]
* [http://www.search.org/programs/hightech/courses.asp Search.Org]

Conferences

2007-08-22T13:22:07Z

Rmislan: /* Annual Conferences and Workshops */

This is a list of '''conferences''' in the [[computer forensics]] field.

[[Brian Carrier]] keeps a list of conferences and journals at http://www.digital-evidence.org/publish/index.html. This list was originally taken from Brian's and used with his permission.

For a list of conferences and training events sorted BY DATE, see [[Upcoming events]].

=Annual Conferences and Workshops=

Research (not training) conferences that are interested in digital investigation and forensics.

;American Academy of Forensic Science
:http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting

;Australian Digital Forensics Conference
:http://scissec.scis.ecu.edu.au/conferences2006/index.php?cf=3

;BlackHat Japan Briefings & Training
:http://japan.blackhat.com/

;BlackHat Federal Briefings & Training
:http://www.blackhat.com/html/bh-link/briefings.html

;CanSecWest
:http://cansecwest.com/

;Computer Security Institute NetSec
:http://www.gocsi.com/netsec/

;Conference on Digital Forensics, Security and Law
:http://www.digitalforensics-conference.org/

;CyberCrime Summit
:http://www.cybercrimesummit.com/index.htm

;Department of Defense CyberCrime Conference
:http://www.dodcybercrime.com/

;Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)
:http://www.gi-ev.de/fachbereiche/sicherheit/fg/sidar/dimva/

;E-Crime and Computer Evidence
:http://www.ecce-conference.com

;FIRST Conference
:http://www.first.org/conference/2007/

;IFIP International Information Security Conference
:http://www.sbs.co.za/ifipsec2007/

;IFIP WG 11.9 International Conference on Digital Forensics
:http://www.cis.utulsa.edu/ifip119/Conferences/WG11-9CallForPapers.asp

;International Conference on IT-Incident Management & IT-Forensics
:http://www.imf-conference.org

;Mobile Forensics World
:http://www.MobileForensicsWorld.com/

;PacSec Conference
:http://pacsec.jp/

;Security OPUS Information Security Conference
:http://www.securityopus.com/index.php

;Techno Forensics Conference
:http://www.techsec.com/html/TechnoForensics2006.htm

;Techno-Security Conference
:http://www.techsec.com/html/Techno2007.html

;USENIX Annual Technical Conference
:http://www.usenix.org/events/

;USENIX Security Symposium
:http://www.usenix.org/events/

= Training Conferences =

;Computer and Enterprise Investigations Conference (CEIC)
:http://www.ceic2007.com/

;HTCIA International Training Conference and Expo
:http://www.ohiohtcia.org/conf_main.html

;IACIS Computer Forensic Training Event
:http://www.iacis.com/iacisv2/pages/training.php

;IACIS Training - Germany
:http://www.iacis.com/iacisv2/pages/training.php

;ChicagoCon - White Hats Come Together in Defense of the Digital Frontier
:http://www.chicagocon.com

= Upcoming Events =

See [[Upcoming events]].

Journals

2007-08-17T13:52:21Z

Rmislan:

; Digital Investigation
: http://www.compseconline.com/digitalinvestigation/
: Print journal from Elsevier that started in 2004.

; International Journal of Digital Evidence (IJDE)
: http://www.ijde.org
: Electronic journal that started in 2002.

; Journal of Digital Forensic Practice
: http://www.tandf.co.uk/journals/titles/15567281.asp
: Print journal from Taylor and Francis that started in 2006.

; Journal of Digital Forensics, Security and Law
: http://www.jdfsl.org/
: Official quarterly publication (print and online) by the [http://www.adfsl.org/ Association of Digital Forensics, Security and Law].

; Journal of Forensic Sciences
: http://www.blackwell-synergy.com/loi/jfo
: A traditional print journal about forensics, but interested in articles on digital forensics as well.
: Blackwell Publishing is now the publisher of the JFS, and all issues prior to January 2006 are still available from ASTM
: http://journalsip.astm.org/JOURNALS/FORENSIC/jofs_home.html

; Transactions on Information Forensics and Security
: http://www.ieee.org/organizations/society/sp/tifs.html
: Print journal from IEEE Signal Processing Society that started in 2005.

; Small Scale Digital Device Forensics Journal
: http://www.ssddfj.org/
: Online journal for academics and practitioners to publish articles regarding the theory, research, and practice in the rapidly changing field of Small Scale Digital Device Forensics.

; Microgram
: http://www.dea.gov/programs/forensicsci/microgram/
: Published by the US Drug Enforcement Agency. The last few pages of each issue are devoted to digital evidence issues.

;Checkmate
:http://www.niiconsulting.com/checkmate/
:The expertise involved in a forensic investigation is best showcased through the documentation of the evidence and the recording of the techniques used for forensic investigation.

= Other Journal Links =

[[Brian Carrier]] keeps a list of conferences and journals at http://www.digital-evidence.org/publish/index.html. This list was originally taken from Brian's and used with his permission.

AT Commands

2007-06-12T15:23:34Z

Rmislan: /* '''Reference Links:''' */

<ul><li>AT and AT+ commands can be used to manually collect simple information. This is an ideal choice for "full control" over the communications that are sent and returned from the phone. These can also be used when there is no tool available to communicate with the phone. These commands were tested using a Motorola v551 GSM phone using Bluetooth and USB data cables. It is important to note that not all of these commands are supported by all phones, but the AT+CLAC command (usually) displays all of the available commands the GSM phone can respond to.</li>
<li>With Motorola phones (and many others) there are '''NO''' AT commands that can be used to retrieve multimedia content. For these, OBEX commands must be issued to the phone to return directory contents, ringtones, pictures and video.</li><li>Samsung GSM phones, on the other hand, '''DO''' have AT commands that allow access to the multimedia content.</li></ul> 

To use these AT commands:
<ol><li> Connect the phone and determine the number of the COM port that is associated with it.</li>
<li>Open HyperTerminal, Realterm or any other terminal program that will communicate with a specified COM port.</li>
<li>With the Motorola phone, type '''AT+MODE=2'''. This prepares the phone for an extended AT+ command set. (+Cxxx and +MPxx)</li></ol> 
After following these steps, you can continue with any of the commands below.

== '''Phonebook:''' ==
'''AT+CPBS=?''' 
Lists the phonebooks that the phone contains. (Choose phonebook storage) 
Returns: +CPBS: ("ME","SM","MT","ON","DC","MC","RC","EN","AD","QD","SD","FD") 

+CPBS="ME" sets the "retrieve mode" to the internal phonebook. 
+CPBS="SM" sets the "retrieve mode" to the SIM phonebook.

'''AT+CPBR=?''' 
Describes the phonebook selected above. (Simple) This gives the max number of entries the phone can contain. It also gives the maximum phone number (or email address) length and name length. 
'''NOTE:''' You can substitute +MPBR for any +CPBR command, but the phone returns a much more specific (and less intelligible) response containing more fields that may act as internal “programming” flags of some sort. 
Returns: +CPBR: (1-1000),40,24

'''AT+CPBR=[beginning index],[ending index]''' 
Returns a list of numbers with the index between the two numbers entered. Also denotes what TYPE of phonebook entry was selected. 
Returns: +CPBR: 9,"18005555555",129,"Contact Name" – 129 refers to a phone number. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name" – 128 refers to an email.

'''AT+CPBR=[index]''' 
Returns the specified index. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name"

'''AT+MPBF="Name"''' 
Searches the phonebook for the Name or string.

'''AT+MPBR=?''' 
Similar to above, but a more verbose result is displayed. 
Returns: +MPBR: 1-1000,40,24,8,0-1,50,(0,2,4,6,9-30,255),(0),(0-1),(1-30),(255),25,(0-1,255),264,(0),0,0,0,0,0,0,0
<ul><li>1-1000 denotes the number of entries that can be stored on the selected (+CPBS) phonebook.</li><li>40 represents the number of characters that the email or phone number can have.</li><li>24 indicates the number of characters the “friendly” name can have.</li><li>The 8 refers to the different “types” of phonebook entry (i.e. Mobile, Main, Email, Home, Fax, Work … etc).</li><li>The +CPBR command does not list anything after the 24 (as seen above), so there are times when the +MPBR may be useful.</li></ul>

'''AT+MPBR=[index]''' 
Returns: +MPBR: 18,"user@domain.net",128,"Contact Name",6,0,255,0,0,1,255,255,0,"",0,0,"","","","","","","",""

== '''SMS Messages:''' ==
'''AT+CMGF=1''' 
This tells the phone to display the entries as text rather than binary. +CMFG=0 would display the data in binary format.

'''AT+CPMS=?''' 
This displays all of the locations in which the phone can save the SMS messages. 
Returns: +CPMS: ("MT","IM","OM","BM","DM"),("OM","DM"),("IM")

'''AT+CMGL=?''' 
Returns the options on which messages you wish to display. 
Returns: +CMGL: ("REC UNREAD", "REC READ", "STO UNSENT", "STO SENT", "ALL")

'''AT+CMGL="ALL"''' 
Selects and displays all of the SMS messages on the selected source.

== '''Misc. Information:''' ==
'''AT+CGSN''' 
Returns the IMEI of the phone. 
Returns: +CGSN: IMEI356252000861622

'''AT+CGMR''' 
Returns the manufacturer’s OS revision. 
Returns: +CGMR: "R47_G_08.17.0FR_01"

'''AT+CGMM''' 
Returns the make, model and capabilities of the phones. 
Returns: +CGMM: "GSM900","GSM1800","GSM1900","GSM850","MODEL=V551"

'''AT+CNUM''' 
Returns the subscriber name/number from the SIM. 
Returns: +CNUM: Owner Name,15555555555,129

'''AT+CLAC''' 
Lists AT commands that the phone supports.

'''AT+MODE=22''' 
Prepares the phone (Motorola) for OBEX commands.

'''AT+MODE=0''' 
This returns the phone to simple AT command mode.

== '''Reference Links:''' ==

[http://gatling.ikk.sztaki.hu/~kissg/gsm/index.html AT+C Command Set of GSM]

[http://www.traud.de/gsm/atex.htm Alexander Traud's GSM pages ]

[http://www.anotherurl.com/library/at_test.htm AT Test Commands]

[http://www.csparks.com/MotoBackup/MotorolaAT.xhtml AT Commands to Access the Motorola]

[http://webapp.etsi.org/key/key.asp?GSMSpecPart1=27&GSMSpecPart2=007 ETSI-3GPP Standards]

AT Commands

2007-06-09T14:27:11Z

Rmislan: Added Ref Links....

<ul><li>AT and AT+ commands can be used to manually collect simple information. This is an ideal choice for "full control" over the communications that are sent and returned from the phone. These can also be used when there is no tool available to communicate with the phone. These commands were tested using a Motorola v551 GSM phone using Bluetooth and USB data cables. It is important to note that not all of these commands are supported by all phones, but the AT+CLAC command (usually) displays all of the available commands the GSM phone can respond to.</li>
<li>With Motorola phones (and many others) there are '''NO''' AT commands that can be used to retrieve multimedia content. For these, OBEX commands must be issued to the phone to return directory contents, ringtones, pictures and video.</li><li>Samsung GSM phones, on the other hand, '''DO''' have AT commands that allow access to the multimedia content.</li></ul> 

To use these AT commands:
<ol><li> Connect the phone and determine the number of the COM port that is associated with it.</li>
<li>Open HyperTerminal, Realterm or any other terminal program that will communicate with a specified COM port.</li>
<li>With the Motorola phone, type '''AT+MODE=2'''. This prepares the phone for an extended AT+ command set. (+Cxxx and +MPxx)</li></ol> 
After following these steps, you can continue with any of the commands below.

== '''Phonebook:''' ==
'''AT+CPBS=?''' 
Lists the phonebooks that the phone contains. (Choose phonebook storage) 
Returns: +CPBS: ("ME","SM","MT","ON","DC","MC","RC","EN","AD","QD","SD","FD") 

+CPBS="ME" sets the "retrieve mode" to the internal phonebook. 
+CPBS="SM" sets the "retrieve mode" to the SIM phonebook.

'''AT+CPBR=?''' 
Describes the phonebook selected above. (Simple) This gives the max number of entries the phone can contain. It also gives the maximum phone number (or email address) length and name length. 
'''NOTE:''' You can substitute +MPBR for any +CPBR command, but the phone returns a much more specific (and less intelligible) response containing more fields that may act as internal “programming” flags of some sort. 
Returns: +CPBR: (1-1000),40,24

'''AT+CPBR=[beginning index],[ending index]''' 
Returns a list of numbers with the index between the two numbers entered. Also denotes what TYPE of phonebook entry was selected. 
Returns: +CPBR: 9,"18005555555",129,"Contact Name" – 129 refers to a phone number. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name" – 128 refers to an email.

'''AT+CPBR=[index]''' 
Returns the specified index. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name"

'''AT+MPBF="Name"''' 
Searches the phonebook for the Name or string.

'''AT+MPBR=?''' 
Similar to above, but a more verbose result is displayed. 
Returns: +MPBR: 1-1000,40,24,8,0-1,50,(0,2,4,6,9-30,255),(0),(0-1),(1-30),(255),25,(0-1,255),264,(0),0,0,0,0,0,0,0
<ul><li>1-1000 denotes the number of entries that can be stored on the selected (+CPBS) phonebook.</li><li>40 represents the number of characters that the email or phone number can have.</li><li>24 indicates the number of characters the “friendly” name can have.</li><li>The 8 refers to the different “types” of phonebook entry (i.e. Mobile, Main, Email, Home, Fax, Work … etc).</li><li>The +CPBR command does not list anything after the 24 (as seen above), so there are times when the +MPBR may be useful.</li></ul>

'''AT+MPBR=[index]''' 
Returns: +MPBR: 18,"user@domain.net",128,"Contact Name",6,0,255,0,0,1,255,255,0,"",0,0,"","","","","","","",""

== '''SMS Messages:''' ==
'''AT+CMGF=1''' 
This tells the phone to display the entries as text rather than binary. +CMFG=0 would display the data in binary format.

'''AT+CPMS=?''' 
This displays all of the locations in which the phone can save the SMS messages. 
Returns: +CPMS: ("MT","IM","OM","BM","DM"),("OM","DM"),("IM")

'''AT+CMGL=?''' 
Returns the options on which messages you wish to display. 
Returns: +CMGL: ("REC UNREAD", "REC READ", "STO UNSENT", "STO SENT", "ALL")

'''AT+CMGL="ALL"''' 
Selects and displays all of the SMS messages on the selected source.

== '''Misc. Information:''' ==
'''AT+CGSN''' 
Returns the IMEI of the phone. 
Returns: +CGSN: IMEI356252000861622

'''AT+CGMR''' 
Returns the manufacturer’s OS revision. 
Returns: +CGMR: "R47_G_08.17.0FR_01"

'''AT+CGMM''' 
Returns the make, model and capabilities of the phones. 
Returns: +CGMM: "GSM900","GSM1800","GSM1900","GSM850","MODEL=V551"

'''AT+CNUM''' 
Returns the subscriber name/number from the SIM. 
Returns: +CNUM: Owner Name,15555555555,129

'''AT+CLAC''' 
Lists AT commands that the phone supports.

'''AT+MODE=22''' 
Prepares the phone (Motorola) for OBEX commands.

'''AT+MODE=0''' 
This returns the phone to simple AT command mode.

== '''Reference Links:''' ==

[http://gatling.ikk.sztaki.hu/~kissg/gsm/index.html, AT+C Command Set of GSM]

[http://www.traud.de/gsm/atex.htm, Alexander Traud's GSM pages ]

[http://www.anotherurl.com/library/at_test.htm, AT Test Commands]

[http://www.csparks.com/MotoBackup/MotorolaAT.xhtml, AT Commands to Access the Motorola]

[http://webapp.etsi.org/key/key.asp?GSMSpecPart1=27&GSMSpecPart2=005, ETSI-3GPP TS 27.005]

[http://webapp.etsi.org/key/key.asp?GSMSpecPart1=27&GSMSpecPart2=007, ETSI-3GPP TS 27.007]

AT Commands

2007-06-09T14:26:19Z

Rmislan: /* '''Misc. Information:''' */

<ul><li>AT and AT+ commands can be used to manually collect simple information. This is an ideal choice for "full control" over the communications that are sent and returned from the phone. These can also be used when there is no tool available to communicate with the phone. These commands were tested using a Motorola v551 GSM phone using Bluetooth and USB data cables. It is important to note that not all of these commands are supported by all phones, but the AT+CLAC command (usually) displays all of the available commands the GSM phone can respond to.</li>
<li>With Motorola phones (and many others) there are '''NO''' AT commands that can be used to retrieve multimedia content. For these, OBEX commands must be issued to the phone to return directory contents, ringtones, pictures and video.</li><li>Samsung GSM phones, on the other hand, '''DO''' have AT commands that allow access to the multimedia content.</li></ul> 

To use these AT commands:
<ol><li> Connect the phone and determine the number of the COM port that is associated with it.</li>
<li>Open HyperTerminal, Realterm or any other terminal program that will communicate with a specified COM port.</li>
<li>With the Motorola phone, type '''AT+MODE=2'''. This prepares the phone for an extended AT+ command set. (+Cxxx and +MPxx)</li></ol> 
After following these steps, you can continue with any of the commands below.

== '''Phonebook:''' ==
'''AT+CPBS=?''' 
Lists the phonebooks that the phone contains. (Choose phonebook storage) 
Returns: +CPBS: ("ME","SM","MT","ON","DC","MC","RC","EN","AD","QD","SD","FD") 

+CPBS="ME" sets the "retrieve mode" to the internal phonebook. 
+CPBS="SM" sets the "retrieve mode" to the SIM phonebook.

'''AT+CPBR=?''' 
Describes the phonebook selected above. (Simple) This gives the max number of entries the phone can contain. It also gives the maximum phone number (or email address) length and name length. 
'''NOTE:''' You can substitute +MPBR for any +CPBR command, but the phone returns a much more specific (and less intelligible) response containing more fields that may act as internal “programming” flags of some sort. 
Returns: +CPBR: (1-1000),40,24

'''AT+CPBR=[beginning index],[ending index]''' 
Returns a list of numbers with the index between the two numbers entered. Also denotes what TYPE of phonebook entry was selected. 
Returns: +CPBR: 9,"18005555555",129,"Contact Name" – 129 refers to a phone number. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name" – 128 refers to an email.

'''AT+CPBR=[index]''' 
Returns the specified index. 
Returns: +CPBR: 18,"user@domain.net",128,"Contact Name"

'''AT+MPBF="Name"''' 
Searches the phonebook for the Name or string.

'''AT+MPBR=?''' 
Similar to above, but a more verbose result is displayed. 
Returns: +MPBR: 1-1000,40,24,8,0-1,50,(0,2,4,6,9-30,255),(0),(0-1),(1-30),(255),25,(0-1,255),264,(0),0,0,0,0,0,0,0
<ul><li>1-1000 denotes the number of entries that can be stored on the selected (+CPBS) phonebook.</li><li>40 represents the number of characters that the email or phone number can have.</li><li>24 indicates the number of characters the “friendly” name can have.</li><li>The 8 refers to the different “types” of phonebook entry (i.e. Mobile, Main, Email, Home, Fax, Work … etc).</li><li>The +CPBR command does not list anything after the 24 (as seen above), so there are times when the +MPBR may be useful.</li></ul>

'''AT+MPBR=[index]''' 
Returns: +MPBR: 18,"user@domain.net",128,"Contact Name",6,0,255,0,0,1,255,255,0,"",0,0,"","","","","","","",""

== '''SMS Messages:''' ==
'''AT+CMGF=1''' 
This tells the phone to display the entries as text rather than binary. +CMFG=0 would display the data in binary format.

'''AT+CPMS=?''' 
This displays all of the locations in which the phone can save the SMS messages. 
Returns: +CPMS: ("MT","IM","OM","BM","DM"),("OM","DM"),("IM")

'''AT+CMGL=?''' 
Returns the options on which messages you wish to display. 
Returns: +CMGL: ("REC UNREAD", "REC READ", "STO UNSENT", "STO SENT", "ALL")

'''AT+CMGL="ALL"''' 
Selects and displays all of the SMS messages on the selected source.

== '''Misc. Information:''' ==
'''AT+CGSN''' 
Returns the IMEI of the phone. 
Returns: +CGSN: IMEI356252000861622

'''AT+CGMR''' 
Returns the manufacturer’s OS revision. 
Returns: +CGMR: "R47_G_08.17.0FR_01"

'''AT+CGMM''' 
Returns the make, model and capabilities of the phones. 
Returns: +CGMM: "GSM900","GSM1800","GSM1900","GSM850","MODEL=V551"

'''AT+CNUM''' 
Returns the subscriber name/number from the SIM. 
Returns: +CNUM: Owner Name,15555555555,129

'''AT+CLAC''' 
Lists AT commands that the phone supports.

'''AT+MODE=22''' 
Prepares the phone (Motorola) for OBEX commands.

'''AT+MODE=0''' 
This returns the phone to simple AT command mode.

'''Reference Links''' 

[http://gatling.ikk.sztaki.hu/~kissg/gsm/index.html, AT+C Command Set of GSM]

[http://www.traud.de/gsm/atex.htm, Alexander Traud's GSM pages ]

[http://www.anotherurl.com/library/at_test.htm, AT Test Commands]

[http://www.csparks.com/MotoBackup/MotorolaAT.xhtml, AT Commands to Access the Motorola]

[http://webapp.etsi.org/key/key.asp?GSMSpecPart1=27&GSMSpecPart2=005, ETSI-3GPP TS 27.005]

[http://webapp.etsi.org/key/key.asp?GSMSpecPart1=27&GSMSpecPart2=007, ETSI-3GPP TS 27.007]

Cell Phone Forensics

2007-05-12T02:42:57Z

Rmislan: /* External Links */

== Guidelines ==

# If on, switch it off. If off, leave off.

#* Note only under exceptional circumstances should the handset be left switched on and in any case every precaution to prevent the handset connecting with the Communication Service Provider should be made. Consider use of one of many [[wireless preservation]] or [[RF isolation]] techniques. Note that the slightest signal leakage will allow an overwriting text message through even if a phone call can't get through.

#* Instead of switching off, it may be better to remove the battery. Phones run a different part of their program when they are turned off. You may wish to avoid having this part of the program run.

#* Note that removing the battery or powering off a mobile phone may introduce a handset unlock code upon powering the device on.

# Collect and preserve other surrounding and related devices. Be especially careful to collect the power charger. The phone's battery will only last a certain amount of time. When it dies, much of the data on the device may go too!

# Plug the phone in, preferably in the evidence room, as soon as possible.
# Retain [[search warrant]] (if necessary - [[LE]]).
# Return device to forensic lab if able.
# Use [[forensically sound]] tools for processing. However, also remember ACPO Principle 2 says: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.

== Notes ==

Expand on as to what to collect:

* [[ESN]],
* [[IMEI]],
* [[Carrier]],
* Manufacturer,
* Model Number,
* Color, and
* Other information related to [[Cell Phone]] and [[SIM Card]]...

Process:
# Photograph the [[Cell Phone]] screen during power up.
# Research the [[Cell Phone]] for technical specifications.
# Research the [[Cell Phone]] for forensic information.
# Based on phone type [[GSM]], [[CDMA]], [[iDEN]], or [[Pay As You Go]] determine acquisition tools

GSM:
# Phone and SIM Card
# SIM Card

CDMA:
# Phone

iDEN:
# Three major tools exist for iDEN Phones:
* iDEN Companion Pro
* iDEN Media Downloader
* iDEN Phonebook Manager

Pay As You Go:
# Phone

== External Links ==

Articles and Reference Materials
*[http://www.forensics.nl/mobile-pda-forensics Mobile Phone Forensics & PDA Forensics Links]
*[http://csrc.nist.gov/mobilesecurity/publications.html#MF U.S. National Institute of Standards and Technology Documents]

Investigative Support
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]
*[http://www.Phone-Forensics.com Phone-Forensics.com (Advanced Forum for Practitioners)]
*[http://www.Mobile-Forensics.com Mobile-Forensics.com (Research Forum for Mobile Device Forensics)]
*[http://trewmte.blogspot.com TREW Mobile Telephone Evidence (Mobile Telephone Evidence Practitioner Site)]
*[http://www.Mobile-Examiner.com Mobile-Examiner.com (Forum for Practitioners)]
*[http://www.forensicfocus.com forensicfocus.com(Practitioners Forum)]

Phone Research
*[http://www.MobileForensicsCentral.com MobileForensicsCentral.com (Information regarding Cell Phone Forensic Applications)]
*[http://www.GSMArena.com GSMArena.com (Technical information regarding GSM Cell Phones)]
*[http://www.PhoneScoop.com PhoneScoop.com (Technical information regarding all Cell Phones)]

Training
*[http://www.SmartPhoneForensics.com SmartPhoneForensics.com (Mobile Device Forensics Training and Investigative Support)]
*[http://www.paraben-training.com/training.html Paraben-Forensics.com (Paraben's Handheld Forensic Training Classes)]

Cell Phone Forensics

2007-05-12T02:40:58Z

Rmislan: /* External Links */

Cell Phone Forensics

2007-05-12T02:40:18Z

Rmislan: /* Phone Research */

Cell Phone Forensics

2007-05-12T02:39:15Z

Rmislan: /* Training */

Cell Phone Forensics

2007-05-12T02:38:10Z

Rmislan: /* Investigative Support */

Cell Phone Forensics

2007-05-12T02:36:56Z

Rmislan: /* Articles and Reference Materials */

SIM Card Forensics

2007-05-12T02:35:51Z

Rmislan: /* Software */

== Procedures ==

Acquire [[SIM Card]] and analyze the following:

* ICCID - Integrated Circuit Card Identification
* MSISDN - Subscriber phone number
* IMSI - International Mobile Subscriber Identity
* LND - Last Dialed numbers
* LOCI -
* LAI -
* LOCI - Location information
* ADN - Abbreviated Dialing Numbers (Contacts)
* FDN - Fixed Dialing Numbers (Provider entered Numbers)
* SMS - (Short Messages)
* SMSP - Text Message parameters
* SMSS - Text message status
* Phase - Phase ID
* SST - SIM Service table
* LP - Preferred languages variable
* SPN - Service Provider name
* EXT1 - Dialing Extension
* EXT2 - Dialing Extension
* GID1 - Groups
* GID2 - Groups
* CBMI - Preferred network messages
* PUCT - Calls per unit
* ACM - Accumulated Call Meter
* ACMmax - Call Limit
* HPLMNSP - HPLMN search period
* PLMNsel - PLMN selector
* FPLMN - Forbidden PLMNs
* CCP - Capability configuration parameter
* ACC - Access control class
* BCCH - Broadcast control channels
* Kc - Ciphering Key

== Hardware ==

=== Serial ===

* [[MicroDrive 120]] with SmartCard Adapter

=== USB ===

* [[ACR 38T]]

== Software ==

* [[ForensicSIM]]
* [[Quantaq USIMdetective]]
* [[Paraben SIM Card Seizure]]

Cell Phone Forensics

2007-05-12T02:35:01Z

Rmislan: /* Links */

Cell Phone Forensics

2007-05-12T02:30:24Z

Rmislan: /* Notes */

Cell Phone Forensics

2007-05-12T02:29:21Z

Rmislan: /* Notes */

Cell Phone Forensics

2007-05-12T02:27:18Z

Rmislan: /* Guidelines */

Cell Phone Forensics

2007-05-12T02:21:36Z

Rmislan: /* Notes */

Cell phones

2007-05-12T02:21:03Z

Rmislan: /* Tools */

'''Cell phones''' or '''mobile phones''' are an important target for [[forensic investigator]]s.

== Technologies ==

* [[CDMA]]
* [[TDMA]]
* [[GSM]]
* [[iDEN]]
* [[EDGE]]
* [[GPRS]]
* [[UMTS]]

== Hardware ==

* [[RIM BlackBerry]]
* [[T-Mobile Sidekick ]]
* [[SIM Cards]]

== Operating Systems ==

* [[Microsoft PocketPC]]
* [[Microsoft Windows Mobile]]
* [[Palm]]
* [[RIM BlackBerry]]
* [[Symbian]]
* [[Linux]]

== Forensics ==

'''Procedures'''

* [[Cell Phone Forensics]]
* [[SIM Card Forensics]]
* [[External Memory Card Forensics]]

== Tools ==

'''Flashers'''
* [[UFS Tornado]]

'''Hardware'''
* [[ Azimuth RadioProof™ Enclosures]]
* [[Radio Frequency (RF) Jammers]]
* [[Network Security Solutions Secure Tents]]
* [[Network Security Solutions Seizure Bags for Cell Phones/PDAs/Laptops]]
* [[Paraben Device Seizure Toolbox]]
* [[Paraben Handheld First Responder Kit]]
* [[Paraben StrongHold Bag]]

'''Software'''
* [[BitPIM]]
* [[Cell Phone Analyzer]]
* [[DataPilot Secure View]]
* [[FloAt's Mobile Agent]]
* [[ForensicMobile]]
* [[ForensicSIM]]
* [[Guidance Software Neutrino]]
* [[iDEN Companion Pro]]
* [[iDEN Media Downloader]]
* [[iDEN Phonebook Manager]]
* [[LogiCube CellDEK]]
* [[MicroSystemation .XRY]]
* [[MOBILedit!]]
* [[Oxygen PM II]]
* [[Paraben Device Seizure]]
* [[Paraben SIM Seizure]]
* [[Pandora's Box]]
* [[Quantaq USIMdetective]]
* [[Quantaq USIMcommander]]
* [[Quantaq USIMdetective]]
* [[Quantaq USIMexplorer]]
* [[Quantaq USIMprofiler]]
* [[Quantaq USIMregistrar]]
* [[TULP2G]]

Cell phones

2007-05-12T02:17:33Z

Rmislan: /* Tools */

'''Cell phones''' or '''mobile phones''' are an important target for [[forensic investigator]]s.

== Technologies ==

* [[CDMA]]
* [[TDMA]]
* [[GSM]]
* [[iDEN]]
* [[EDGE]]
* [[GPRS]]
* [[UMTS]]

== Hardware ==

* [[RIM BlackBerry]]
* [[T-Mobile Sidekick ]]
* [[SIM Cards]]

== Operating Systems ==

* [[Microsoft PocketPC]]
* [[Microsoft Windows Mobile]]
* [[Palm]]
* [[RIM BlackBerry]]
* [[Symbian]]
* [[Linux]]

== Forensics ==

'''Procedures'''

* [[Cell Phone Forensics]]
* [[SIM Card Forensics]]
* [[External Memory Card Forensics]]

== Tools ==

'''Flashers'''
* [[UFS Tornado]]

'''Hardware'''
* [[ Azimuth RadioProof™ Enclosures]]
* [[Radio Frequency (RF) Jammers]]
* [[Network Security Solutions Secure Tents]]
* [[Network Security Solutions Seizure Bags for Cell Phones/PDAs/Laptops]]
* [http://www.paraben-forensics.com/catalog/product_info.php?cPath=26&products_id=343 Paraben Device Seizure Toolbox]
* [http://www.paraben-forensics.com/catalog/product_info.php?cPath=26&products_id=372 Paraben Handheld First Responder Kit]
* [[Paraben StrongHold Bag]]

'''Software'''
* [[BitPIM]]
* [[Cell Phone Analyzer]]
* [[DataPilot Secure View]]
* [[FloAt's Mobile Agent]]
* [[ForensicMobile]]
* [[ForensicSIM]]
* [[Guidance Software Neutrino]]
* [[iDEN Companion Pro]]
* [[iDEN Media Downloader]]
* [[iDEN Phonebook Manager]]
* [[LogiCube CellDEK]]
* [[MicroSystemation .XRY]]
* [[MOBILedit!]]
* [[Oxygen PM II]]
* [[Paraben Device Seizure]]
* [[Paraben SIM Seizure]]
* [[Pandora's Box]]
* [[Quantaq USIMdetective]]
* [[Quantaq USIMcommander]]
* [[Quantaq USIMdetective]]
* [[Quantaq USIMexplorer]]
* [[Quantaq USIMprofiler]]
* [[Quantaq USIMregistrar]]
* [[TULP2G]]

Cell Phone Forensics

2007-05-12T02:11:26Z

Rmislan: /* Links */

Cell Phone Forensics

2007-02-21T03:34:15Z

Rmislan: /* Links */

Cell Phone Forensics

2007-02-21T03:32:47Z

Rmislan: /* Notes */