Difference between pages "First Responder's Evidence Disk" and "DoD Cyber Crime Center"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
(Added a download link to FRED)
 
(New page: The Defense Cyber Crime Center, or DC3, is a Department of Defense organization run by the Air Force Office of Special Investigations. The center consists of three divisions: * ...)
 
Line 1: Line 1:
The First Responder's Evidence Disk, or FRED, is a script based [[Incident Response|incident response]] tool. It was designed to capture volatile information from a computer system for later analysis without modifying anything on the victim. It consists of a batch file used to execute a set of known good tools that gather the state of a victim computer system. It was similar to the [[IRCR]] program and has been widely imitated by other tools. Many other incident response tools used names similar to FRED.
+
The Defense Cyber Crime Center, or DC3, is a Department of Defense organization run by the [[AFOSI|Air Force Office of Special Investigations]]. The center consists of three divisions:
  
== Usage ==
+
* [[DCFL|Defense Computer Forensics Lab]]
 +
* [[DCITA|Defense Computer Investigations Training Academy]]
 +
* [[DCCI|Defense Cyber Crime Institute]]
  
The program was distributed as a compressed 1.44 MB floppy image. The examiner runs this image on a safe system and writes the FRED program out to a piece of removable media such as a floppy disk or USB device. The examiner then connects this device to the victim machine. When run, the FRED program writes information out to an audit file on the removable device. The examiner takes this audit file back to the safe system for later analysis. The audit file can also be sent to other investigators if desired.
+
== Events ==
  
== History ==
+
The DC3 sponsors an annual [[Conferences|conference]], the DoD Cybercrime Conference. The last conference was held in January 2007 in St. Louis, MO.
  
FRED was developed by [[Jesse Kornblum]] for the [[Air Force Office of Special Investigations]] starting in the fall of 2000 and was first released in 2001. The tool was publicly unveiled the following year at the [[Digital Forensic Research Workshop|DFRWS Conference]]. Although the component parts of FRED were not released, mostly due to licensing restrictions, Kornblum did present a paper, ''[http://dfrws.org/2002/papers/Papers/Jesse_Kornblum.pdf Preservation of Fragile Digital Evidence by First Responders]'', that included the FRED script.  
+
In 2006 the DC3 ran a [[DC3 Digital Forensics Challenge|Digital Forensics Challenge]]. At the 2007 DoD Cybercrime conference, the DC3 announced plans to make the challenge an annual event.
  
A version of the FRED script was later incorporated into the [[Helix]] disk.
+
== History ==
  
There was a proposal for a program to process the audit files into [[HTML]], but this never came to fruition.
+
The DC3 was formed in 2001 when the newly created [[DCCI]] was merged with the existing [[DCFL]] and [[DCITA]] (at the time called the Defense Computer Investigations Training Program (DCITP).  
 
+
Since 2004 FRED has been maintained by the [[Air Force Computer Emergency Response Team]]. The current version of FRED (version 4) has been redesigned as a single executable, with remote collection capabilities, and uses Native API functions. The audit file uses PKI for encryption to protect the contents from tampering and disclosure. The publicly available version has remote functionality, and PKI encryption capabilities removed.
+
 
+
== Trivia ==
+
 
+
The desire for a recursive [[MD5]] program for FRED inspired the development of [[md5deep]].
+
 
+
== See Also ==
+
 
+
* [[IRCR]]
+
* [[COFEE]]
+
  
 
== External Links ==
 
== External Links ==
  
; [[FRED]]
+
* [http://dc3.mil/ Official website]
: http://www.box.net/shared/xu0hag8sya
+
: Hopefully this link stays pretty persistent since it is my box account [[User:Vesh|Vesh]]vesh.
+
 
+
 
+
 
+
[[Category:Incident response tools]]
+

Revision as of 16:03, 25 February 2007

The Defense Cyber Crime Center, or DC3, is a Department of Defense organization run by the Air Force Office of Special Investigations. The center consists of three divisions:

Events

The DC3 sponsors an annual conference, the DoD Cybercrime Conference. The last conference was held in January 2007 in St. Louis, MO.

In 2006 the DC3 ran a Digital Forensics Challenge. At the 2007 DoD Cybercrime conference, the DC3 announced plans to make the challenge an annual event.

History

The DC3 was formed in 2001 when the newly created DCCI was merged with the existing DCFL and DCITA (at the time called the Defense Computer Investigations Training Program (DCITP).

External Links