Difference between pages "Upcoming events" and "Tools:Data Recovery"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Conferences)
 
(Carving)
 
Line 1: Line 1:
<b>PLEASE READ BEFORE YOU EDIT THE LISTS BELOW</b><br>
+
{{Wikify}}
Events should be posted in the correct section, and in date order.  An event should NEVER be listed in more than one section (i.e. Ongoing/Continuous events should not be listed in Scheduled Training).  When events begin the same day, events of a longer length should be listed first.  New postings of events with the same date(s) as other events should be added after events already in the list. If a provider offers the same event at several locations simultaneously, the listing should have a single (ONE) entry in the list with the date(s) and ALL locations for the event. Please use three-letter month abbreviations (i.e. Sep, NOT Sept. or September), use two digit dates (i.e. Jan 01 NOT Jan 1), and use date ranges rather than listing every date during an event(i.e. Jan 02-05, NOT Jan 02, 03, 04, 05).<br>
+
<i>Some conferences or training opportunities may be <u>limited</u> to <b>Law Enforcement Only</b> or to a specific audience.  Such restrictions should be noted when known.</i>
+
  
This is a BY DATE listing of upcoming conferences and training events relevant to [[digital forensics]].  It is not an all inclusive list, but includes most well-known activities.  Some events may duplicate events on the generic [[conferences]] page, but entries in this list have specific dates and locations for the upcoming event.
+
= Partition Recovery =
  
This listing is divided into four sections (described as follows):<br>
+
; [[Partition Table Doctor]]
<ol><li><b><u>Calls For Papers</u></b> - Calls for papers for either Journals or for Conferences, relevant to Digital Forensics (Name, Closing Date, URL)</li><br>
+
: http://www.ptdd.com/index.htm
<li><b><u>Conferences</u></b> - Conferences relevant for Digital Forensics (Name, Date, Location, URL)</li><br>
+
<li><b><u>On-Going / Continuous Training</u></b> - Training opportunities that are either always available online/distance learning format or that are offered the same time every month (Name, date-if applicable, URL)</li><br>
+
<li><b><u>[[Scheduled Training Courses]]</u></b> - Training Classes/Courses that are scheduled for specific dates/locations. This would include online (or distance learning format) courses which begin on specific dates, instead of the "start anytime" courses listed in the previous section. (Name, Date(s), Location(s), URL) (''note: this has been moved to its own page.'')<br></li></ol>
+
  
The Conference and Training List is provided by the American Academy of Forensic Sciences (AAFS) Digital and Multi-media Listserv. 
+
; [[parted]]
<i> (Subscribe by sending an email to listserv@lists.mitre.org with message body containing SUBSCRIBE AAFS-DIGITAL-MULTIMEDIA-LIST)</i>
+
: The Linux partition management tool.
Requests for additions, deletions or corrections to this list may be sent by email to David Baker <i>(bakerd AT mitre.org)</i>.
+
  
== Calls For Papers ==
+
; [[Active Partition Recovery]]
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
: ...
|- style="background:#bfbfbf; font-weight: bold"
+
! Title
+
! Due Date
+
! Website
+
|-
+
|2nd International Workshop on Computational Forensics
+
|Apr 20, 2008
+
|http://iwcf08.arsforensica.org/download/IWCF08-CFP-USletter.pdf
+
|-
+
|RECON 2008
+
|Apr 30, 2008
+
|http://recon.cx/2008/recon2008-cfp.txt
+
|-
+
|Black Hat Japan 2008 Briefings
+
|OPEN ON May 01, 2008
+
|https://cfp.blackhat.com/
+
|-
+
|Techno-Security 2008
+
|May 04, 2008
+
|http://www.techsec.com/html/TechnoPapers.html
+
|-
+
|Black Hat USA 2008 Briefings
+
|May 14, 2008
+
|https://www.blackhat.com/html/bh-usa-08/bh-usa-08-cfp.html
+
|-
+
|4th International Conference on IT Incident Management & IT Forensics
+
|Jun 01, 2008
+
|http://www.gi-ev.de/fachbereiche/sicherheit/fg/sidar/imf/imf2008/cfp_en.html
+
|-
+
|ANZFSS - 19th International Symposium on the Forensic Sciences
+
|Jul 06, 2008
+
|http://www.anzfss2008.org.au/content/view/56/63/
+
|-
+
|American Academy of Forensic Sciences Annual Meeting
+
|Aug 01, 2008
+
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
+
|-
+
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
+
|Oct 15, 2008
+
|http://www.ifip119.org/Conferences/WG11-9-CFP-2009.pdf
+
|-
+
|}
+
  
== Conferences ==
+
; [[gpart]]
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
: http://www.stud.uni-hannover.de/user/76201/gpart/
|- style="background:#bfbfbf; font-weight: bold"
+
! Title
+
! Date/Location
+
! Website
+
|-
+
|RSA Conference 2008
+
|Apr 07-11, San Francisco, CA
+
|http://www.rsaconference.com/2008/US/Home.aspx
+
|-
+
|2008 National OPSEC Conference
+
|Apr 07-11, Denver, CO
+
|http://www.nsa.gov/ia/events/conferences/index.cfm?ConferenceID=53
+
|-
+
|USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET '08) Botnets, Spyware, Worms, and More
+
|Apr 15, San Francisco, CA
+
|http://www.usenix.org/events/leet08/index.html
+
|-
+
|ADFSL 2008 Conference on Digital Forensics, Security and Law
+
|Apr 23-25, Oklahoma City, OK
+
|http://www.digitalforensics-conference.org
+
|-
+
|CEIC 2008 Computer & Enterprise Investigations Conference
+
|Apr 27-30, Las Vegas, NV
+
|http://www.ceicconference.com/
+
|-
+
|Microsoft Law Enforcement Tech Conference 2008
+
|Apr 28-30, Redmond, Washington
+
|-
+
|HTCIA/ASIS High Technology Crime Conference
+
|May 06-08, San Francisco, CA
+
|http://htciatraining.org/general_info.asp
+
|-
+
|Fourth Annual Cyber Security and Information Intelligence Research Workshop (CSIIRW-08)
+
|May 12-14, Oak Ridge, TN
+
|http://www.ioc.ornl.gov/csiirw
+
|-
+
|Ohio HTCIA Spring Training Conference
+
|May 12-14, Lakeland Community College, OH
+
|http://www.ohiohtcia.org/conference.html
+
|-
+
|LayerOne 2008 Information Technology Conference
+
|May 17-18, Los Angeles, CA
+
|http://layerone.info
+
|-
+
|EuSecWest Security Conference 2008
+
|May 21-22, London, England
+
|http://eusecwest.com/
+
|-
+
|3rd International Workshop on Systematic Approaches to Digital Forensic Engineering
+
|May 22, Oakland, CA
+
|http://conf.ncku.edu.tw/sadfe/sadfe08/
+
|-
+
|Techno-Security 2008
+
|Jun 01-04, Myrtle Beach, SC
+
|http://www.techsec.com/html/Techno2008.html
+
|-
+
|Gartner IT Security Summit
+
|Jun 02-04, Washington, DC
+
|http://www.gartner.com/it/page.jsp?id=507478&tab=overview
+
|-
+
|6th International Conference on Applied Cryptography and Network Security
+
|Jun 03-06, Columbia University, New York City, NY
+
|http://acns2008.cs.columbia.edu/
+
|-
+
|RECON 2008
+
|Jun 13-15, Montreal, Quebec, Canada
+
|http://recon.cx/2008/
+
|-
+
|Usenix Annual Technical Conference
+
|Jun 22-27, Boston, MA
+
|http://www.usenix.com/events/usenix08/
+
|-
+
|International Association of Forensic Sciences Annual Meeting
+
|Jul 21-26, New Orleans, LA
+
|http://www.iafs2008.com/
+
|-
+
|17th USENIX Security Symposium
+
|Jul 28-Aug 01, San Jose, CA
+
|http://www.usenix.org/events/sec08/
+
|-
+
|Blackhat USA 2008 Briefings & Training
+
|Aug 02-07, Las Vegas, NV
+
|http://www.blackhat.com/html/bh-link/briefings.html
+
|-
+
|2nd International Workshop on Computational Forensics
+
|Aug 07-08, Washington, DC
+
|http://iwcf08.arsforensica.org
+
|-
+
|Defcon 16
+
|Aug 08-10, Las Vegas, NV
+
|http://www.defcon.org
+
|-
+
|Digital Forensic Research Workshop
+
|Aug 11-13, Baltimore, MD
+
|http://www.dfrws.org
+
|-
+
|International Workshop on Digital Crime and Forensics in conjunction w/4th International Conference on Intelligent Information Hiding and Multimedia Signal Processing
+
|Aug 15-17, Harbin, China
+
|http://www.dcs.warwick.ac.uk/~ctli/CFP_IWDCF2008.html
+
|-
+
|11th International Symposium on Recent Advances in Intrusion Detection
+
|Sep 15-17, Cambridge, MA
+
|http://www.ll.mit.edu/IST/RAID2008/
+
|-
+
|4th International Conference on IT Incident Management & IT Forensics
+
|Sep 23-25, Mannheim,  Germany
+
|http://www.imf-conference.org/
+
|-
+
|ANZFSS - 19th International Symposium on the Forensic Sciences
+
|Oct 06-09, Melbourne, Australia
+
|http://www.anzfss2008.org.au/
+
|-
+
|2008 HTCIA International Training Conference
+
|Oct 22-28, Atlantic City, NJ
+
|http://www.htcia.org/conference.shtml
+
|-
+
|2009 DoD Cyber Crime Conference
+
|Jan 24-30, St. Louis, MO
+
|http://www.dodcybercrime.com/
+
|-
+
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
+
|Jan 25-28, Orlando, FL
+
|http://www.ifip119.org/Conferences/
+
|-
+
|American Academy of Forensic Sciences Annual Meeting
+
|Feb 16-21, Denver, CO
+
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
+
|-
+
|}
+
  
== On-going / Continuous Training ==
+
; [[Testdisk]]
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
: http://www.cgsecurity.org/wiki/TestDisk
|- style="background:#bfbfbf; font-weight: bold"
+
 
! Title
+
== See Also ==
! Date/Location or Venue
+
 
! Website
+
* [http://support.microsoft.com/?kbid=166997 Using Norton Disk Edit to Backup Your Master Boot Record]
|-
+
 
|Basic Computer Examiner Course - Computer Forensic Training Online
+
== Notes ==
|Distance Learning Format
+
 
|http://www.cftco.com
+
* "fdisk /mbr" restores the boot code in the [[MBR]], but not the partition itself.
|-
+
= Data Recovery =
|Linux Data Forensics Training
+
 
|Distance Learning Format
+
; [[BringBack]]
|http://www.crazytrain.com/training.html
+
: http://www.toolsthatwork.com/
|-
+
: BringBack offers easy to use, inexpensive, and highly successful data recovery for Windows and Linux (ext2) operating systems and digital images stored on memory cards, etc.
|SANS On-Demand Training
+
 
|Distance Learning Format
+
; [[ByteBack Data Recovery Investigative Suite v4.0]]
|http://www.sans.org/ondemand/?portal=69456f95660ade45be29c00b0c14aea1
+
: http://www.toolsthatwork.com
|-
+
: Now with UDMA, ATA & SATA support, memory management and greater ease and control of partition and MBR manipulations, ByteBack continues to uphold it's viability as the computer forensics and recovery application of professionals.
|MaresWare Suite Training
+
 
|First full week every month, Atlanta, GA
+
; [[RAID Reconstructor]]
|http://www.maresware.com/maresware/training/maresware.htm
+
: http://www.runtime.org/raid.htm
|-
+
: Runtime Software's RAID Reconstructor will reconstruct [[RAID Level 0]] (Striping) and [[RAID Level 5]] drives.
|Evidence Recovery for Windows Vista&trade;
+
 
|First full week every month, Brunswick, GA
+
; [[Salvation Data]]
|http://www.internetcrimes.net
+
: http://www.salvationdata.com
|-
+
: Claims to have a program that can read the "[[bad blocks]]" of [[Maxtor]] drives with proprietary commands.
|Evidence Recovery for Windows Server&reg; 2003 R2
+
 
|Second full week every month, Brunswick, GA
+
=Carving=
|http://www.internetcrimes.net
+
; [[DataLifter DataLifter® - File Extractor Pro]]
|-
+
: http://www.datalifter.com/products.htm
|Evidence Recovery for the Windows XP&trade; operating system
+
 
|Third full week every month, Brunswick, GA
+
; [[Scalpel]]
|http://www.internetcrimes.net
+
: Currently the most popular open-source carving tool.
|-
+
 
|Computer Forensics Training and CCE&trade; Testing for Litigation Support Professionals
+
; [[EnCase]]
|Third weekend of every month (Fri-Mon), Dallas, TX
+
: EnCase comes with some eScripts that will do carving.
|http://www.md5group.com
+
 
|-
+
; [[CarvFs]]
|}
+
A virtual filesystem (fuse) implementation that can provide carving tools
==[[Scheduled Training Courses]]==
+
with the posibility to do recursive multi tool zero-storage carving
 +
(also called in-place carving). Patches and scripts for scalpel and
 +
foremost are provided. Works on raw and encase images.
 +
: http://ocfa.sourceforge.net/libcarvpath/
 +
 
 +
; [[LibCarvPath]]
 +
: http://ocfa.sourceforge.net/libcarvpath/
 +
A shared library that allows carving tools to use zero-storage carving on
 +
carvfs virtual files.

Revision as of 03:16, 18 January 2007

40px-Ambox warning pn.png

This article, and others, needs to be wikified.
Please remove this template after wikifying.

Partition Recovery

Partition Table Doctor
http://www.ptdd.com/index.htm
parted
The Linux partition management tool.
Active Partition Recovery
...
gpart
http://www.stud.uni-hannover.de/user/76201/gpart/
Testdisk
http://www.cgsecurity.org/wiki/TestDisk

See Also

Notes

  • "fdisk /mbr" restores the boot code in the MBR, but not the partition itself.

Data Recovery

BringBack
http://www.toolsthatwork.com/
BringBack offers easy to use, inexpensive, and highly successful data recovery for Windows and Linux (ext2) operating systems and digital images stored on memory cards, etc.
ByteBack Data Recovery Investigative Suite v4.0
http://www.toolsthatwork.com
Now with UDMA, ATA & SATA support, memory management and greater ease and control of partition and MBR manipulations, ByteBack continues to uphold it's viability as the computer forensics and recovery application of professionals.
RAID Reconstructor
http://www.runtime.org/raid.htm
Runtime Software's RAID Reconstructor will reconstruct RAID Level 0 (Striping) and RAID Level 5 drives.
Salvation Data
http://www.salvationdata.com
Claims to have a program that can read the "bad blocks" of Maxtor drives with proprietary commands.

Carving

DataLifter DataLifter® - File Extractor Pro
http://www.datalifter.com/products.htm
Scalpel
Currently the most popular open-source carving tool.
EnCase
EnCase comes with some eScripts that will do carving.
CarvFs

A virtual filesystem (fuse) implementation that can provide carving tools with the posibility to do recursive multi tool zero-storage carving (also called in-place carving). Patches and scripts for scalpel and foremost are provided. Works on raw and encase images.

http://ocfa.sourceforge.net/libcarvpath/
LibCarvPath
http://ocfa.sourceforge.net/libcarvpath/

A shared library that allows carving tools to use zero-storage carving on carvfs virtual files.