Difference between revisions of "Main Page"

From ForensicsWiki
Jump to: navigation, search
m
m
(29 intermediate revisions by 3 users not shown)
Line 2: Line 2:
 
This is the '''Forensics Wiki''', a [http://creativecommons.org/licenses/by-sa/2.5/ Creative Commons]-licensed [http://en.wikipedia.org/wiki/Wiki wiki] devoted to information about [[digital forensics]] (also known as computer forensics). We currently list a total of [[Special:Allpages|{{NUMBEROFARTICLES}}]] pages.
 
This is the '''Forensics Wiki''', a [http://creativecommons.org/licenses/by-sa/2.5/ Creative Commons]-licensed [http://en.wikipedia.org/wiki/Wiki wiki] devoted to information about [[digital forensics]] (also known as computer forensics). We currently list a total of [[Special:Allpages|{{NUMBEROFARTICLES}}]] pages.
 
    
 
    
−
Much of [[computer forensics]] is focused on the [[tools]] and [[techniques]] used by [[investigator]]s, but there are also a number of important [[papers]], [[people]], and [[organizations]] involved. Many of those organizations sponsor [[conferences]] throughout the year and around the world. You may also wish to examine the popular [[journals]] and some special [[reports]].
+
Much of [[computer forensics]] is focused on the [[tools]] and [[techniques]] used by [[investigator]]s, but there are also a number of important [[papers]], [[people]], and [[organizations]] involved. Many of those organizations sponsor [[Upcoming_events|conferences]] throughout the year and around the world. You may also wish to examine the popular [[journals]] and some special [[reports]].
−
</div>  
+
</div>
 +
 
 +
 
 +
==WIKI NEWS==
 +
2013-05-15: You can now subscribe to Forensics Wiki Recent Changes with the [[ForensicsWiki FeedBurner Feed]]
  
 
{| width="100%"
 
{| width="100%"
Line 12: Line 16:
 
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Research </h2>
 
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Research </h2>
  
−
<small>August 2011</small>
+
<small>June 2013</small>
−
 
+
 
<bibtex>
 
<bibtex>
−
@article{beverly:ipcarving,
+
@INPROCEEDINGS{6503202,  
−
author = "Robert Beverly and Simson Garfinkel and Gregory Cardwell",
+
author={Gessiou, E. and Volanis, S. and Athanasopoulos, E. and Markatos, E.P. and Ioannidis, S.},  
−
journal = "Digital Investigation",
+
booktitle={Global Communications Conference (GLOBECOM), 2012 IEEE},  
−
publisher="Elsevier",
+
title={Digging up social structures from documents on the web},  
−
booktitle = {Proc. of the Eleventh Annual DFRWS Conference},
+
year={2012},
−
title = "Forensic Carving of Network Packets and Associated Data Structures",
+
pages={744-750},  
−
volume=8
+
abstract={We collected more than ten million Microsoft Office documents from public websites, analyzed the metadata stored in each document and extracted information related to social activities. Our analysis revealed the existence of exactly identified cliques of users that edit, revise and collaborate on industrial and military content. We also examined cliques in documents downloaded from Fortune-500 company websites. We constructed their graphs and measured their properties. The graphs contained many connected components and presented social properties. The a priori knowledge of a company's social graph may significantly assist an adversary to launch targeted attacks, such as targeted advertisements and phishing emails. Our study demonstrates the privacy risks associated with metadata by cross-correlating all members identified in a clique with users of Twitter. We show that it is possible to match authors collaborating in the creation of a document with Twitter accounts. To the best of our knowledge, this study is the first to identify individuals and create social cliques solely based on information derived from document metadata. Our study raises major concerns about the risks involved in privacy leakage due to document metadata.},  
−
year = 2011,
+
keywords={data privacy;document handling;graph theory;meta data;social networking (online);Fortune-500 company Websites;Microsoft Office documents;Twitter accounts;company social graph;document metadata;information extraction;metadata analysis;phishing emails;privacy leakage;privacy risks;public Websites;social activities;social cliques;social properties;social structures;targeted advertisements},
−
abstract="Using validated carving techniques, we show that
+
doi={10.1109/GLOCOM.2012.6503202},
−
  popular operating systems (\eg Windows, Linux, and OSX)
+
ISSN={1930-529X},}
−
  frequently have residual IP packets, Ethernet frames,
+
−
  and associated data structures present in system memory
+
−
  from long-terminated network traffic. Such information is useful
+
−
  for many forensic purposes including establishment of
+
−
  prior connection activity and services used;
+
−
  identification of other
+
−
  systems present on the system's LAN or WLAN; geolocation of the
+
−
  host computer system; and cross-drive analysis. We show that network structures can also be
+
−
  recovered from memory that is persisted onto a mass storage medium
+
−
  during the course of system swapping or hibernation.
+
−
  We present our network carving techniques, algorithms and tools,
+
−
  and validate these against both purpose-built memory images and a readily
+
−
  available forensic corpora. These techniques are
+
−
  valuable to both forensics tasks, particularly
+
−
  in analyzing mobile devices, and to cyber-security objectives such
+
−
  as malware analysis."
+
−
}
+
−
 
+
−
 
+
 
</bibtex>
 
</bibtex>
 +
We collected more than ten million Microsoft Office documents from public websites, analyzed the metadata stored in each document and extracted information related to social activities. Our analysis revealed the existence of exactly identified cliques of users that edit, revise and collaborate on industrial and military content. We also examined cliques in documents downloaded from Fortune-500 company websites. We constructed their graphs and measured their properties. The graphs contained many connected components and presented social properties. The a priori knowledge of a company's social graph may significantly assist an adversary to launch targeted attacks, such as targeted advertisements and phishing emails. Our study demonstrates the privacy risks associated with metadata by cross-correlating all members identified in a clique with users of Twitter. We show that it is possible to match authors collaborating in the creation of a document with Twitter accounts. To the best of our knowledge, this study is the first to identify individuals and create social cliques solely based on information derived from document metadata. Our study raises major concerns about the risks involved in privacy leakage due to document metadata.
 +
http://cis.poly.edu/~gessiou/reports/metadata.pdf
  
 
(See also [[Past Selected Articles]])
 
(See also [[Past Selected Articles]])
Line 103: Line 89:
 
* '''[[Tools#Disk_Analysis_Tools|Disk Analysis]]''': [[EnCase]], [[SMART]], [[Sleuthkit]], [[foremost]], [[Scalpel]], [[frag_find]]...
 
* '''[[Tools#Disk_Analysis_Tools|Disk Analysis]]''': [[EnCase]], [[SMART]], [[Sleuthkit]], [[foremost]], [[Scalpel]], [[frag_find]]...
 
* '''[[Tools#Forensics_Live_CDs|Live CDs]]''': [[DEFT Linux]], [[Helix]] ([[Helix3 Pro|Pro]]), [[FCCU Gnu/Linux Boot CD]], [[Knoppix STD]], ...
 
* '''[[Tools#Forensics_Live_CDs|Live CDs]]''': [[DEFT Linux]], [[Helix]] ([[Helix3 Pro|Pro]]), [[FCCU Gnu/Linux Boot CD]], [[Knoppix STD]], ...
−
* '''[[Tools:Document Metadata Extraction|Metadata Extraction]]''': [[wvWare]], [[jhead]], [[Hachoir | hachoir-metadata]], ...
+
* '''[[Tools:Document Metadata Extraction|Metadata Extraction]]''': [[wvWare]], [[jhead]], [[Hachoir | hachoir-metadata]], [[Photo Investigator]]...
 
* '''[[Tools:File Analysis|File Analysis]]''': [[file]], [[ldd]], [[ltrace]], [[strace]], [[strings]], ...
 
* '''[[Tools:File Analysis|File Analysis]]''': [[file]], [[ldd]], [[ltrace]], [[strace]], [[strings]], ...
 
* '''[[Tools:Network_Forensics|Network Forensics]]''': [[Snort]],  [[Wireshark]], [[Kismet]],  [[NetworkMiner]]...
 
* '''[[Tools:Network_Forensics|Network Forensics]]''': [[Snort]],  [[Wireshark]], [[Kismet]],  [[NetworkMiner]]...
Line 126: Line 112:
  
 
</div>
 
</div>
−
 
+
 
  
 
|}
 
|}

Revision as of 18:38, 9 October 2013

This is the Forensics Wiki, a Creative Commons-licensed wiki devoted to information about digital forensics (also known as computer forensics). We currently list a total of 863 pages.

Much of computer forensics is focused on the tools and techniques used by investigators, but there are also a number of important papers, people, and organizations involved. Many of those organizations sponsor conferences throughout the year and around the world. You may also wish to examine the popular journals and some special reports.


WIKI NEWS

2013-05-15: You can now subscribe to Forensics Wiki Recent Changes with the ForensicsWiki FeedBurner Feed

Featured Forensic Research

June 2013

Gessiou, E., Volanis, S., Athanasopoulos, E., Markatos, E.P., Ioannidis, S. - Digging up social structures from documents on the web
Global Communications Conference (GLOBECOM), 2012 IEEE pp. 744-750,2012
Bibtex
Author : Gessiou, E., Volanis, S., Athanasopoulos, E., Markatos, E.P., Ioannidis, S.
Title : Digging up social structures from documents on the web
In : Global Communications Conference (GLOBECOM), 2012 IEEE -
Address :
Date : 2012

We collected more than ten million Microsoft Office documents from public websites, analyzed the metadata stored in each document and extracted information related to social activities. Our analysis revealed the existence of exactly identified cliques of users that edit, revise and collaborate on industrial and military content. We also examined cliques in documents downloaded from Fortune-500 company websites. We constructed their graphs and measured their properties. The graphs contained many connected components and presented social properties. The a priori knowledge of a company's social graph may significantly assist an adversary to launch targeted attacks, such as targeted advertisements and phishing emails. Our study demonstrates the privacy risks associated with metadata by cross-correlating all members identified in a clique with users of Twitter. We show that it is possible to match authors collaborating in the creation of a document with Twitter accounts. To the best of our knowledge, this study is the first to identify individuals and create social cliques solely based on information derived from document metadata. Our study raises major concerns about the risks involved in privacy leakage due to document metadata. http://cis.poly.edu/~gessiou/reports/metadata.pdf

(See also Past Selected Articles)

Featured Article

Forensic Linux Live CD issues
Forensic Linux Live CD distributions are widely used during computer forensic investigations. Currently, many vendors of such Live CD distributions state that their Linux do not modify the contents of hard drives or employ "write protection." Testing indicates that this may not always be the case. Read More...


Topics


You can help! We have a list of articles that need to be expanded. If you know anything about any of these topics, please feel free to chip in.