The Quarterly Magazine for Digital Forensics Practitioners<br /> ISSN 9 772042 061110<br /> Competition!<br /> Win one of 3 copies of WinHex Professional<br /> ISSUE 08<br /> AUGUST 2011<br /> INSIDE<br /> / e-Discovery Tools<br /> / Image Processing<br /> / Hacking the Cloud<br /> / Digital Forensics in Sri Lanka<br /> LATENT SEMANTIC INDEXING<br /> Dr Michael R Taylor explains why conceptual search is vital in the analysis of large multi lingual data sets<br /> / REGULARS / FROM THE LAB / INTRODUCING <br /> / Book Reviews<br /> Robservations, 360, Ted Smith looks at our new FEATURE ON Digital Forensics<br /> news, irq & more… <br /> X-Ways Forensics <br /> Biometrics & Forensics with Open Source Tools<br /> Shape your future<br /> Forensic Computing MSc Forensic Computing BSc Honours<br /> Computer Security MSc Computer Security BSc Honours<br /> To find out more visit dmu.ac.uk/technology or contact us:<br /> T: (0116)<a title="Digital Forensics Magazine Issue 8, August2011 page 1" href="http://viewer.zmags.com/publication/a90db379?page=1">The Quarterly Magazine for Digital Forensics Pract</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 2" href="http://viewer.zmags.com/publication/a90db379?page=2"> Shape your future Forensic Computing MSc Fo</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 3" href="http://viewer.zmags.com/publication/a90db379?page=3">EDITORIAL When we decided to have an issue of D</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 4" href="http://viewer.zmags.com/publication/a90db379?page=4"></a> <a title="Digital Forensics Magazine Issue 8, August2011 page 5" href="http://viewer.zmags.com/publication/a90db379?page=5">CONTENTS / DIGITAL FORENSICS MAGAZINE </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 6" href="http://viewer.zmags.com/publication/a90db379?page=6"> / NEWS NEWS Digital Investigations accelerated</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 7" href="http://viewer.zmags.com/publication/a90db379?page=7"> Three computer forensic experts, Det. Sandra </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 8" href="http://viewer.zmags.com/publication/a90db379?page=8"> Mobile Development from Apress The lar</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 9" href="http://viewer.zmags.com/publication/a90db379?page=9"> / FEATURE E-DISCOVERY TOOLS IN A FORENSIC INV</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 10" href="http://viewer.zmags.com/publication/a90db379?page=10"> / FEATURE </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 11" href="http://viewer.zmags.com/publication/a90db379?page=11"> We generated bit-stream copies (images) of m</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 12" href="http://viewer.zmags.com/publication/a90db379?page=12"> / FEATURE documents about political parties. </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 13" href="http://viewer.zmags.com/publication/a90db379?page=13"> </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 14" href="http://viewer.zmags.com/publication/a90db379?page=14"> / LETTERS 360° TYour chance to have your say … </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 15" href="http://viewer.zmags.com/publication/a90db379?page=15"> are having issues logging in or problems viewing </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 16" href="http://viewer.zmags.com/publication/a90db379?page=16"> Cell site analysis Computer forensics Audio vi</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 17" href="http://viewer.zmags.com/publication/a90db379?page=17"> / LEAD FEATURE WHAT LIES BENEATH? In an incr</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 18" href="http://viewer.zmags.com/publication/a90db379?page=18"> / LEAD FEATURE / Do You Google? The majority of</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 19" href="http://viewer.zmags.com/publication/a90db379?page=19"> / Explosion of electronically searchable inform</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 20" href="http://viewer.zmags.com/publication/a90db379?page=20"> / LEAD FEATURE searching using LSI has been a</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 21" href="http://viewer.zmags.com/publication/a90db379?page=21"> Fast-forward even 5 or 10 years later, and th</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 22" href="http://viewer.zmags.com/publication/a90db379?page=22"> / LEAD FEATURE / Email the primary source for e</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 23" href="http://viewer.zmags.com/publication/a90db379?page=23"> once-academic technology a very real and practica</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 24" href="http://viewer.zmags.com/publication/a90db379?page=24"> / FEATURE HACKING THE CLOUD – SOCIAL ENGINEERI</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 25" href="http://viewer.zmags.com/publication/a90db379?page=25"> Although we believe we have made a conscious deci</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 26" href="http://viewer.zmags.com/publication/a90db379?page=26"> / FEATURE · Attack – for us, in a test sc</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 27" href="http://viewer.zmags.com/publication/a90db379?page=27"> / Evidence Challenges Your first objective is ofte</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 28" href="http://viewer.zmags.com/publication/a90db379?page=28"> </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 29" href="http://viewer.zmags.com/publication/a90db379?page=29"> / ROBSERVATIONS ROBSERVATIONS Accur – Casey Tb</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 30" href="http://viewer.zmags.com/publication/a90db379?page=30"> Reviewing the latest sports highlights </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 31" href="http://viewer.zmags.com/publication/a90db379?page=31"> / LEGAL EDITORIAL LEGAL EDITORIAL Welcome back</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 32" href="http://viewer.zmags.com/publication/a90db379?page=32"> / LEGAL FEATURE EXPLORING THE E-DISCOVERY PROC</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 33" href="http://viewer.zmags.com/publication/a90db379?page=33"> (i) [outside the scope of this discussion] (ii) a</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 34" href="http://viewer.zmags.com/publication/a90db379?page=34"> / LEGAL FEATURE MODERN COMPUTER FORENSIC INVEST</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 35" href="http://viewer.zmags.com/publication/a90db379?page=35"> After the examinations have been completed, t</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 36" href="http://viewer.zmags.com/publication/a90db379?page=36"> / LEGAL NEWS ALERT LEGAL NEWS ALERT Spring of </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 37" href="http://viewer.zmags.com/publication/a90db379?page=37"> / COMPETITION COMPETITION / this issue, we hav</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 38" href="http://viewer.zmags.com/publication/a90db379?page=38"> </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 39" href="http://viewer.zmags.com/publication/a90db379?page=39"> </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 40" href="http://viewer.zmags.com/publication/a90db379?page=40"> / MEET THE PROFESSIONALS MEET THE DF PROFESSIO</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 41" href="http://viewer.zmags.com/publication/a90db379?page=41"> of us this is like speaking a foreign language. T</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 42" href="http://viewer.zmags.com/publication/a90db379?page=42"> </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 43" href="http://viewer.zmags.com/publication/a90db379?page=43"> / FEATURE BIOMETRICS AND DIGITAL FORENSICS Ju</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 44" href="http://viewer.zmags.com/publication/a90db379?page=44"> / FEATURE / Defining a biometric match A key qu</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 45" href="http://viewer.zmags.com/publication/a90db379?page=45"> usability may prefer a relaxed configuration, whil</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 46" href="http://viewer.zmags.com/publication/a90db379?page=46"> / FEATURE In this respect, we are perhaps</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 47" href="http://viewer.zmags.com/publication/a90db379?page=47"> / CSA investigations Transaction times are an imp</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 48" href="http://viewer.zmags.com/publication/a90db379?page=48"> ASSESSMENT VENDOR INDEPENDENCE t</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 49" href="http://viewer.zmags.com/publication/a90db379?page=49"> / APPLE AUTOPSY APPLE AUTOPSY Apple continues to</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 50" href="http://viewer.zmags.com/publication/a90db379?page=50"> / FEATURE E-DISCOVERY & THE MAC Since the las</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 51" href="http://viewer.zmags.com/publication/a90db379?page=51"> Therefore we see these programs and services beco</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 52" href="http://viewer.zmags.com/publication/a90db379?page=52"> / FEATURE · From an Forensic Image like a .dm</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 53" href="http://viewer.zmags.com/publication/a90db379?page=53"> · “Discovery Assistant” will then scan and bring </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 54" href="http://viewer.zmags.com/publication/a90db379?page=54"> / FEATURE DISCOVERING THE EASE OF X-WAYS FOREN</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 55" href="http://viewer.zmags.com/publication/a90db379?page=55"> / Creating a Case and Adding an Image Once that l</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 56" href="http://viewer.zmags.com/publication/a90db379?page=56"> / FEATURE depending on what options you have </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 57" href="http://viewer.zmags.com/publication/a90db379?page=57"> represent the fact that they are now bookmarked. </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 58" href="http://viewer.zmags.com/publication/a90db379?page=58"> / FEATURE Figure 10. Directory browser </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 59" href="http://viewer.zmags.com/publication/a90db379?page=59"> Forensic Computing 12-month stu</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 60" href="http://viewer.zmags.com/publication/a90db379?page=60"> / FEATURE VIDEO & IMAGE FORENSICS Johann Hofma</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 61" href="http://viewer.zmags.com/publication/a90db379?page=61"> Teddy Cerra, President of Division Security C</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 62" href="http://viewer.zmags.com/publication/a90db379?page=62"> / FEATURE Figure 1. 01 – Seized </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 63" href="http://viewer.zmags.com/publication/a90db379?page=63"> Figure 3. The first image on each row is the query</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 64" href="http://viewer.zmags.com/publication/a90db379?page=64"> / FEATURE / Frame extraction: Intelli- gent vs. </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 65" href="http://viewer.zmags.com/publication/a90db379?page=65"> / NEXT ISSUE COMING SOON… A Roundup of Feat</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 66" href="http://viewer.zmags.com/publication/a90db379?page=66"> / FEATURE </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 67" href="http://viewer.zmags.com/publication/a90db379?page=67"> / WHERE PROFILING COMES INTO THE GAME PROS & C</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 68" href="http://viewer.zmags.com/publication/a90db379?page=68"> / FEATURE For decades, authorship analysi</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 69" href="http://viewer.zmags.com/publication/a90db379?page=69"> strategic information like defence engineering da</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 70" href="http://viewer.zmags.com/publication/a90db379?page=70"> Maximise Prioritise Visualise Call IntaForen</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 71" href="http://viewer.zmags.com/publication/a90db379?page=71"> FILE INTEGRITY MONITORING Scott Zimmerman continu</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 72" href="http://viewer.zmags.com/publication/a90db379?page=72"> / FEATURE Figure 1. </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 73" href="http://viewer.zmags.com/publication/a90db379?page=73"> Figure 3. The “/etc/fstab” file is returned to its</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 74" href="http://viewer.zmags.com/publication/a90db379?page=74"> / FEATURE / Tips for Deployment File Integrity </a> <a title="Digital Forensics Magazine Issue 8, August2011 page 75" href="http://viewer.zmags.com/publication/a90db379?page=75"> Digital ForensicS / magazine BACK ISSUES Digita</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 76" href="http://viewer.zmags.com/publication/a90db379?page=76"> / FEATURE DIGITAL FORENSICS IN SRI LANKA A loo</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 77" href="http://viewer.zmags.com/publication/a90db379?page=77"> Established and maintained by the ICTA, the S</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 78" href="http://viewer.zmags.com/publication/a90db379?page=78"> / FEATURE that due to the limited communicati</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 79" href="http://viewer.zmags.com/publication/a90db379?page=79"> / Sri Lanka's ICT Literacy Through a variety of s</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 80" href="http://viewer.zmags.com/publication/a90db379?page=80"> / BOOK REVIEWS BOOK REVIEWS Kingpin: How One H</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 81" href="http://viewer.zmags.com/publication/a90db379?page=81"> We have to correct an error from Issue 7 where we</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 82" href="http://viewer.zmags.com/publication/a90db379?page=82"> / COLUMN IRQ IThe best laid plans... 'm</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 83" href="http://viewer.zmags.com/publication/a90db379?page=83"> With today’s ever-changing technologies and env</a> <a title="Digital Forensics Magazine Issue 8, August2011 page 84" href="http://viewer.zmags.com/publication/a90db379?page=84"> </a>