<br /> Digital<br /> The Quarterly Magazine for Digital Forensics Practitioners<br /> EXCLUSIVE!<br /> ForensicS<br /> Win a free pass to the<br /> Forensics<br /> Summit<br /> ISSUE 04<br /> / magazine 1 AUGUST 2010<br /> INSIDE<br /> / You've Been Framed!<br /> / Digital Forensics in<br /> Law Enforcement<br /> / Pyschosocial<br /> Forensics<br /> PRESERVATION<br /> OF EVIDENCE<br /> Explaining how an organization should plan and 03<br /> prepare for a computer crime investigation<br /> 9 772042 061103<br /> Issue 4 / £11.99 TR Media<br /> / REGULARS / FROM THE LAB / Book Reviews / WRITERS<br /> <a title="DF4_Online.pdf page 1" href="http://viewer.zmags.com/publication/05e919e2?page=1"> Digital The Quarterly Magazine for Digital Fore</a> <a title="DF4_Online.pdf page 2" href="http://viewer.zmags.com/publication/05e919e2?page=2"> Shape your future Forensic Computing MSc Fo</a> <a title="DF4_Online.pdf page 3" href="http://viewer.zmags.com/publication/05e919e2?page=3"> EDITORIAL T </a> <a title="DF4_Online.pdf page 4" href="http://viewer.zmags.com/publication/05e919e2?page=4"> Reviewing the latest sports highlights </a> <a title="DF4_Online.pdf page 5" href="http://viewer.zmags.com/publication/05e919e2?page=5"> / CONTENTS CONTENTS / DIGITAL FORENSICS MAGAZ</a> <a title="DF4_Online.pdf page 6" href="http://viewer.zmags.com/publication/05e919e2?page=6"> / NEWS NEWS NATO’s Plans To Defend Against Cyb</a> <a title="DF4_Online.pdf page 7" href="http://viewer.zmags.com/publication/05e919e2?page=7"> with just under 50% also listing themselves as ‘D</a> <a title="DF4_Online.pdf page 8" href="http://viewer.zmags.com/publication/05e919e2?page=8"> Mobile Development from Apress The la</a> <a title="DF4_Online.pdf page 9" href="http://viewer.zmags.com/publication/05e919e2?page=9"> 360° TYour chance to have your say … </a> <a title="DF4_Online.pdf page 10" href="http://viewer.zmags.com/publication/05e919e2?page=10"> / LETTERS 3) What is Zmag.com? Why is it when</a> <a title="DF4_Online.pdf page 11" href="http://viewer.zmags.com/publication/05e919e2?page=11"> Forensic Computing 12-month st</a> <a title="DF4_Online.pdf page 12" href="http://viewer.zmags.com/publication/05e919e2?page=12"> / LEAD FEATURE PROACTIVE COMPUTER FORENSICS TH</a> <a title="DF4_Online.pdf page 13" href="http://viewer.zmags.com/publication/05e919e2?page=13"> circumstances of preparation indicate lack of tru</a> <a title="DF4_Online.pdf page 14" href="http://viewer.zmags.com/publication/05e919e2?page=14"> / LEAD FEATURE For example, the use of c</a> <a title="DF4_Online.pdf page 15" href="http://viewer.zmags.com/publication/05e919e2?page=15"> We will examine section 9 as it relates to h</a> <a title="DF4_Online.pdf page 16" href="http://viewer.zmags.com/publication/05e919e2?page=16"> / LEAD FEATURE This is very similar to A</a> <a title="DF4_Online.pdf page 17" href="http://viewer.zmags.com/publication/05e919e2?page=17"> Cell site analysis Computer forensics Audio v</a> <a title="DF4_Online.pdf page 18" href="http://viewer.zmags.com/publication/05e919e2?page=18"> / FEATURE WHO’S BEEN FRAMED? How effective are</a> <a title="DF4_Online.pdf page 19" href="http://viewer.zmags.com/publication/05e919e2?page=19"> attack itself and not the actions that follow. It</a> <a title="DF4_Online.pdf page 20" href="http://viewer.zmags.com/publication/05e919e2?page=20"> / FEATURE penetrate the wireless network of a</a> <a title="DF4_Online.pdf page 21" href="http://viewer.zmags.com/publication/05e919e2?page=21"> wireless attack conducted by the malicious user b</a> <a title="DF4_Online.pdf page 22" href="http://viewer.zmags.com/publication/05e919e2?page=22"> / FEATURE have also taken steps to truly make</a> <a title="DF4_Online.pdf page 23" href="http://viewer.zmags.com/publication/05e919e2?page=23"> / NEXT ISSUE COMING SOON… Some of the great</a> <a title="DF4_Online.pdf page 24" href="http://viewer.zmags.com/publication/05e919e2?page=24"> / FEATURE PSYCHOSOCIAL FORENSICS Exploring a</a> <a title="DF4_Online.pdf page 25" href="http://viewer.zmags.com/publication/05e919e2?page=25"> / Crime Scene Investigation Process Figure 1 show</a> <a title="DF4_Online.pdf page 26" href="http://viewer.zmags.com/publication/05e919e2?page=26"> / FEATURE Psychosocial crime scene investigat</a> <a title="DF4_Online.pdf page 27" href="http://viewer.zmags.com/publication/05e919e2?page=27"> / MERIT The MERIT (Management and Education of th</a> <a title="DF4_Online.pdf page 28" href="http://viewer.zmags.com/publication/05e919e2?page=28"> </a> <a title="DF4_Online.pdf page 29" href="http://viewer.zmags.com/publication/05e919e2?page=29"> COMPETITION / Win a free ticket to the SANS Digit</a> <a title="DF4_Online.pdf page 30" href="http://viewer.zmags.com/publication/05e919e2?page=30">/ FEATURE THE STATE OF DIGITAL FORENSICS I</a> <a title="DF4_Online.pdf page 31" href="http://viewer.zmags.com/publication/05e919e2?page=31"> police officers and civilian staff, although a few</a> <a title="DF4_Online.pdf page 32" href="http://viewer.zmags.com/publication/05e919e2?page=32"> / FEATURE / Asia-South Pacific In both Australi</a> <a title="DF4_Online.pdf page 33" href="http://viewer.zmags.com/publication/05e919e2?page=33"> law enforcement’s ability to deal with the eviden</a> <a title="DF4_Online.pdf page 34" href="http://viewer.zmags.com/publication/05e919e2?page=34"> / FEATURE to certification in the use of thei</a> <a title="DF4_Online.pdf page 35" href="http://viewer.zmags.com/publication/05e919e2?page=35"> Pharos Flyer With Bleed.pdf 1 11/06/2010 23:44:43</a> <a title="DF4_Online.pdf page 36" href="http://viewer.zmags.com/publication/05e919e2?page=36"> Pharos Flyer With Bleed.pdf 2 11/06/2010 23:44:44</a> <a title="DF4_Online.pdf page 37" href="http://viewer.zmags.com/publication/05e919e2?page=37"> / LEGAL EDITORIAL LEGAL EDITORIAL Welcome aga</a> <a title="DF4_Online.pdf page 38" href="http://viewer.zmags.com/publication/05e919e2?page=38"> / LEGAL FEATURE THE EXPERT WITNESS FROM COMPUT</a> <a title="DF4_Online.pdf page 39" href="http://viewer.zmags.com/publication/05e919e2?page=39"> a single specialist, a ‘Single Joint Expert’ (SJE</a> <a title="DF4_Online.pdf page 40" href="http://viewer.zmags.com/publication/05e919e2?page=40"> / LEGAL FEATURE the governing body for that i</a> <a title="DF4_Online.pdf page 41" href="http://viewer.zmags.com/publication/05e919e2?page=41"> Maximise Prioritise Visualise Call IntaForen</a> <a title="DF4_Online.pdf page 42" href="http://viewer.zmags.com/publication/05e919e2?page=42"> / LEGAL NEWS ALERT LEGAL NEWS ALERT Open S</a> <a title="DF4_Online.pdf page 43" href="http://viewer.zmags.com/publication/05e919e2?page=43"> Opening the Gates to Effective Computer Forensi</a> <a title="DF4_Online.pdf page 44" href="http://viewer.zmags.com/publication/05e919e2?page=44"> / PRODUCT REVIEW PRODUCT REVIEW Product Purpos</a> <a title="DF4_Online.pdf page 45" href="http://viewer.zmags.com/publication/05e919e2?page=45"> / Acquiring Digital Image Types and Preservin</a> <a title="DF4_Online.pdf page 46" href="http://viewer.zmags.com/publication/05e919e2?page=46"> / PRODUCT REVIEW The main Imager window </a> <a title="DF4_Online.pdf page 47" href="http://viewer.zmags.com/publication/05e919e2?page=47"> Figure 3 TSK was tested using the non-inte</a> <a title="DF4_Online.pdf page 48" href="http://viewer.zmags.com/publication/05e919e2?page=48"> / PRODUCT REVIEW tests headers for type and m</a> <a title="DF4_Online.pdf page 49" href="http://viewer.zmags.com/publication/05e919e2?page=49"> Digital ForensicS / magazine Digital Forensics m</a> <a title="DF4_Online.pdf page 50" href="http://viewer.zmags.com/publication/05e919e2?page=50"> / FEATURE IPHORENSICS – NO PAIN, NO GAIN! Th</a> <a title="DF4_Online.pdf page 51" href="http://viewer.zmags.com/publication/05e919e2?page=51"> a kill command to zero the storage either interna</a> <a title="DF4_Online.pdf page 52" href="http://viewer.zmags.com/publication/05e919e2?page=52"> / FEATURE one layer, collaborative evidence m</a> <a title="DF4_Online.pdf page 53" href="http://viewer.zmags.com/publication/05e919e2?page=53"> IPhone 3 Soldered on Chips / Faraday Bag The iPho</a> <a title="DF4_Online.pdf page 54" href="http://viewer.zmags.com/publication/05e919e2?page=54"> / FEATURE practices, to assure the “forensica</a> <a title="DF4_Online.pdf page 55" href="http://viewer.zmags.com/publication/05e919e2?page=55"> Digital ForensicS / magazine PLACE YOU</a> <a title="DF4_Online.pdf page 56" href="http://viewer.zmags.com/publication/05e919e2?page=56"> / MEET THE PROFESSIONALS MEET THE DF PROFESSIO</a> <a title="DF4_Online.pdf page 57" href="http://viewer.zmags.com/publication/05e919e2?page=57"> What are your views on the industry standard tool</a> <a title="DF4_Online.pdf page 58" href="http://viewer.zmags.com/publication/05e919e2?page=58"> / PRODUCT REVIEW PRODUCT REVIEW Product Purpos</a> <a title="DF4_Online.pdf page 59" href="http://viewer.zmags.com/publication/05e919e2?page=59"> are concentrating most of their effort into the p</a> <a title="DF4_Online.pdf page 60" href="http://viewer.zmags.com/publication/05e919e2?page=60"> / PRODUCT REVIEW to still run XACT from the i</a> <a title="DF4_Online.pdf page 61" href="http://viewer.zmags.com/publication/05e919e2?page=61"> Physical Analyser Interface / Summary Both solut</a> <a title="DF4_Online.pdf page 62" href="http://viewer.zmags.com/publication/05e919e2?page=62"> MD5 are recognised as one of the leading digital </a> <a title="DF4_Online.pdf page 63" href="http://viewer.zmags.com/publication/05e919e2?page=63"> / FEATURE DATA: CAPTURE IT LIVE! Why we shoul</a> <a title="DF4_Online.pdf page 64" href="http://viewer.zmags.com/publication/05e919e2?page=64"> / FEATURE live data. For the purposes of this</a> <a title="DF4_Online.pdf page 65" href="http://viewer.zmags.com/publication/05e919e2?page=65"> / Surely collecting live data might taint the</a> <a title="DF4_Online.pdf page 66" href="http://viewer.zmags.com/publication/05e919e2?page=66"> / FEATURE / FOR MORE INFORMATION Trojan defence</a> <a title="DF4_Online.pdf page 67" href="http://viewer.zmags.com/publication/05e919e2?page=67"> indication of the type of evidence discovered. Th</a> <a title="DF4_Online.pdf page 68" href="http://viewer.zmags.com/publication/05e919e2?page=68"> FORENSICS TRAINING http://computer-forensics.san</a> <a title="DF4_Online.pdf page 69" href="http://viewer.zmags.com/publication/05e919e2?page=69"> / FEATURE REAL TIME STEGANALYSIS A Use Case fo</a> <a title="DF4_Online.pdf page 70" href="http://viewer.zmags.com/publication/05e919e2?page=70"> / FEATURE case of DLP systems, keeping that w</a> <a title="DF4_Online.pdf page 71" href="http://viewer.zmags.com/publication/05e919e2?page=71"> diligently maintained and used, or user workstati</a> <a title="DF4_Online.pdf page 72" href="http://viewer.zmags.com/publication/05e919e2?page=72"> / FEATURE / Digital Steganography Tools for hid</a> <a title="DF4_Online.pdf page 73" href="http://viewer.zmags.com/publication/05e919e2?page=73"> Example of embedding a text character applicatio</a> <a title="DF4_Online.pdf page 74" href="http://viewer.zmags.com/publication/05e919e2?page=74"> BLADE F O R E N S I C D AT A R E C O V E R Y </a> <a title="DF4_Online.pdf page 75" href="http://viewer.zmags.com/publication/05e919e2?page=75"> / FEATURE BECOMING A DF PROFESSIONAL So, You </a> <a title="DF4_Online.pdf page 76" href="http://viewer.zmags.com/publication/05e919e2?page=76"> / FEATURE they have this desire in their out-</a> <a title="DF4_Online.pdf page 77" href="http://viewer.zmags.com/publication/05e919e2?page=77"> / Where Would Someone With Forensic Skills Fi</a> <a title="DF4_Online.pdf page 78" href="http://viewer.zmags.com/publication/05e919e2?page=78"> / BOOK REVIEWS BOOK REVIEWS UNIX and Linux For</a> <a title="DF4_Online.pdf page 79" href="http://viewer.zmags.com/publication/05e919e2?page=79"> Mac OS X, iPod, and iPhone Forensic Analysis DVD </a> <a title="DF4_Online.pdf page 80" href="http://viewer.zmags.com/publication/05e919e2?page=80"> </a> <a title="DF4_Online.pdf page 81" href="http://viewer.zmags.com/publication/05e919e2?page=81"> CALLING ALL RESEARCHERS & PRACTITIONERS If you ar</a> <a title="DF4_Online.pdf page 82" href="http://viewer.zmags.com/publication/05e919e2?page=82"> / COLUMN IRQ Angus Marshall interrupts your train</a> <a title="DF4_Online.pdf page 83" href="http://viewer.zmags.com/publication/05e919e2?page=83"> LONDON • September 8–9, 2010 10% discount for DFM</a> <a title="DF4_Online.pdf page 84" href="http://viewer.zmags.com/publication/05e919e2?page=84"> Order Today! May April 2010 2010 Digita</a>