<br />
Digital<br />
The Quarterly Magazine for Digital Forensics Practitioners<br />
<br />
EXCLUSIVE!<br />
ForensicS<br />
Win a free pass to the<br />
Forensics<br />
Summit<br />
<br />
<br />
ISSUE 04<br />
/ magazine 1 AUGUST 2010<br />
<br />
<br />
INSIDE<br />
/ You've Been Framed!<br />
/ Digital Forensics in<br />
Law Enforcement<br />
/ Pyschosocial<br />
Forensics<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br /&g<a title="DF4_Online.pdf page 1" href="http://viewer.zmags.com/publication/05e919e2?page=1">Digital The Quarterly Magazine for Digital Fore</a> Digital The Quarterly Magazine for Digital Fore<a title="DF4_Online.pdf page 2" href="http://viewer.zmags.com/publication/05e919e2?page=2">Shape your futureForensic Computing MSc Fo</a> Shape your futureForensic Computing MSc Fo<a title="DF4_Online.pdf page 3" href="http://viewer.zmags.com/publication/05e919e2?page=3">EDITORIAL T </a> EDITORIAL T <a title="DF4_Online.pdf page 4" href="http://viewer.zmags.com/publication/05e919e2?page=4">Reviewing the latest sports highlights</a> Reviewing the latest sports highlights<a title="DF4_Online.pdf page 5" href="http://viewer.zmags.com/publication/05e919e2?page=5">/ CONTENTSCONTENTS/ DIGITAL FORENSICS MAGAZ</a> / CONTENTSCONTENTS/ DIGITAL FORENSICS MAGAZ<a title="DF4_Online.pdf page 6" href="http://viewer.zmags.com/publication/05e919e2?page=6">/ NEWSNEWSNATO’s Plans To Defend Against Cyb</a> / NEWSNEWSNATO’s Plans To Defend Against Cyb<a title="DF4_Online.pdf page 7" href="http://viewer.zmags.com/publication/05e919e2?page=7">with just under 50% also listing themselves as ‘D</a> with just under 50% also listing themselves as ‘D<a title="DF4_Online.pdf page 8" href="http://viewer.zmags.com/publication/05e919e2?page=8">Mobile Development from ApressThe la</a> Mobile Development from ApressThe la<a title="DF4_Online.pdf page 9" href="http://viewer.zmags.com/publication/05e919e2?page=9">360°TYour chance to have your say … </a> 360°TYour chance to have your say … <a title="DF4_Online.pdf page 10" href="http://viewer.zmags.com/publication/05e919e2?page=10">/ LETTERS3) What is Zmag.com? Why is it when</a> / LETTERS3) What is Zmag.com? Why is it when<a title="DF4_Online.pdf page 11" href="http://viewer.zmags.com/publication/05e919e2?page=11"> Forensic Computing12-month st</a> Forensic Computing12-month st<a title="DF4_Online.pdf page 12" href="http://viewer.zmags.com/publication/05e919e2?page=12">/ LEAD FEATUREPROACTIVE COMPUTERFORENSICSTH</a> / LEAD FEATUREPROACTIVE COMPUTERFORENSICSTH<a title="DF4_Online.pdf page 13" href="http://viewer.zmags.com/publication/05e919e2?page=13">circumstances of preparation indicate lack of tru</a> circumstances of preparation indicate lack of tru<a title="DF4_Online.pdf page 14" href="http://viewer.zmags.com/publication/05e919e2?page=14">/ LEAD FEATURE For example, the use of c</a> / LEAD FEATURE For example, the use of c<a title="DF4_Online.pdf page 15" href="http://viewer.zmags.com/publication/05e919e2?page=15"> We will examine section 9 as it relates to h</a> We will examine section 9 as it relates to h<a title="DF4_Online.pdf page 16" href="http://viewer.zmags.com/publication/05e919e2?page=16">/ LEAD FEATURE This is very similar to A</a> / LEAD FEATURE This is very similar to A<a title="DF4_Online.pdf page 17" href="http://viewer.zmags.com/publication/05e919e2?page=17">CellsiteanalysisComputer forensicsAudiov</a> CellsiteanalysisComputer forensicsAudiov<a title="DF4_Online.pdf page 18" href="http://viewer.zmags.com/publication/05e919e2?page=18">/ FEATUREWHO’S BEEN FRAMED?How effective are</a> / FEATUREWHO’S BEEN FRAMED?How effective are<a title="DF4_Online.pdf page 19" href="http://viewer.zmags.com/publication/05e919e2?page=19">attack itself and not the actions that follow. It</a> attack itself and not the actions that follow. It<a title="DF4_Online.pdf page 20" href="http://viewer.zmags.com/publication/05e919e2?page=20">/ FEATUREpenetrate the wireless network of a</a> / FEATUREpenetrate the wireless network of a<a title="DF4_Online.pdf page 21" href="http://viewer.zmags.com/publication/05e919e2?page=21">wireless attack conducted by the malicious user b</a> wireless attack conducted by the malicious user b<a title="DF4_Online.pdf page 22" href="http://viewer.zmags.com/publication/05e919e2?page=22">/ FEATUREhave also taken steps to truly make</a> / FEATUREhave also taken steps to truly make<a title="DF4_Online.pdf page 23" href="http://viewer.zmags.com/publication/05e919e2?page=23">/ NEXT ISSUECOMING SOON… Some of the great</a> / NEXT ISSUECOMING SOON… Some of the great<a title="DF4_Online.pdf page 24" href="http://viewer.zmags.com/publication/05e919e2?page=24">/ FEATUREPSYCHOSOCIALFORENSICSExploring a</a> / FEATUREPSYCHOSOCIALFORENSICSExploring a<a title="DF4_Online.pdf page 25" href="http://viewer.zmags.com/publication/05e919e2?page=25">/ Crime Scene Investigation ProcessFigure 1 show</a> / Crime Scene Investigation ProcessFigure 1 show<a title="DF4_Online.pdf page 26" href="http://viewer.zmags.com/publication/05e919e2?page=26">/ FEATUREPsychosocial crimescene investigat</a> / FEATUREPsychosocial crimescene investigat<a title="DF4_Online.pdf page 27" href="http://viewer.zmags.com/publication/05e919e2?page=27">/ MERITThe MERIT (Management and Education of th</a> / MERITThe MERIT (Management and Education of th<a title="DF4_Online.pdf page 28" href="http://viewer.zmags.com/publication/05e919e2?page=28"></a> <a title="DF4_Online.pdf page 29" href="http://viewer.zmags.com/publication/05e919e2?page=29">COMPETITION/ Win a free ticket to the SANS Digit</a> COMPETITION/ Win a free ticket to the SANS Digit<a title="DF4_Online.pdf page 30" href="http://viewer.zmags.com/publication/05e919e2?page=30">/ FEATURETHE STATE OFDIGITAL FORENSICS I</a> / FEATURETHE STATE OFDIGITAL FORENSICS I<a title="DF4_Online.pdf page 31" href="http://viewer.zmags.com/publication/05e919e2?page=31">police officers and civilian staff, although a few</a> police officers and civilian staff, although a few<a title="DF4_Online.pdf page 32" href="http://viewer.zmags.com/publication/05e919e2?page=32">/ FEATURE/ Asia-South PacificIn both Australi</a> / FEATURE/ Asia-South PacificIn both Australi<a title="DF4_Online.pdf page 33" href="http://viewer.zmags.com/publication/05e919e2?page=33">law enforcement’s ability to deal with the eviden</a> law enforcement’s ability to deal with the eviden<a title="DF4_Online.pdf page 34" href="http://viewer.zmags.com/publication/05e919e2?page=34">/ FEATUREto certification in the use of thei</a> / FEATUREto certification in the use of thei<a title="DF4_Online.pdf page 35" href="http://viewer.zmags.com/publication/05e919e2?page=35">Pharos Flyer With Bleed.pdf 1 11/06/2010 23:44:43</a> Pharos Flyer With Bleed.pdf 1 11/06/2010 23:44:43<a title="DF4_Online.pdf page 36" href="http://viewer.zmags.com/publication/05e919e2?page=36">Pharos Flyer With Bleed.pdf 2 11/06/2010 23:44:44</a> Pharos Flyer With Bleed.pdf 2 11/06/2010 23:44:44<a title="DF4_Online.pdf page 37" href="http://viewer.zmags.com/publication/05e919e2?page=37">/ LEGAL EDITORIALLEGAL EDITORIAL Welcome aga</a> / LEGAL EDITORIALLEGAL EDITORIAL Welcome aga<a title="DF4_Online.pdf page 38" href="http://viewer.zmags.com/publication/05e919e2?page=38">/ LEGAL FEATURETHE EXPERTWITNESSFROM COMPUT</a> / LEGAL FEATURETHE EXPERTWITNESSFROM COMPUT<a title="DF4_Online.pdf page 39" href="http://viewer.zmags.com/publication/05e919e2?page=39">a single specialist, a ‘Single Joint Expert’ (SJE</a> a single specialist, a ‘Single Joint Expert’ (SJE<a title="DF4_Online.pdf page 40" href="http://viewer.zmags.com/publication/05e919e2?page=40">/ LEGAL FEATUREthe governing body for that i</a> / LEGAL FEATUREthe governing body for that i<a title="DF4_Online.pdf page 41" href="http://viewer.zmags.com/publication/05e919e2?page=41">MaximisePrioritiseVisualiseCall IntaForen</a> MaximisePrioritiseVisualiseCall IntaForen<a title="DF4_Online.pdf page 42" href="http://viewer.zmags.com/publication/05e919e2?page=42">/ LEGAL NEWS ALERTLEGAL NEWS ALERTOpen S</a> / LEGAL NEWS ALERTLEGAL NEWS ALERTOpen S<a title="DF4_Online.pdf page 43" href="http://viewer.zmags.com/publication/05e919e2?page=43">Opening the Gates to EffectiveComputer Forensi</a> Opening the Gates to EffectiveComputer Forensi<a title="DF4_Online.pdf page 44" href="http://viewer.zmags.com/publication/05e919e2?page=44">/ PRODUCT REVIEWPRODUCT REVIEWProduct Purpos</a> / PRODUCT REVIEWPRODUCT REVIEWProduct Purpos<a title="DF4_Online.pdf page 45" href="http://viewer.zmags.com/publication/05e919e2?page=45">/ Acquiring Digital Image Types and Preservin</a> / Acquiring Digital Image Types and Preservin<a title="DF4_Online.pdf page 46" href="http://viewer.zmags.com/publication/05e919e2?page=46">/ PRODUCT REVIEW The main Imager window </a> / PRODUCT REVIEW The main Imager window <a title="DF4_Online.pdf page 47" href="http://viewer.zmags.com/publication/05e919e2?page=47">Figure 3 TSK was tested using the non-inte</a> Figure 3 TSK was tested using the non-inte<a title="DF4_Online.pdf page 48" href="http://viewer.zmags.com/publication/05e919e2?page=48">/ PRODUCT REVIEWtests headers for type and m</a> / PRODUCT REVIEWtests headers for type and m<a title="DF4_Online.pdf page 49" href="http://viewer.zmags.com/publication/05e919e2?page=49">DigitalForensicS/ magazineDigital Forensics m</a> DigitalForensicS/ magazineDigital Forensics m<a title="DF4_Online.pdf page 50" href="http://viewer.zmags.com/publication/05e919e2?page=50">/ FEATUREIPHORENSICS –NO PAIN, NO GAIN! Th</a> / FEATUREIPHORENSICS –NO PAIN, NO GAIN! Th<a title="DF4_Online.pdf page 51" href="http://viewer.zmags.com/publication/05e919e2?page=51">a kill command to zero the storage either interna</a> a kill command to zero the storage either interna<a title="DF4_Online.pdf page 52" href="http://viewer.zmags.com/publication/05e919e2?page=52">/ FEATUREone layer, collaborative evidence m</a> / FEATUREone layer, collaborative evidence m<a title="DF4_Online.pdf page 53" href="http://viewer.zmags.com/publication/05e919e2?page=53">IPhone 3 Soldered on Chips/ Faraday BagThe iPho</a> IPhone 3 Soldered on Chips/ Faraday BagThe iPho<a title="DF4_Online.pdf page 54" href="http://viewer.zmags.com/publication/05e919e2?page=54">/ FEATUREpractices, to assure the “forensica</a> / FEATUREpractices, to assure the “forensica<a title="DF4_Online.pdf page 55" href="http://viewer.zmags.com/publication/05e919e2?page=55">DigitalForensicS/ magazinePLACE YOU</a> DigitalForensicS/ magazinePLACE YOU<a title="DF4_Online.pdf page 56" href="http://viewer.zmags.com/publication/05e919e2?page=56">/ MEET THE PROFESSIONALSMEET THE DFPROFESSIO</a> / MEET THE PROFESSIONALSMEET THE DFPROFESSIO<a title="DF4_Online.pdf page 57" href="http://viewer.zmags.com/publication/05e919e2?page=57">What are your views on the industry standard tool</a> What are your views on the industry standard tool<a title="DF4_Online.pdf page 58" href="http://viewer.zmags.com/publication/05e919e2?page=58">/ PRODUCT REVIEWPRODUCT REVIEWProduct Purpos</a> / PRODUCT REVIEWPRODUCT REVIEWProduct Purpos<a title="DF4_Online.pdf page 59" href="http://viewer.zmags.com/publication/05e919e2?page=59">are concentrating most of their effort into the p</a> are concentrating most of their effort into the p<a title="DF4_Online.pdf page 60" href="http://viewer.zmags.com/publication/05e919e2?page=60">/ PRODUCT REVIEWto still run XACT from the i</a> / PRODUCT REVIEWto still run XACT from the i<a title="DF4_Online.pdf page 61" href="http://viewer.zmags.com/publication/05e919e2?page=61">Physical Analyser Interface/ SummaryBoth solut</a> Physical Analyser Interface/ SummaryBoth solut<a title="DF4_Online.pdf page 62" href="http://viewer.zmags.com/publication/05e919e2?page=62">MD5 are recognised as one of the leading digital</a> MD5 are recognised as one of the leading digital<a title="DF4_Online.pdf page 63" href="http://viewer.zmags.com/publication/05e919e2?page=63">/ FEATUREDATA:CAPTURE IT LIVE! Why we shoul</a> / FEATUREDATA:CAPTURE IT LIVE! Why we shoul<a title="DF4_Online.pdf page 64" href="http://viewer.zmags.com/publication/05e919e2?page=64">/ FEATURElive data. For the purposes of this</a> / FEATURElive data. For the purposes of this<a title="DF4_Online.pdf page 65" href="http://viewer.zmags.com/publication/05e919e2?page=65">/ Surely collecting live data might taint the</a> / Surely collecting live data might taint the<a title="DF4_Online.pdf page 66" href="http://viewer.zmags.com/publication/05e919e2?page=66">/ FEATURE/ FOR MORE INFORMATIONTrojan defence</a> / FEATURE/ FOR MORE INFORMATIONTrojan defence<a title="DF4_Online.pdf page 67" href="http://viewer.zmags.com/publication/05e919e2?page=67">indication of the type of evidence discovered. Th</a> indication of the type of evidence discovered. Th<a title="DF4_Online.pdf page 68" href="http://viewer.zmags.com/publication/05e919e2?page=68">FORENSICS TRAININGhttp://computer-forensics.san</a> FORENSICS TRAININGhttp://computer-forensics.san<a title="DF4_Online.pdf page 69" href="http://viewer.zmags.com/publication/05e919e2?page=69">/ FEATUREREAL TIMESTEGANALYSISA Use Case fo</a> / FEATUREREAL TIMESTEGANALYSISA Use Case fo<a title="DF4_Online.pdf page 70" href="http://viewer.zmags.com/publication/05e919e2?page=70">/ FEATUREcase of DLP systems, keeping that w</a> / FEATUREcase of DLP systems, keeping that w<a title="DF4_Online.pdf page 71" href="http://viewer.zmags.com/publication/05e919e2?page=71">diligently maintained and used, or user workstati</a> diligently maintained and used, or user workstati<a title="DF4_Online.pdf page 72" href="http://viewer.zmags.com/publication/05e919e2?page=72">/ FEATURE/ Digital SteganographyTools for hid</a> / FEATURE/ Digital SteganographyTools for hid<a title="DF4_Online.pdf page 73" href="http://viewer.zmags.com/publication/05e919e2?page=73">Example of embedding a text characterapplicatio</a> Example of embedding a text characterapplicatio<a title="DF4_Online.pdf page 74" href="http://viewer.zmags.com/publication/05e919e2?page=74">BLADEF O R E N S I C D AT A R E C O V E R Y</a> BLADEF O R E N S I C D AT A R E C O V E R Y<a title="DF4_Online.pdf page 75" href="http://viewer.zmags.com/publication/05e919e2?page=75">/ FEATUREBECOMING A DFPROFESSIONAL So, You </a> / FEATUREBECOMING A DFPROFESSIONAL So, You <a title="DF4_Online.pdf page 76" href="http://viewer.zmags.com/publication/05e919e2?page=76">/ FEATUREthey have this desire in their out-</a> / FEATUREthey have this desire in their out-<a title="DF4_Online.pdf page 77" href="http://viewer.zmags.com/publication/05e919e2?page=77">/ Where Would Someone With Forensic Skills Fi</a> / Where Would Someone With Forensic Skills Fi<a title="DF4_Online.pdf page 78" href="http://viewer.zmags.com/publication/05e919e2?page=78">/ BOOK REVIEWSBOOK REVIEWSUNIX and Linux For</a> / BOOK REVIEWSBOOK REVIEWSUNIX and Linux For<a title="DF4_Online.pdf page 79" href="http://viewer.zmags.com/publication/05e919e2?page=79">Mac OS X, iPod, andiPhone Forensic AnalysisDVD </a> Mac OS X, iPod, andiPhone Forensic AnalysisDVD <a title="DF4_Online.pdf page 80" href="http://viewer.zmags.com/publication/05e919e2?page=80"></a> <a title="DF4_Online.pdf page 81" href="http://viewer.zmags.com/publication/05e919e2?page=81">CALLING ALLRESEARCHERS &PRACTITIONERSIf you ar</a> CALLING ALLRESEARCHERS &PRACTITIONERSIf you ar<a title="DF4_Online.pdf page 82" href="http://viewer.zmags.com/publication/05e919e2?page=82">/ COLUMNIRQAngus Marshall interrupts yourtrain</a> / COLUMNIRQAngus Marshall interrupts yourtrain<a title="DF4_Online.pdf page 83" href="http://viewer.zmags.com/publication/05e919e2?page=83">LONDON • September 8–9, 201010% discount for DFM</a> LONDON • September 8–9, 201010% discount for DFM<a title="DF4_Online.pdf page 84" href="http://viewer.zmags.com/publication/05e919e2?page=84">Order Today!MayApril20102010Digita</a> Order Today!MayApril20102010Digita