Difference between pages "Upcoming events" and "Category:Disk imaging"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
(Conferences)
 
(Unix-based imagers)
 
Line 1: Line 1:
<b>PLEASE READ BEFORE YOU EDIT THE LISTS BELOW</b><br>
+
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#dddddd; align:center;">
Events should be posted in the correct section, and in date order. An event should NEVER be listed in more than one section (i.e. Ongoing/Continuous events should not be listed in Scheduled Training). When events begin the same day, events of a longer length should be listed first. New postings of events with the same date(s) as other events should be added after events already in the list. If a provider offers the same event at several locations simultaneously, the listing should have a single (ONE) entry in the list with the date(s) and ALL locations for the event. Please use three-letter month abbreviations (i.e. Sep, NOT Sept. or September), use two digit dates (i.e. Jan 01 NOT Jan 1), and use date ranges rather than listing every date during an event(i.e. Jan 02-05, NOT Jan 02, 03, 04, 05).<br>
+
'''Note:''' We're trying to use the same [[tool template]] for all devices. Please use this if possible.
<i>Some events may be <u>limited</u> to <b>Law Enforcement Only</b> or to a specific audience.  Such restrictions should be noted when known.</i>
+
</div>
  
This is a BY DATE listing of upcoming events relevant to [[digital forensics]].  It is not an all inclusive list, but includes most well-known activities. Some events may duplicate events on the generic [[conferences]] page, but entries in this list have specific dates and locations for the upcoming event.
+
'''TODO: Not all of the following are tools, most are simply company names. The tools should have their own articles...'''
  
This listing is divided into four sections (described as follows):<br>
+
= Hardware imagers =
<ol><li><b><u>Calls For Papers</u></b> - Calls for papers for either Journals or for Conferences, relevant to Digital Forensics (Name, Closing Date, URL)</li><br>
+
; [[DeepSpar Disk Imager]]
<li><b><u>Conferences</u></b> - Conferences relevant for Digital Forensics (Name, Date, Location, URL)</li><br>
+
: Handles Data Recovery Imaging issues, drive instability, and bad sectors. http://www.deepspar.com/products-ds-disk-imager.html  - Data Sheet and Whitepaper available for download from product web page.
<li><b><u>On-Going / Continuous Training</u></b> - Training opportunities that are either always available online/distance learning format (start anytime) or that are offered the same time every month (Name, date-if applicable, URL)</li><br>
+
; [[ICS Solo3]]
<li><b><u>[[Scheduled Training Courses]]</u></b> - Training Classes/Courses that are scheduled for specific dates/locations. This would include online (or distance learning format) courses which begin on specific dates, instead of the "start anytime" courses listed in the previous section. (Provider, URL) (''note: this has been moved to its own page.'')<br></li></ol>
+
: Supports USB, Firewire and SCSI drives. http://www.icsforensic.com/
 +
; [[Logicube Talon]]
 +
: Supports USB
 +
; [[PSIClone]]
 +
: Built-in PATA, SATA, USB and write blocker. http://www.thepsiclone.com/
 +
: Enhanced Error Handling and Logging
 +
; [[Voom HardCopy III]]
 +
: Allows destination drive to be formatted in NTFS.
  
== Calls For Papers ==
+
= Unix-based imagers=
Please help us keep this up-to-date with deadlines for upcoming conferences that would be appropriate for forensic research.
+
  
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
; '''ewfacquire''' and '''ewfacquiresteam'''
|- style="background:#bfbfbf; font-weight: bold"
+
: The tools '''ewfacquire''' and '''ewfacquiresteam''' are part of the [[libewf]] library package. They can create evidence files in the [[EnCase]] and [[FTK Imager]] .E0* (EWF-E01) and [[SMART]] .s0* (EWF-S01) formats. '''ewfacquire''' and '''ewfacquirestream''' calculate an [[MD5]] and/or [[SHA1]] hash while the data is being acquired. Because of compatibility with [[EnCase]] '''ewfacquire''' and '''ewfacquirestream''' only store the [[SHA1]] digest hash in the Extended EWF (EWF-X) format. '''ewfacquire''' and '''ewfacquirestream''' provide support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.
! width="30%|Title
+
: https://libewf.sourceforge.net/
! width="15%"|Due Date
+
! width="15%"|Notification Date
+
! width="40%"|Website
+
|-
+
|2010 Conference on Digital Forensics, Security and Law
+
|Feb 19, 2010
+
|
+
|http://www.digitalforensics-conference.org/callforpapers.htm
+
|-
+
|Digital Forensic Research Workshop (DFRWS) 2010
+
|Feb 28, 2010
+
|Apr 05, 2010
+
|http://dfrws.org/2010/cfp.shtml
+
|-
+
|2010 IEEE International Conference on Technologies for Homeland Security
+
|Apr 24, 2010
+
|
+
|http://ieee-hst.org/
+
|-
+
|2nd International Workshop on Security in Cloud Computing (SCC'2010)
+
|May 01, 2010
+
|Jun 07, 2010
+
|http://bingweb.binghamton.edu/~ychen/SCC2010.htm
+
|-
+
|}
+
  
See also [http://www.wikicfp.com/cfp/servlet/tool.search?q=forensics WikiCFP 'Forensics']
+
; [[Adepto]]
 +
: http://www.e-fense.com/helix/
  
== Conferences ==
+
; [[aimage]]
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
: Part of the [[AFF]] system, [[aimage]] can create files is raw, AFF, AFD, or AFM formats. AFF and AFD formats can be compressed or uncompressed. [[aimage]]  can optionally compress and calculate [[MD5]] or [[SHA-1]] hash residues while the data is being copied. It has intelligent error recovery, similar to what is in [[ddrescue]].
|- style="background:#bfbfbf; font-weight: bold"
+
! width="40%"|Title
+
! width="20%"|Date/Location
+
! width="40%"|Website
+
|-
+
|DoD Cyber Crime Conference
+
|Jan 22-29<br>St. Louis, MO
+
|http://www.dodcybercrime.com/10CC/
+
|-
+
|ShmooCon VI
+
|Feb 05-07<br>Washington, DC
+
|http://www.shmoocon.org
+
|-
+
|International Conference on Technical and Legal Aspects of the e-Society
+
|Feb 10-15<br>St. Maarten, Netherlands Antilles
+
|http://www.iaria.org/conferences2010/CYBERLAWS10.html
+
|-
+
|Third International Workshop on Digital Forensics
+
|Feb 15-18<br>Krakow, Poland
+
|http://www.ares-conference.eu/conf/index.php/workshops/wsdf
+
|-
+
|American Academy of Forensic Sciences Annual Meeting
+
|Feb. 22-27<br>Seattle, WA
+
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
+
|-
+
|RSA Conference 2010
+
|Mar 01-05<br>San Francisco, CA
+
|http://www.rsaconference.com/2010/usa/index.htm
+
|-
+
|CanSecWest 2010
+
|Mar 22-26<br>Vancouver, British Columbia, Canada
+
|http://cansecwest.com/index.html
+
|-
+
|31st IEEE Symposium on Security and Privacy
+
|May 16-19<br>Oakland, CA
+
|http://oakland31.cs.virginia.edu/
+
|-
+
|AusCERT Asia Pacific Information Security Conference
+
|May 16-21<br>Kenmore Hills, Queensland, Australia
+
|http://conference.auscert.org.au/conf2010/index.html
+
|-
+
|Conference on Digital Forensics, Security and Law 2010
+
|May 19-21<br>St. Paul, MN
+
|http://www.digitalforensics-conference.org/index.htm
+
|-
+
|7th International Symposium on Risk Management and Cyber-Informatics
+
|Jun 29-Jul 02<br>Orlando, FL
+
|http://www.2010iiisconferences.org/RMCI
+
|-
+
|Digital Forensic Research Workshop (DFRWS) 2010
+
|Aug 02-04<br>Portland, OR
+
|http://dfrws.org/2010/
+
|-
+
|2nd International Workshop on Security in Cloud Computing (SCC'2010)
+
|Sep 13-16<br>San Diego, CA
+
|http://bingweb.binghamton.edu/~ychen/SCC2010.htm
+
|-
+
|VB2010 Fighting malware and spam
+
|Sep 29 - Oct 01<br>Vancouver, BC, Canada
+
|http://www.virusbtn.com/conference/vb2010/
+
|-
+
|2010 IEEE International Conference on Technologies for Homeland Security
+
|Nov 08-10<br>Waltham, MA
+
|http://ieee-hst.org/
+
|-
+
|}
+
  
== On-going / Continuous Training ==
+
; [[AIR]]
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
: AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
|- style="background:#bfbfbf; font-weight: bold"
+
: http://air-imager.sourceforge.net/
! width="40%"|Title
+
! width="20%"|Date/Location
+
! width="40%"|Website
+
|-
+
|- style="background:pink;align:left"
+
! DISTANCE LEARNING
+
|-
+
|Basic Computer Examiner Course - Computer Forensic Training Online
+
|Distance Learning Format
+
|http://www.cftco.com
+
|-
+
|Linux Data Forensics Training
+
|Distance Learning Format
+
|http://www.crazytrain.com/training.html
+
|-
+
|SANS On-Demand Training
+
|Distance Learning Format
+
|http://www.sans.org/ondemand/?portal=69456f95660ade45be29c00b0c14aea1
+
|-
+
|Champlain College - CCE Course
+
|Online / Distance Learning Format
+
|http://extra.champlain.edu/cps/wdc/alliances/cce/landing/
+
|-
+
|Las Positas College
+
|Online Computer Forensics Courses
+
|http://www.laspositascollege.edu
+
|-
+
|- style="background:pink;align:left"
+
!RECURRING TRAINING
+
|-
+
|MaresWare Suite Training
+
|First full week every month<br>Atlanta, GA
+
|http://www.maresware.com/maresware/training/maresware.htm
+
|-
+
|Evidence Recovery for Windows Vista&trade;
+
|First full week every month<br>Brunswick, GA
+
|http://www.internetcrimes.net
+
|-
+
|Evidence Recovery for Windows Server&reg; 2003 R2
+
|Second full week every month<br>Brunswick, GA
+
|http://www.internetcrimes.net
+
|-
+
|Evidence Recovery for the Windows XP&trade; operating system
+
|Third full week every month<br>Brunswick, GA
+
|http://www.internetcrimes.net
+
|-
+
|Computer Forensics Training and CCE&trade; Testing for Litigation Support Professionals
+
|Third weekend of every month(Fri-Mon)<br>Dallas, TX
+
|http://www.md5group.com
+
|-
+
|}
+
  
==See Also==
+
; [[dcfldd]]
* [[Scheduled Training Courses]]
+
: A version of [[dd]] created by the [[Digital Computer Forensics Laboratory]]. [[dcfldd]] is an enhanced version of [[GNU]] dd with features useful for forensics and security, such as calculating [[MD5]] or [[SHA-1]] [[hash]]es on the fly and faster disk wiping.
==References==
+
 
* [http://faculty.cs.tamu.edu/guofei/sec_conf_stat.htm Computer Security Conference Ranking and Statistic]
+
; [[dd]]
* [http://www.kdnuggets.com/meetings/ Meetings and Conferences in Data Mining and Discovery]
+
: A program that converts and copies files, is one of the oldest [[Unix]] programs. I can copy data from any Unix "file" (including a [[raw partition]]) to any other Unix "file" (including a disk file or a raw partition). This is one of the oldest of the imaging tools, and produces [[raw image files]]. Extended into [[dcfldd]].
* http://www.conferencealerts.com/data.htm Data Mining Conferences World-Wide]
+
 
 +
; EnCase [[LinEn]]
 +
: Linux-based version of EnCase's forensic imaging tool.
 +
 
 +
; GNU [[ddrescue]]
 +
: http://www.gnu.org/software/ddrescue/ddrescue.html
 +
 
 +
; [[dd_rescue]]
 +
: http://www.garloff.de/kurt/linux/ddrescue/
 +
: A tool similar to [[dd]], but unlike dd it will continue reading the next sector, if it stumbles over bad sectors it cannot read.
 +
 
 +
; iLook [[IXimager]]
 +
: The primary imaging tool for [[iLook]]. It is [[Linux]] based and produces compressed authenticatable [[image file]]s that may only be read in the iLook analysis tool.
 +
 
 +
; [[MacQuisition Boot CD]]
 +
: Provides software to safely image [[Macintosh]] drives.
 +
 
 +
; [[rdd]]
 +
: http://sourceforge.net/projects/rdd
 +
: Rdd is robust with respect to read errors and incorporates several other functions: MD5 and SHA-1 hashing, block hashing, entropy computation, checksumming, network transfer, and output splitting.
 +
 
 +
; [[sdd]]
 +
: Another [[dd]]-like tool. It is supposed to be faster in certain situations.
 +
 
 +
= Windows-based imagers =
 +
 
 +
; [[AccessData]]
 +
: Their ultimate tool lets you "READ, ACQUIRE, DECRYPT, ANALYZE and REPORT (R.A.D.A.R.)."
 +
 
 +
; [[ASR]]
 +
: A tool for [[imaging]] and analyzing disks.
 +
 
 +
; [[DIBS]]
 +
: Can image and convert many file formats. Also builds mobile toolkit.
 +
 
 +
; [[EnCase]]
 +
: Can image with out dongle plugged in. Only images to E0* file.
 +
 
 +
; [[FTK Imager]] by [[AccessData]]
 +
: Can image and convert many image formats. Including [[E0*]] (EWF-E01), s0* (EWF-S01) and [[dd]]. Also a free tool.
 +
 
 +
; [[Ghost]]
 +
: FTK can read forensic, uncompressed [[Ghost image]]s.
 +
 
 +
; [[iLook]]
 +
: The [[IRS]]'s set of forensic tools and utilities.  iLook V8 can image in Windows.
 +
 
 +
; [[Paraben]]
 +
: A complete set of tools for [[Windows]] (and [[handheld]]) products.
 +
 
 +
; [[ProDiscovery]]
 +
: Images and searches [[FAT12]], [[FAT16]], [[FAT32]] and all [[NTFS]] files.
 +
 
 +
; [[X-Ways Forensics]]
 +
: Has some limited imaging capabilities. The output is [[raw format]].
 +
 
 +
; [[X-Ways Replica]]
 +
: Performs [[hard disk]] [[cloning]] and imaging. The output is [[raw format]].
 +
 
 +
 
 +
[[Category:Tools]]
 +
 
 +
[[Category:Tools]]

Revision as of 15:07, 31 January 2009

Note: We're trying to use the same tool template for all devices. Please use this if possible.

TODO: Not all of the following are tools, most are simply company names. The tools should have their own articles...

Hardware imagers

DeepSpar Disk Imager
Handles Data Recovery Imaging issues, drive instability, and bad sectors. http://www.deepspar.com/products-ds-disk-imager.html - Data Sheet and Whitepaper available for download from product web page.
ICS Solo3
Supports USB, Firewire and SCSI drives. http://www.icsforensic.com/
Logicube Talon
Supports USB
PSIClone
Built-in PATA, SATA, USB and write blocker. http://www.thepsiclone.com/
Enhanced Error Handling and Logging
Voom HardCopy III
Allows destination drive to be formatted in NTFS.

Unix-based imagers

ewfacquire and ewfacquiresteam
The tools ewfacquire and ewfacquiresteam are part of the libewf library package. They can create evidence files in the EnCase and FTK Imager .E0* (EWF-E01) and SMART .s0* (EWF-S01) formats. ewfacquire and ewfacquirestream calculate an MD5 and/or SHA1 hash while the data is being acquired. Because of compatibility with EnCase ewfacquire and ewfacquirestream only store the SHA1 digest hash in the Extended EWF (EWF-X) format. ewfacquire and ewfacquirestream provide support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.
https://libewf.sourceforge.net/
Adepto
http://www.e-fense.com/helix/
aimage
Part of the AFF system, aimage can create files is raw, AFF, AFD, or AFM formats. AFF and AFD formats can be compressed or uncompressed. aimage can optionally compress and calculate MD5 or SHA-1 hash residues while the data is being copied. It has intelligent error recovery, similar to what is in ddrescue.
AIR
AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
http://air-imager.sourceforge.net/
dcfldd
A version of dd created by the Digital Computer Forensics Laboratory. dcfldd is an enhanced version of GNU dd with features useful for forensics and security, such as calculating MD5 or SHA-1 hashes on the fly and faster disk wiping.
dd
A program that converts and copies files, is one of the oldest Unix programs. I can copy data from any Unix "file" (including a raw partition) to any other Unix "file" (including a disk file or a raw partition). This is one of the oldest of the imaging tools, and produces raw image files. Extended into dcfldd.
EnCase LinEn
Linux-based version of EnCase's forensic imaging tool.
GNU ddrescue
http://www.gnu.org/software/ddrescue/ddrescue.html
dd_rescue
http://www.garloff.de/kurt/linux/ddrescue/
A tool similar to dd, but unlike dd it will continue reading the next sector, if it stumbles over bad sectors it cannot read.
iLook IXimager
The primary imaging tool for iLook. It is Linux based and produces compressed authenticatable image files that may only be read in the iLook analysis tool.
MacQuisition Boot CD
Provides software to safely image Macintosh drives.
rdd
http://sourceforge.net/projects/rdd
Rdd is robust with respect to read errors and incorporates several other functions: MD5 and SHA-1 hashing, block hashing, entropy computation, checksumming, network transfer, and output splitting.
sdd
Another dd-like tool. It is supposed to be faster in certain situations.

Windows-based imagers

AccessData
Their ultimate tool lets you "READ, ACQUIRE, DECRYPT, ANALYZE and REPORT (R.A.D.A.R.)."
ASR
A tool for imaging and analyzing disks.
DIBS
Can image and convert many file formats. Also builds mobile toolkit.
EnCase
Can image with out dongle plugged in. Only images to E0* file.
FTK Imager by AccessData
Can image and convert many image formats. Including E0* (EWF-E01), s0* (EWF-S01) and dd. Also a free tool.
Ghost
FTK can read forensic, uncompressed Ghost images.
iLook
The IRS's set of forensic tools and utilities. iLook V8 can image in Windows.
Paraben
A complete set of tools for Windows (and handheld) products.
ProDiscovery
Images and searches FAT12, FAT16, FAT32 and all NTFS files.
X-Ways Forensics
Has some limited imaging capabilities. The output is raw format.
X-Ways Replica
Performs hard disk cloning and imaging. The output is raw format.