<br /> Digital<br /> The Quarterly Magazine for Digital Forensics Practitioners<br /> ForensicS<br /> / magazine<br /> INSIDE<br /> / Scott Zimmerman on<br /> Chain of Custody<br /> / Survey Results<br /> / Criminal Profiling<br /> / Ethics In Computer<br /> Forensics<br /> TRAINING &<br /> EDUCATION<br /> ISSUE<br /> LAW ENFORCEMENT<br /> TRAINING<br /> Bev Nutter analyses the digital forensics challenges<br /> and training requirements for law enforcement<br /> HAPPY 1ST<br /> BIRTHDAY!<br /> ISSUE 05<br /> 1 NOVEMBER 2010<br /> COMPETITION!<br /> Bundles of goodies for<br /> our Anniversary Issue!<br /> 04<br /> 9 772042 061103<br /> Issue 5 / £11.99 TR Media<br /> / REGULARS / INTRODUCING / Book Reviews / FROM THE LAB<br /> LEGAL NEWS, 360, Sean Morrissey's brand 3 great books from Frazer Lewis on<br /> IRQ… AND MUCH MORE new column: Apple Autopsy Syngress and Apres<a title="DF5_Online.pdf page 1" href="http://viewer.zmags.com/publication/d5a7adee?page=1"> Digital The Quarterly Magazine for Digital Fore</a> <a title="DF5_Online.pdf page 2" href="http://viewer.zmags.com/publication/d5a7adee?page=2"> LONDON • September 8–9, 2010 10% discount for DFM</a> <a title="DF5_Online.pdf page 3" href="http://viewer.zmags.com/publication/d5a7adee?page=3"> EDITORIAL W </a> <a title="DF5_Online.pdf page 4" href="http://viewer.zmags.com/publication/d5a7adee?page=4"> Reviewing the latest sports highlights </a> <a title="DF5_Online.pdf page 5" href="http://viewer.zmags.com/publication/d5a7adee?page=5"> / CONTENTS CONTENTS / DIGITAL FORENSICS MAGAZ</a> <a title="DF5_Online.pdf page 6" href="http://viewer.zmags.com/publication/d5a7adee?page=6"> / NEWS NEWS SANS Inaugural EU Summit It was </a> <a title="DF5_Online.pdf page 7" href="http://viewer.zmags.com/publication/d5a7adee?page=7"> New features such as the ability to create re</a> <a title="DF5_Online.pdf page 8" href="http://viewer.zmags.com/publication/d5a7adee?page=8"> Mobile Development from Apress The lar</a> <a title="DF5_Online.pdf page 9" href="http://viewer.zmags.com/publication/d5a7adee?page=9"> 360° TYour chance to have your say … </a> <a title="DF5_Online.pdf page 10" href="http://viewer.zmags.com/publication/d5a7adee?page=10"> / LETTERS iPad First we tried the magazine us</a> <a title="DF5_Online.pdf page 11" href="http://viewer.zmags.com/publication/d5a7adee?page=11"> Shape your future Forensic Computing MSc Fo</a> <a title="DF5_Online.pdf page 12" href="http://viewer.zmags.com/publication/d5a7adee?page=12"> / FEATURE THE IDEAL DF COURSE How to design </a> <a title="DF5_Online.pdf page 13" href="http://viewer.zmags.com/publication/d5a7adee?page=13"> In the fourth year, the student spends 25 per</a> <a title="DF5_Online.pdf page 14" href="http://viewer.zmags.com/publication/d5a7adee?page=14"> / FEATURE Hiring the digital forensics in</a> <a title="DF5_Online.pdf page 15" href="http://viewer.zmags.com/publication/d5a7adee?page=15"> At De Montfort, Faculty have found that the t</a> <a title="DF5_Online.pdf page 16" href="http://viewer.zmags.com/publication/d5a7adee?page=16"> Cell site analysis Computer forensics Audio vi</a> <a title="DF5_Online.pdf page 17" href="http://viewer.zmags.com/publication/d5a7adee?page=17"> COMPETITION / To celebrate our 1st ANNIVERSARY in</a> <a title="DF5_Online.pdf page 18" href="http://viewer.zmags.com/publication/d5a7adee?page=18"> / FROM THE LAB VOLATILE RAM ANALYSIS An intro</a> <a title="DF5_Online.pdf page 19" href="http://viewer.zmags.com/publication/d5a7adee?page=19"> pressing reasons why RAM should not be captured b</a> <a title="DF5_Online.pdf page 20" href="http://viewer.zmags.com/publication/d5a7adee?page=20"> / FROM THE LAB Figure3. output from </a> <a title="DF5_Online.pdf page 21" href="http://viewer.zmags.com/publication/d5a7adee?page=21"> The ‘DTB’ field shows the physical memory ad</a> <a title="DF5_Online.pdf page 22" href="http://viewer.zmags.com/publication/d5a7adee?page=22"> / FROM THE LAB Figure 7 shows all the DL</a> <a title="DF5_Online.pdf page 23" href="http://viewer.zmags.com/publication/d5a7adee?page=23"> / LEAD FEATURE TRAINING IN LAW ENFORCEMENT A</a> <a title="DF5_Online.pdf page 24" href="http://viewer.zmags.com/publication/d5a7adee?page=24"> / LEAD FEATURE and ongoing advancements in te</a> <a title="DF5_Online.pdf page 25" href="http://viewer.zmags.com/publication/d5a7adee?page=25"> To demonstrate an individual’s competency, s</a> <a title="DF5_Online.pdf page 26" href="http://viewer.zmags.com/publication/d5a7adee?page=26"> / LEAD FEATURE members who have attended a co</a> <a title="DF5_Online.pdf page 27" href="http://viewer.zmags.com/publication/d5a7adee?page=27"> Maximise Prioritise Visualise Call IntaForen</a> <a title="DF5_Online.pdf page 28" href="http://viewer.zmags.com/publication/d5a7adee?page=28"> Digital ForensicS / magazine PLACE YOU</a> <a title="DF5_Online.pdf page 29" href="http://viewer.zmags.com/publication/d5a7adee?page=29"> / LEGAL EDITORIAL LEGAL EDITORIAL Welcome agai</a> <a title="DF5_Online.pdf page 30" href="http://viewer.zmags.com/publication/d5a7adee?page=30"> / LEGAL FEATURE RIPA AN INTRODUCTION FOR E-IN</a> <a title="DF5_Online.pdf page 31" href="http://viewer.zmags.com/publication/d5a7adee?page=31"> Those who do not comply with the RIP Act when int</a> <a title="DF5_Online.pdf page 32" href="http://viewer.zmags.com/publication/d5a7adee?page=32"> / LEGAL FEATURE CHAIN OF CUSTODY THE FOURTH PA</a> <a title="DF5_Online.pdf page 33" href="http://viewer.zmags.com/publication/d5a7adee?page=33"> Was anyone else present? Why or why not? As menti</a> <a title="DF5_Online.pdf page 34" href="http://viewer.zmags.com/publication/d5a7adee?page=34"> / LEGAL FEATURE Of course, not everyone </a> <a title="DF5_Online.pdf page 35" href="http://viewer.zmags.com/publication/d5a7adee?page=35"> perform tasks B, D, and E. When assigning tasks t</a> <a title="DF5_Online.pdf page 36" href="http://viewer.zmags.com/publication/d5a7adee?page=36"> / LEGAL NEWS ALERT LEGAL NEWS ALERT Privac</a> <a title="DF5_Online.pdf page 37" href="http://viewer.zmags.com/publication/d5a7adee?page=37"> itself does not include a record of the state of </a> <a title="DF5_Online.pdf page 38" href="http://viewer.zmags.com/publication/d5a7adee?page=38"> / TRAINING SURVEY RESULTS DFM TRAINING SURVEY </a> <a title="DF5_Online.pdf page 39" href="http://viewer.zmags.com/publication/d5a7adee?page=39"> The next section we explored the business and</a> <a title="DF5_Online.pdf page 40" href="http://viewer.zmags.com/publication/d5a7adee?page=40"> / TRAINING SURVEY RESULTS One comment was</a> <a title="DF5_Online.pdf page 41" href="http://viewer.zmags.com/publication/d5a7adee?page=41"> / Figure 9. Core competencies and further requ</a> <a title="DF5_Online.pdf page 42" href="http://viewer.zmags.com/publication/d5a7adee?page=42"> Pharos Flyer With Bleed.pdf 1 11/06/2010 23:44:43</a> <a title="DF5_Online.pdf page 43" href="http://viewer.zmags.com/publication/d5a7adee?page=43"> Pharos Flyer With Bleed.pdf 2 11/06/2010 23:44:44</a> <a title="DF5_Online.pdf page 44" href="http://viewer.zmags.com/publication/d5a7adee?page=44"> / MEET THE PROFESSIONALS MEET THE DF PROFESSIO</a> <a title="DF5_Online.pdf page 45" href="http://viewer.zmags.com/publication/d5a7adee?page=45"> With all of this study did you have any time for </a> <a title="DF5_Online.pdf page 46" href="http://viewer.zmags.com/publication/d5a7adee?page=46"> </a> <a title="DF5_Online.pdf page 47" href="http://viewer.zmags.com/publication/d5a7adee?page=47"> / APPLE AUTOPSY APPLE AUTOPSY Welcome to our n</a> <a title="DF5_Online.pdf page 48" href="http://viewer.zmags.com/publication/d5a7adee?page=48"> / FEATURE MAC FORENSICS TRAINING Comparing th</a> <a title="DF5_Online.pdf page 49" href="http://viewer.zmags.com/publication/d5a7adee?page=49"> There are so many applications that come with</a> <a title="DF5_Online.pdf page 50" href="http://viewer.zmags.com/publication/d5a7adee?page=50"> / FEATURE To emphasise the point we loose</a> <a title="DF5_Online.pdf page 51" href="http://viewer.zmags.com/publication/d5a7adee?page=51"> / Vendor Training ATC-NY Corp – Mac Marshall One </a> <a title="DF5_Online.pdf page 52" href="http://viewer.zmags.com/publication/d5a7adee?page=52"> Digital ForensicS / magazine Digital Forensics m</a> <a title="DF5_Online.pdf page 53" href="http://viewer.zmags.com/publication/d5a7adee?page=53"> / FEATURE ETHICS IN COMPUTER FORENSICS Compute</a> <a title="DF5_Online.pdf page 54" href="http://viewer.zmags.com/publication/d5a7adee?page=54"> / FEATURE important areas in computer forensi</a> <a title="DF5_Online.pdf page 55" href="http://viewer.zmags.com/publication/d5a7adee?page=55"> store and use it. However, there might be private</a> <a title="DF5_Online.pdf page 56" href="http://viewer.zmags.com/publication/d5a7adee?page=56"> / FEATURE / Responsible Mentoring I</a> <a title="DF5_Online.pdf page 57" href="http://viewer.zmags.com/publication/d5a7adee?page=57"> / NEXT ISSUE COMING SOON… Some of the great </a> <a title="DF5_Online.pdf page 58" href="http://viewer.zmags.com/publication/d5a7adee?page=58"> / FEATURE ALPHABET SOUP DIGITAL FORENSIC CERT</a> <a title="DF5_Online.pdf page 59" href="http://viewer.zmags.com/publication/d5a7adee?page=59"> Accredited and industry accepted digital fore</a> <a title="DF5_Online.pdf page 60" href="http://viewer.zmags.com/publication/d5a7adee?page=60"> / FEATURE </a> <a title="DF5_Online.pdf page 61" href="http://viewer.zmags.com/publication/d5a7adee?page=61"> </a> <a title="DF5_Online.pdf page 62" href="http://viewer.zmags.com/publication/d5a7adee?page=62"> / FEATURE / Most Popular Digital Forensic Cer</a> <a title="DF5_Online.pdf page 63" href="http://viewer.zmags.com/publication/d5a7adee?page=63"> / FEATURE CRIMINAL MINDS MODUS OPERANDI AND SI</a> <a title="DF5_Online.pdf page 64" href="http://viewer.zmags.com/publication/d5a7adee?page=64"> / FEATURE examination of criminal evidence in</a> <a title="DF5_Online.pdf page 65" href="http://viewer.zmags.com/publication/d5a7adee?page=65"> Feature Ana lysis Port Range •A the •T </a> <a title="DF5_Online.pdf page 66" href="http://viewer.zmags.com/publication/d5a7adee?page=66"> / FEATURE • The set of directories and files </a> <a title="DF5_Online.pdf page 67" href="http://viewer.zmags.com/publication/d5a7adee?page=67"> / Manual or Automated? As pointed out by [Casey],</a> <a title="DF5_Online.pdf page 68" href="http://viewer.zmags.com/publication/d5a7adee?page=68"> Digital ForensicS / magazine BACK ISSUES Issue </a> <a title="DF5_Online.pdf page 69" href="http://viewer.zmags.com/publication/d5a7adee?page=69"> OF SHEEP & HEAP We are sheep to the heap. That’s </a> <a title="DF5_Online.pdf page 70" href="http://viewer.zmags.com/publication/d5a7adee?page=70"> / FEATURE least the size requested by the use</a> <a title="DF5_Online.pdf page 71" href="http://viewer.zmags.com/publication/d5a7adee?page=71"> malloc implementation to use. In our case, since </a> <a title="DF5_Online.pdf page 72" href="http://viewer.zmags.com/publication/d5a7adee?page=72"> / FEATURE are other analysis techniques for d</a> <a title="DF5_Online.pdf page 73" href="http://viewer.zmags.com/publication/d5a7adee?page=73"> MD5 are recognised as one of the leading digital </a> <a title="DF5_Online.pdf page 74" href="http://viewer.zmags.com/publication/d5a7adee?page=74"> / FEATURE HIDE AND SEEK THE EFFECTIVENESS OF P</a> <a title="DF5_Online.pdf page 75" href="http://viewer.zmags.com/publication/d5a7adee?page=75"> potentially achieve “plausible deniability” (the </a> <a title="DF5_Online.pdf page 76" href="http://viewer.zmags.com/publication/d5a7adee?page=76"> / FEATURE Figure 4. Recuva does</a> <a title="DF5_Online.pdf page 77" href="http://viewer.zmags.com/publication/d5a7adee?page=77"> to overwrite data, the blocks occupied by old del</a> <a title="DF5_Online.pdf page 78" href="http://viewer.zmags.com/publication/d5a7adee?page=78"> / BOOK REVIEWS BOOK REVIEWS Digital Forensics </a> <a title="DF5_Online.pdf page 79" href="http://viewer.zmags.com/publication/d5a7adee?page=79"> virtual environments, with the second chapter loo</a> <a title="DF5_Online.pdf page 80" href="http://viewer.zmags.com/publication/d5a7adee?page=80"> </a> <a title="DF5_Online.pdf page 81" href="http://viewer.zmags.com/publication/d5a7adee?page=81"> CALLING ALL RESEARCHERS & PRACTITIONERS If you ar</a> <a title="DF5_Online.pdf page 82" href="http://viewer.zmags.com/publication/d5a7adee?page=82"> / COLUMN IRQ IIn competence… ’ve just re</a> <a title="DF5_Online.pdf page 83" href="http://viewer.zmags.com/publication/d5a7adee?page=83"> Forensic Computing 12-month stu</a> <a title="DF5_Online.pdf page 84" href="http://viewer.zmags.com/publication/d5a7adee?page=84"> Order Today! May April 2010 2010 Digita</a>