<x:xmpmeta tsc:version="2.0.1" xmlns:x="adobe:ns:meta/" xmlns:tsc="http://www.techsmith.com/xmp/tsc/">
   <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpDM="http://ns.adobe.com/xmp/1.0/DynamicMedia/" xmlns:xmpG="http://ns.adobe.com/xap/1.0/g/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:tscDM="http://www.techsmith.com/xmp/tscDM/" xmlns:tscIQ="http://www.techsmith.com/xmp/tscIQ/" xmlns:tscHS="http://www.techsmith.com/xmp/tscHS/" xmlns:stDim="http://ns.adobe.com/xap/1.0/sType/Dimensions#" xmlns:stFnt="http://ns.adobe.com/xap/1.0/sType/Font#" xmlns:exif="http://ns.adobe.com/exif/1.0" xmlns:dc="http://purl.org/dc/elements/1.1/">
      <rdf:Description dc:date="2017-04-13 11:45:02 PM" dc:source="Camtasia,9.0.3,enu" dc:title="l_25frn" tscDM:firstFrame="l_25frn_First_Frame.png" tscDM:originId="2625EA67-814F-4A0C-B4C7-2902396CFF3B" tscDM:project="l_25frn.tscproj">
         <xmpDM:duration xmpDM:scale="1/1000" xmpDM:value="2658633"/>
         <xmpDM:videoFrameSize stDim:unit="pixel" stDim:h="1080" stDim:w="1440"/>
         <tsc:langName>
            <rdf:Bag>
               <rdf:li xml:lang="en-US">English</rdf:li></rdf:Bag>
         </tsc:langName>
         <xmpDM:Tracks>
            <rdf:Bag>
               <rdf:li>
                  <rdf:Description xmpDM:trackType="ScreenText" xmpDM:frameRate="f1000" xmpDM:trackName="Screen Text">
                     <xmpDM:markers>
                        <rdf:Seq>
                           <rdf:li><rdf:Description xmpDM:name="Digital Forensics Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu" xmpDM:startTime="0" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-17/" xmpDM:startTime="0" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="hack-like-pro-digital-forensics-for-aspiring-hacker-part-1-tools-techniques" xmpDM:startTime="0" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Overview What is Digital Forensics? Digital Artifacts Network Forensics Sources of Network-based Evidence Mobile Device Digital Artifacts These slides are" xmpDM:startTime="3433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="based partly on the “Introduction to Digital Forensics Course” developed by University of Illinois’s NSF-supported Digital Forensics Curriculum development initiative." xmpDM:startTime="3433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="What is Digital Forensics? Forensics: The application of science to legal problems and investigations." xmpDM:startTime="24933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Digital forensics: A branch of forensics involving the recovery and investigation of digital evidence." xmpDM:startTime="24933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Digital evidence: Data stored or transmitted using a digital device: Computer, Storage, Network, Mobiles." xmpDM:startTime="24933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Computer Forensics Storage Forensics Network Forensics Mobile Forensics" xmpDM:startTime="24933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Evidence Integrity Should ensure evidence is not damaged or altered." xmpDM:startTime="96933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Any alteration must be precisely documented." xmpDM:startTime="96933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Avoid loss of evidence." xmpDM:startTime="96933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Avoid introducing artifacts that may confuse investigation." xmpDM:startTime="96933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Don’t do examination on the original device." xmpDM:startTime="96933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Make a forensic duplicate." xmpDM:startTime="96933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="NIST Computer Forensics Tool Testing (CFTT) certified tools." xmpDM:startTime="96933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Verify integrity by computing crypto hashes Turn-off computer/Mobile? Depends." xmpDM:startTime="96933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="May loose evidence such as open decrypted files" xmpDM:startTime="96933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Network Forensics: Example Justin Ross Harris was charged with murder of his toddler son, who died after being left in" xmpDM:startTime="273467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="a hot car." xmpDM:startTime="273467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Internet browsing history on Justin’s work computer showed he had searched for information on how child deaths occur in cars" xmpDM:startTime="273467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="and how hot it needs to be to kill them." xmpDM:startTime="273467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="He was eventually found guilty." xmpDM:startTime="273467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="273467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Storage Forensics: Example “BTK” serial killer Dennis Rader murdered 10 people in Kansas across 3 decades." xmpDM:startTime="371333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="He sometimes sent mocking messages to the police." xmpDM:startTime="371333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="In 2005 he sent a message asking the police if they could trace the source of documents on a floppy" xmpDM:startTime="371333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="disk; via a newspaper ad, they told him no." xmpDM:startTime="371333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="He sent a message on a floppy disk, which also included a deleted Word document whose metadata referred to the" xmpDM:startTime="371333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Christ Lutheran Church in Wichita (where he was president of the church council) and named “Dennis” as the last person" xmpDM:startTime="371333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="to modify the file." xmpDM:startTime="371333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Within 10 days of mailing the disk, he was arrested." xmpDM:startTime="371333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="371333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Digital Artifacts Operating system: Event logs, Registry data." xmpDM:startTime="732200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="File system: access times, modification." xmpDM:startTime="732200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Disk: deleted files, hidden partitions." xmpDM:startTime="732200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Internet: browser history, e-mail." xmpDM:startTime="732200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Media: photos, videos, audio." xmpDM:startTime="732200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Documents: Office, PDFs, RTF, XML." xmpDM:startTime="732200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Databases: MySQL, Oracle." xmpDM:startTime="732200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Application data: instant messaging." xmpDM:startTime="732200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="732200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Write Blockers Software write blockers can block the message from the OS." xmpDM:startTime="739667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Hardware write blocker is required to block the message from the BIOS." xmpDM:startTime="739667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Portable_forensic_tableau.JPG" xmpDM:startTime="739667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="739667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Digital Artifacts Operating system: Event logs, Registry data." xmpDM:startTime="740867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="File system: access times, modification." xmpDM:startTime="740867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Disk: deleted files, hidden partitions." xmpDM:startTime="740867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Internet: browser history, e-mail." xmpDM:startTime="740867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Media: photos, videos, audio." xmpDM:startTime="740867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Documents: Office, PDFs, RTF, XML." xmpDM:startTime="740867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Databases: MySQL, Oracle." xmpDM:startTime="740867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Application data: instant messaging." xmpDM:startTime="740867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="740867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Write Blockers Software write blockers can block the message from the OS." xmpDM:startTime="802500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Hardware write blocker is required to block the message from the BIOS." xmpDM:startTime="802500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Portable_forensic_tableau.JPG" xmpDM:startTime="802500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="802500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Metadata Files Files that contain data about the file system itself." xmpDM:startTime="870100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="$MFT: master file table (file records)." xmpDM:startTime="870100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="$MFTMirr: mirror of $MFT." xmpDM:startTime="870100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="$LogFile: transaction log to recover from failure." xmpDM:startTime="870100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="$BadClus: bad clusters." xmpDM:startTime="870100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="." xmpDM:startTime="870100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Root directory." xmpDM:startTime="870100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="$Secure: special access control list database." xmpDM:startTime="870100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="870100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="File Recovery vs." xmpDM:startTime="870767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Carving Recovery: file system metadata are intact; use them to find file (“undelete”)." xmpDM:startTime="870767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Carving: pulls the raw bytes from the media." xmpDM:startTime="870767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Recovery of files without file system metadata." xmpDM:startTime="870767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Header-footer carving: All JPEG files start with 0xFFD8 and ends with 0xFFD9." xmpDM:startTime="870767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tools: Scalpel, Foremost, EnCase." xmpDM:startTime="870767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="File-structure-based carving: Use internal file metadata Tools: Foremost, PhotoRec Content-based carving: statistical signatures indicating language or file content." xmpDM:startTime="870767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="870767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Metadata Files Files that contain data about the file system itself." xmpDM:startTime="872133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="$MFT: master file table (file records)." xmpDM:startTime="872133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="$MFTMirr: mirror of $MFT." xmpDM:startTime="872133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="$LogFile: transaction log to recover from failure." xmpDM:startTime="872133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="$BadClus: bad clusters." xmpDM:startTime="872133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="." xmpDM:startTime="872133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Root directory." xmpDM:startTime="872133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="$Secure: special access control list database." xmpDM:startTime="872133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="872133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="File Recovery vs." xmpDM:startTime="978700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Carving Recovery: file system metadata are intact; use them to find file (“undelete”)." xmpDM:startTime="978700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Carving: pulls the raw bytes from the media." xmpDM:startTime="978700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Recovery of files without file system metadata." xmpDM:startTime="978700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Header-footer carving: All JPEG files start with 0xFFD8 and ends with 0xFFD9." xmpDM:startTime="978700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tools: Scalpel, Foremost, EnCase." xmpDM:startTime="978700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="File-structure-based carving: Use internal file metadata Tools: Foremost, PhotoRec Content-based carving: statistical signatures indicating language or file content." xmpDM:startTime="978700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="978700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Memory Carving Snapshots (images) of RAM can be taken by some tools (dd, dev, mem)." xmpDM:startTime="1077667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Just like a disk." xmpDM:startTime="1077667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Crash dumps." xmpDM:startTime="1077667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sleep images are left behind (maybe unencrypted) by some OSes." xmpDM:startTime="1077667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="E.g.," xmpDM:startTime="1077667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="/private/var/vm/sleepimage." xmpDM:startTime="1077667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="RAM is highly fragmented." xmpDM:startTime="1077667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1077667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Computer Forensics Windows Registry." xmpDM:startTime="1082300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Event logs." xmpDM:startTime="1082300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Link files." xmpDM:startTime="1082300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Recycle Bin Application Metadata: E.g.," xmpDM:startTime="1082300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Microsoft Office List of last 10 authors." xmpDM:startTime="1082300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="A list of revisions, along with who made them, if “track changes” is on." xmpDM:startTime="1082300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Hidden annotations and comments." xmpDM:startTime="1082300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Created, last written, and accessed times." xmpDM:startTime="1082300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Browser History and Cache Prefetch Files: Stored in C:\Windows\Prefetch\*.pf" xmpDM:startTime="1082300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1082300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Memory Carving Snapshots (images) of RAM can be taken by some tools (dd, dev, mem)." xmpDM:startTime="1083433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Just like a disk." xmpDM:startTime="1083433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Crash dumps." xmpDM:startTime="1083433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sleep images are left behind (maybe unencrypted) by some OSes." xmpDM:startTime="1083433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="E.g.," xmpDM:startTime="1083433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="/private/var/vm/sleepimage." xmpDM:startTime="1083433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="RAM is highly fragmented." xmpDM:startTime="1083433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1083433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Computer Forensics Windows Registry." xmpDM:startTime="1155433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Event logs." xmpDM:startTime="1155433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Link files." xmpDM:startTime="1155433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Recycle Bin Application Metadata: E.g.," xmpDM:startTime="1155433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Microsoft Office List of last 10 authors." xmpDM:startTime="1155433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="A list of revisions, along with who made them, if “track changes” is on." xmpDM:startTime="1155433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Hidden annotations and comments." xmpDM:startTime="1155433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Created, last written, and accessed times." xmpDM:startTime="1155433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Browser History and Cache Prefetch Files: Stored in C:\Windows\Prefetch\*.pf" xmpDM:startTime="1155433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1155433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Network Forensics E-mails and IM sessions; browser activity; routinely kept packet logs; /var/log/messages Depending on the method of capture, packet" xmpDM:startTime="1284633" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="capture may be treated as recordings of events, i.e.," xmpDM:startTime="1284633" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="there are privacy and legal implications, so you must be careful." xmpDM:startTime="1284633" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1284633" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sources of Network-based Evidence, 1 Wireless access points." xmpDM:startTime="1388467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Easy to eavesdrop on traffic that passes through." xmpDM:startTime="1388467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Management and control frames are not encrypted." xmpDM:startTime="1388467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Switches (devices that connect computers together)." xmpDM:startTime="1388467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Contain tables that store, e.g.," xmpDM:startTime="1388467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="mappings between physical ports and devices’ MAC addresses." xmpDM:startTime="1388467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Traffic can be captured from switches as well." xmpDM:startTime="1388467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Routers (devices that connect segments of networks together)." xmpDM:startTime="1388467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Contain routing tables that map router ports with networks." xmpDM:startTime="1388467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Routers may also function as packet filters." xmpDM:startTime="1388467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1388467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sources of Network-based Evidence, 2 DHCP servers (which give out IP addresses via a temporary leasing system; every machine needs" xmpDM:startTime="1572767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="an IP address to connect to the Internet)." xmpDM:startTime="1572767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="DHCP server logs contain IP address to MAC address mappings and the times the IP addresses were leased." xmpDM:startTime="1572767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="DNS servers and name servers (which convert domain names to IP addresses)." xmpDM:startTime="1572767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Logs may reveal connection attempts from internal to external websites, e-mail, or SSH servers, with time stamps." xmpDM:startTime="1572767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Authentication servers (which, e.g.," xmpDM:startTime="1572767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="validate username &amp; password credentials)." xmpDM:startTime="1572767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Log successful/failed login attempts for all devices within their authentication domains." xmpDM:startTime="1572767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1572767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sources of Network-based Evidence, 3 Network intrusion detection/prevention systems (NIDS/NIPS) (which monitor what’s coming in and going out of a" xmpDM:startTime="1682433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="network)." xmpDM:startTime="1682433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="May detect attacks in progress." xmpDM:startTime="1682433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Can be tuned to give more granular data." xmpDM:startTime="1682433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Firewalls (which block incoming and/or outgoing traffic)." xmpDM:startTime="1682433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Firewalls can be configured to keep logs, which can serve as digital evidence." xmpDM:startTime="1682433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Web proxies (intermediary servers that support clients’ access to Web content)." xmpDM:startTime="1682433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="An enterprise’s Web proxy can store Web surfing logs for the entire organization." xmpDM:startTime="1682433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1682433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sources of Network-based Evidence, 4 Application servers." xmpDM:startTime="1816533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="E.g.," xmpDM:startTime="1816533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="database, Web, e-mail, chat, and voicemail servers." xmpDM:startTime="1816533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="These can be very important." xmpDM:startTime="1816533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Local network diagrams and applications." xmpDM:startTime="1816533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="You can review these to find out which servers are useful for a particular investigation." xmpDM:startTime="1816533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1816533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Flow Record Processing System A flow record processing system captures, stores, and then processes information about the flows of interest." xmpDM:startTime="1868267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="It can include these components: Sensor: The device that monitors flows and extracts important bits to a flow record." xmpDM:startTime="1868267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Does actual capture." xmpDM:startTime="1868267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Collector: A server that receives and stores flow records from sensors." xmpDM:startTime="1868267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="(Sensors have limited storage.)" xmpDM:startTime="1868267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Aggregator: Aggregates data from multiple collectors." xmpDM:startTime="1868267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Analysis: Software tools are used for analysis." xmpDM:startTime="1868267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="E.g.," xmpDM:startTime="1868267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Wireshark includes all 4 components in 1 tool." xmpDM:startTime="1868267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1868267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Mobile Device Digital Artifacts Internal memory (NAND)." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="GPS, text messages, call records." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Photos, contacts." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Email, browser history." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="External memory (SIM cards)." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Subscriber data." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Extra storage for internal memory." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Service provider logs." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Call records, cell usage." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Location parameters." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Text/multimedia messages." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Intercepted data." xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1942700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Summary Digital Forensics involves recovering digital evidence from computer, storage, network, or mobile devides Recovering files without metadata is called" xmpDM:startTime="2252433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="'File Carving' Computer forensics requires looking at registry, logs, link files, recycle bin, and appliction meta data Network forensics requires" xmpDM:startTime="2252433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="looking at emails, instant messages, traffic, browser histories Network evidence can be collected by access points, switches, routers, DHCP servers," xmpDM:startTime="2252433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="DNS Servers, Authentication Servers, NIDS, Firewalls, and web proxies Mobile device artifacts includes contents of internal memory, SIM card, Service" xmpDM:startTime="2252433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="provider logs" xmpDM:startTime="2252433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Lab 25: Autopsy Autopsy is a forensic tool commonly used to analyze disk images Read about the software https://www.sleuthkit.org/autopsy/v2/" xmpDM:startTime="2599700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Download the software Mac: http://macappstore.org/autopsy/" xmpDM:startTime="2599700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Windows: https://www.sleuthkit.org/autopsy/download.php" xmpDM:startTime="2599700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Download a clean Ubuntu image from http://releases.ubuntu.com/trusty/" xmpDM:startTime="2599700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="2599700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Lab 25 (Cont) Launch autopsy: Mac: Browse to http://localhost:9999/autopsy Windows: Launch autopsy Create a new case with proper name, description," xmpDM:startTime="2634767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="and investigator name Add host with default configurations Add a new image Choose the downloaded Ubuntu file Type disk Import" xmpDM:startTime="2634767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="method Symlink Let the software calculate the hash function of the image" xmpDM:startTime="2634767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Lab 25 (Cont) Analyze the disk image Choose file analysis Look at different files included with the image Generate an" xmpDM:startTime="2652100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ASCII report of README.diskdefines" xmpDM:startTime="2652100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Go to file type and sort file by types." xmpDM:startTime="2652100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Using the terminal, navigate to see the sorted file directory Check contents of crypto.html" xmpDM:startTime="2652100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Submission: Submit screenshot for each lab stage" xmpDM:startTime="2652100" xmpDM:duration="1000"/></rdf:li></rdf:Seq>
                     </xmpDM:markers>
                  </rdf:Description>
               </rdf:li>
               <rdf:li>
                  <rdf:Description xmpDM:trackType="TableOfContents" xmpDM:frameRate="f1000" xmpDM:trackName="Table of Contents">
                     <xmpDM:markers>
                        <rdf:Seq>
                           <rdf:li><rdf:Description xmpDM:name="Digital Forensics" xmpDM:startTime="0" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="0" tscDM:imageoffset="0" tscDM:imagerect="0, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Overview" xmpDM:startTime="3433" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="1" tscDM:imageoffset="0" tscDM:imagerect="75, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="What is Digital Forensics?" xmpDM:startTime="24933" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="2" tscDM:imageoffset="0" tscDM:imagerect="150, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Evidence Integrity" xmpDM:startTime="96933" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="3" tscDM:imageoffset="0" tscDM:imagerect="225, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Network Forensics: Example" xmpDM:startTime="273467" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="4" tscDM:imageoffset="0" tscDM:imagerect="300, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Storage Forensics: Example" xmpDM:startTime="371333" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="5" tscDM:imageoffset="0" tscDM:imagerect="375, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Digital Artifacts" xmpDM:startTime="732200" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="6" tscDM:imageoffset="0" tscDM:imagerect="450, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Write Blockers" xmpDM:startTime="739667" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="7" tscDM:imageoffset="0" tscDM:imagerect="525, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Digital Artifacts" xmpDM:startTime="740867" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="8" tscDM:imageoffset="0" tscDM:imagerect="600, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Write Blockers" xmpDM:startTime="802500" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="9" tscDM:imageoffset="0" tscDM:imagerect="675, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Metadata Files" xmpDM:startTime="870100" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="10" tscDM:imageoffset="0" tscDM:imagerect="750, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="File Recovery vs. Carving" xmpDM:startTime="870767" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="11" tscDM:imageoffset="0" tscDM:imagerect="825, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Metadata Files" xmpDM:startTime="872133" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="12" tscDM:imageoffset="0" tscDM:imagerect="900, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="File Recovery vs. Carving" xmpDM:startTime="978700" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="13" tscDM:imageoffset="0" tscDM:imagerect="975, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Memory Carving" xmpDM:startTime="1077667" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="14" tscDM:imageoffset="0" tscDM:imagerect="1050, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Computer Forensics" xmpDM:startTime="1082300" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="15" tscDM:imageoffset="0" tscDM:imagerect="1125, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Memory Carving" xmpDM:startTime="1083433" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="16" tscDM:imageoffset="0" tscDM:imagerect="1200, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Computer Forensics" xmpDM:startTime="1155433" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="17" tscDM:imageoffset="0" tscDM:imagerect="1275, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Network Forensics" xmpDM:startTime="1284633" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="18" tscDM:imageoffset="0" tscDM:imagerect="1350, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sources of Network-based Evidence, 1" xmpDM:startTime="1388467" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="19" tscDM:imageoffset="0" tscDM:imagerect="1425, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sources of Network-based Evidence, 2" xmpDM:startTime="1572767" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="20" tscDM:imageoffset="0" tscDM:imagerect="1500, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sources of Network-based Evidence, 3" xmpDM:startTime="1682433" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="21" tscDM:imageoffset="0" tscDM:imagerect="1575, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sources of Network-based Evidence, 4" xmpDM:startTime="1816533" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="22" tscDM:imageoffset="0" tscDM:imagerect="1650, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Flow Record Processing System" xmpDM:startTime="1868267" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="23" tscDM:imageoffset="0" tscDM:imagerect="1725, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Mobile Device Digital Artifacts" xmpDM:startTime="1942700" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="24" tscDM:imageoffset="0" tscDM:imagerect="1800, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Summary" xmpDM:startTime="2252433" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="25" tscDM:imageoffset="0" tscDM:imagerect="1875, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Lab 25: Autopsy" xmpDM:startTime="2599700" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="26" tscDM:imageoffset="0" tscDM:imagerect="1950, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Lab 25 (Cont) " xmpDM:startTime="2634767" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="27" tscDM:imageoffset="0" tscDM:imagerect="2025, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name=" Lab 25 (Cont)" xmpDM:startTime="2652100" tscDM:image="l_25frn_Thumbnails.png" tscDM:imageindex="28" tscDM:imageoffset="0" tscDM:imagerect="2100, 0, 75, 56"/></rdf:li></rdf:Seq>
                     </xmpDM:markers>
                  </rdf:Description>
               </rdf:li>
            </rdf:Bag>
         </xmpDM:Tracks>
         <tscDM:controller>
            <rdf:Description xmpDM:name="tscplayer">
               <tscDM:parameters>
                  <rdf:Bag>
                     <rdf:li xmpDM:name="autohide" xmpDM:value="false"/><rdf:li xmpDM:name="autoplay" xmpDM:value="true"/><rdf:li xmpDM:name="loop" xmpDM:value="false"/><rdf:li xmpDM:name="searchable" xmpDM:value="true"/><rdf:li xmpDM:name="captionsenabled" xmpDM:value="false"/><rdf:li xmpDM:name="sidebarenabled" xmpDM:value="false"/><rdf:li xmpDM:name="unicodeenabled" xmpDM:value="false"/><rdf:li xmpDM:name="backgroundcolor" xmpDM:value="000000"/><rdf:li xmpDM:name="sidebarlocation" xmpDM:value="left"/><rdf:li xmpDM:name="endaction" xmpDM:value="stop"/><rdf:li xmpDM:name="endactionparam" xmpDM:value="true"/><rdf:li xmpDM:name="locale" xmpDM:value="en-US"/></rdf:Bag>
               </tscDM:parameters>
               <tscDM:controllerText>
                  <rdf:Bag>
                  </rdf:Bag>
               </tscDM:controllerText>
            </rdf:Description>
         </tscDM:controller>
         <tscDM:contentList>
            <rdf:Description>
               <tscDM:files>
                  <rdf:Seq>
                     <rdf:li xmpDM:name="0" xmpDM:value="l_25frn.mp4"/><rdf:li xmpDM:name="1" xmpDM:value="l_25frn_First_Frame.png"/><rdf:li xmpDM:name="2" xmpDM:value="l_25frn_Thumbnails.png"/></rdf:Seq>
               </tscDM:files>
            </rdf:Description>
         </tscDM:contentList>
      </rdf:Description>
   </rdf:RDF>
</x:xmpmeta>