<br /> Digital<br /> The Quarterly Magazine for Digital Forensics Practitioners Issue 21 · November 2014<br /> WIN! an iPod Nano<br /> ForensicS<br /> / magazine<br /> IMPROVING<br /> Image Recovery Rates<br /> inBIG<br /> DATA<br /> Brian Cusack & Dan Fraser<br /> introduce their new tool HBIR<br /> Hash Based Image Retrieval<br /> Latest News, 360<br /> Book Reviews, IRQ<br /> & much more inside!<br /> PLUS!<br /> STARTTLS<br /> SQLite Databases<br /> Cryptographic Keys<br /> Cisco Router Forensics<br /> 21<br /> 9 772042 061004<br /> Issue 21 / £14.99 TR Media<br /> <br /> EDITORIAL<br /> M<br /> any of you who are involved in digital forensic<br /> investigations will be working on mobile phones,<br /> tab<a title="DFM21 - Online page 1" href="http://viewer.zmags.com/publication/30df3923?page=1"> Digital The Quarterly Magazine for Digital Fore</a> <a title="DFM21 - Online page 2" href="http://viewer.zmags.com/publication/30df3923?page=2"> </a> <a title="DFM21 - Online page 3" href="http://viewer.zmags.com/publication/30df3923?page=3"> EDITORIAL M </a> <a title="DFM21 - Online page 4" href="http://viewer.zmags.com/publication/30df3923?page=4"> </a> <a title="DFM21 - Online page 5" href="http://viewer.zmags.com/publication/30df3923?page=5"> 69 FEATURES 08 / SQLite Databases – Part I In th</a> <a title="DFM21 - Online page 6" href="http://viewer.zmags.com/publication/30df3923?page=6"> / NEWS NEWS NEWS / UK NCA on the lookout for c</a> <a title="DFM21 - Online page 7" href="http://viewer.zmags.com/publication/30df3923?page=7"> pay attention to it can certainly stop it in its </a> <a title="DFM21 - Online page 8" href="http://viewer.zmags.com/publication/30df3923?page=8"> / FEATURE SQLITE DATABASES: TREASURE TROVE FOR</a> <a title="DFM21 - Online page 9" href="http://viewer.zmags.com/publication/30df3923?page=9"> the smart phones such as iPhone, Android, Symbian</a> <a title="DFM21 - Online page 10" href="http://viewer.zmags.com/publication/30df3923?page=10"> / FEATURE Figure 3. Conv</a> <a title="DFM21 - Online page 11" href="http://viewer.zmags.com/publication/30df3923?page=11"> C:\Users\Owner\AppDate\ Roaming\Skype\Username\ C</a> <a title="DFM21 - Online page 12" href="http://viewer.zmags.com/publication/30df3923?page=12"> / FEATURE Figure 8 Sky</a> <a title="DFM21 - Online page 13" href="http://viewer.zmags.com/publication/30df3923?page=13"> </a> <a title="DFM21 - Online page 14" href="http://viewer.zmags.com/publication/30df3923?page=14"> / LEAD FEATURE IMPROVING IMAGE RECOVERY RATES </a> <a title="DFM21 - Online page 15" href="http://viewer.zmags.com/publication/30df3923?page=15"> Exaclibur, Photobook, Jacob and Digital Library P</a> <a title="DFM21 - Online page 16" href="http://viewer.zmags.com/publication/30df3923?page=16"> / LEAD FEATURE 50Kb Batch 950kB Batch CB</a> <a title="DFM21 - Online page 17" href="http://viewer.zmags.com/publication/30df3923?page=17"> the HBIR Tool by comparing it to the CBIR and CBI</a> <a title="DFM21 - Online page 18" href="http://viewer.zmags.com/publication/30df3923?page=18"> / LEAD FEATURE / Hash in Networking The hashing</a> <a title="DFM21 - Online page 19" href="http://viewer.zmags.com/publication/30df3923?page=19"> / LEGAL EDITORIAL LEGAL EDITORIAL Marriott fined U</a> <a title="DFM21 - Online page 20" href="http://viewer.zmags.com/publication/30df3923?page=20"> / LEGAL FEATURE INTRODUCTION TO EDRM An Introd</a> <a title="DFM21 - Online page 21" href="http://viewer.zmags.com/publication/30df3923?page=21"> Please take a look at the diagram at Figure 1</a> <a title="DFM21 - Online page 22" href="http://viewer.zmags.com/publication/30df3923?page=22"> / LEGAL FEATURE DFM readers may already b</a> <a title="DFM21 - Online page 23" href="http://viewer.zmags.com/publication/30df3923?page=23"> delivered (outgoing) documents, and they also dif</a> <a title="DFM21 - Online page 24" href="http://viewer.zmags.com/publication/30df3923?page=24"> / LEGAL EDITORIAL LEGAL NEWS A round-up of the la</a> <a title="DFM21 - Online page 25" href="http://viewer.zmags.com/publication/30df3923?page=25"> </a> <a title="DFM21 - Online page 26" href="http://viewer.zmags.com/publication/30df3923?page=26"> / FROM THE LAB CISCO ROUTER FORENSICS Because </a> <a title="DFM21 - Online page 27" href="http://viewer.zmags.com/publication/30df3923?page=27"> / Router Management Best Practices Routers are co</a> <a title="DFM21 - Online page 28" href="http://viewer.zmags.com/publication/30df3923?page=28"> / FROM THE LAB </a> <a title="DFM21 - Online page 29" href="http://viewer.zmags.com/publication/30df3923?page=29"> 20141007-141422: Number of identified frames: 135 </a> <a title="DFM21 - Online page 30" href="http://viewer.zmags.com/publication/30df3923?page=30"> / FROM THE LAB Technical Support: http:// www.</a> <a title="DFM21 - Online page 31" href="http://viewer.zmags.com/publication/30df3923?page=31"> </a> <a title="DFM21 - Online page 32" href="http://viewer.zmags.com/publication/30df3923?page=32"> / FEATURE RECOVERING CRYPTOGRAPHIC KEYS FROM M</a> <a title="DFM21 - Online page 33" href="http://viewer.zmags.com/publication/30df3923?page=33"> Moreover, the Regulation of Investigatory po</a> <a title="DFM21 - Online page 34" href="http://viewer.zmags.com/publication/30df3923?page=34"> / FEATURE Figure 1. “truecr</a> <a title="DFM21 - Online page 35" href="http://viewer.zmags.com/publication/30df3923?page=35"> · truecryptsummary – to produce the detail o</a> <a title="DFM21 - Online page 36" href="http://viewer.zmags.com/publication/30df3923?page=36"> / FEATURE What is required then is to recogni</a> <a title="DFM21 - Online page 37" href="http://viewer.zmags.com/publication/30df3923?page=37"> </a> <a title="DFM21 - Online page 38" href="http://viewer.zmags.com/publication/30df3923?page=38"> / FEATURE INFORMATION SECURITY AND DIGITAL FOR</a> <a title="DFM21 - Online page 39" href="http://viewer.zmags.com/publication/30df3923?page=39"> The personal information will be used togethe</a> <a title="DFM21 - Online page 40" href="http://viewer.zmags.com/publication/30df3923?page=40"> / FEATURE / The Forensics of `Big Data' Cyber P</a> <a title="DFM21 - Online page 41" href="http://viewer.zmags.com/publication/30df3923?page=41"> need to give added protection to that you can dev</a> <a title="DFM21 - Online page 42" href="http://viewer.zmags.com/publication/30df3923?page=42"> / ADVERTORIAL CYBER SECURITY, ACADEMIA AND INDUST</a> <a title="DFM21 - Online page 43" href="http://viewer.zmags.com/publication/30df3923?page=43"> 43</a> <a title="DFM21 - Online page 44" href="http://viewer.zmags.com/publication/30df3923?page=44"> / FEATURE EXPLORING NETWORK ELEMENT VULNERABIL</a> <a title="DFM21 - Online page 45" href="http://viewer.zmags.com/publication/30df3923?page=45"> mechanism, the potential for attacks and the perf</a> <a title="DFM21 - Online page 46" href="http://viewer.zmags.com/publication/30df3923?page=46"> / FEATURE Figure 2. Pack</a> <a title="DFM21 - Online page 47" href="http://viewer.zmags.com/publication/30df3923?page=47"> The 6to4 mechanism involved in this research</a> <a title="DFM21 - Online page 48" href="http://viewer.zmags.com/publication/30df3923?page=48"> / FEATURE Figure 5. TCP </a> <a title="DFM21 - Online page 49" href="http://viewer.zmags.com/publication/30df3923?page=49"> </a> <a title="DFM21 - Online page 50" href="http://viewer.zmags.com/publication/30df3923?page=50"> </a> <a title="DFM21 - Online page 51" href="http://viewer.zmags.com/publication/30df3923?page=51"> / GET INVOLVED GET INVOLVED Calling all Book Revi</a> <a title="DFM21 - Online page 52" href="http://viewer.zmags.com/publication/30df3923?page=52"> </a> <a title="DFM21 - Online page 53" href="http://viewer.zmags.com/publication/30df3923?page=53"> ts m What s Secur ty Analyt cs?n </a> <a title="DFM21 - Online page 54" href="http://viewer.zmags.com/publication/30df3923?page=54"> / FEATURE THE DAWN OF A NEW ERA IN E-MAIL SECU</a> <a title="DFM21 - Online page 55" href="http://viewer.zmags.com/publication/30df3923?page=55"> oriented social networking sites and how this rel</a> <a title="DFM21 - Online page 56" href="http://viewer.zmags.com/publication/30df3923?page=56"> / FEATURE YOU WOULD B</a> <a title="DFM21 - Online page 57" href="http://viewer.zmags.com/publication/30df3923?page=57"> media giants be seen as almost farcical, given wh</a> <a title="DFM21 - Online page 58" href="http://viewer.zmags.com/publication/30df3923?page=58"> </a> <a title="DFM21 - Online page 59" href="http://viewer.zmags.com/publication/30df3923?page=59"> 36 Letters, emails, tweets, connections and more…</a> <a title="DFM21 - Online page 60" href="http://viewer.zmags.com/publication/30df3923?page=60"> / COMPETITION COMPETITION / This issue we have</a> <a title="DFM21 - Online page 61" href="http://viewer.zmags.com/publication/30df3923?page=61"> </a> <a title="DFM21 - Online page 62" href="http://viewer.zmags.com/publication/30df3923?page=62"> / FEATURE ADVANCED PERSISTENT THREAT What are </a> <a title="DFM21 - Online page 63" href="http://viewer.zmags.com/publication/30df3923?page=63"> controls against APT. This study examines APT and</a> <a title="DFM21 - Online page 64" href="http://viewer.zmags.com/publication/30df3923?page=64"> / FEATURE / Reactive Approaches for Addressi</a> <a title="DFM21 - Online page 65" href="http://viewer.zmags.com/publication/30df3923?page=65"> Unlike the proactive security controls discus</a> <a title="DFM21 - Online page 66" href="http://viewer.zmags.com/publication/30df3923?page=66"> Digital ForensicS / magazine Digital The Qua</a> <a title="DFM21 - Online page 67" href="http://viewer.zmags.com/publication/30df3923?page=67"> </a> <a title="DFM21 - Online page 68" href="http://viewer.zmags.com/publication/30df3923?page=68"> </a> <a title="DFM21 - Online page 69" href="http://viewer.zmags.com/publication/30df3923?page=69"> / FEATURE THINGS IN THE SADDLE NARRATIVES FOR </a> <a title="DFM21 - Online page 70" href="http://viewer.zmags.com/publication/30df3923?page=70"> / FEATURE HOMO SAPIENS ARE VERY BAD AT EST</a> <a title="DFM21 - Online page 71" href="http://viewer.zmags.com/publication/30df3923?page=71"> There is a need for political engagement wi</a> <a title="DFM21 - Online page 72" href="http://viewer.zmags.com/publication/30df3923?page=72"> / FEATURE from Ralph Waldo Emerson, and it se</a> <a title="DFM21 - Online page 73" href="http://viewer.zmags.com/publication/30df3923?page=73"> / COMING SOON COMING SOON… A round-up of featu</a> <a title="DFM21 - Online page 74" href="http://viewer.zmags.com/publication/30df3923?page=74"> / book reviews BOOK REVIEWS SOCIAL MEDIA SECURITY</a> <a title="DFM21 - Online page 75" href="http://viewer.zmags.com/publication/30df3923?page=75"> THE BOOK COVERS THE FIRST STEPS WHEN INVEST</a> <a title="DFM21 - Online page 76" href="http://viewer.zmags.com/publication/30df3923?page=76"> / book reviews W hen it comes </a> <a title="DFM21 - Online page 77" href="http://viewer.zmags.com/publication/30df3923?page=77"> </a> <a title="DFM21 - Online page 78" href="http://viewer.zmags.com/publication/30df3923?page=78"> / book reviews I started my computing</a> <a title="DFM21 - Online page 79" href="http://viewer.zmags.com/publication/30df3923?page=79"> A nice thick guide to forensics i</a> <a title="DFM21 - Online page 80" href="http://viewer.zmags.com/publication/30df3923?page=80"> / book reviews T his book gives an</a> <a title="DFM21 - Online page 81" href="http://viewer.zmags.com/publication/30df3923?page=81"> </a> <a title="DFM21 - Online page 82" href="http://viewer.zmags.com/publication/30df3923?page=82"> / IRQ IRQ The Quest for The Best? T </a> <a title="DFM21 - Online page 83" href="http://viewer.zmags.com/publication/30df3923?page=83"> </a> <a title="DFM21 - Online page 84" href="http://viewer.zmags.com/publication/30df3923?page=84"> </a>