Please enable JavaScript.

Coggle requires JavaScript to display documents.

Week 4 - Coggle Diagram

- - - - file system modified
      - manipulation of other timestamps
      - a system clock can be changed
    - - timestamp can be considered as conclusive it can be corroborated with additional evidence
      - time is non-conclusive if it cannot be corroborated with additional evidence
    - - Check for a corresponding LNK file containing the same date and time and check for the metadata in the docx file
  - - - changing clock rate
      - directly changing time
  - - - determining the best available time information
      - converging clocks to ensure consistency is maintained
    - - NTP
        
        to synchronise across a network
        
        takes place over a period of time
        
        involves NTP packets transfer
        
        contain timestamps with time sample from both participating client and server
        
        NTP is an internet time protocol that includes disipline algorithms for syncing clocks
        
        characteristics
        
        highly scalable
        
        fault tolerant
        
        uses UTC for current time
        
        has two algorithms
        
        clock-filtering algorithm
        
        assits windows in determining the best time sample
        
        sifts through time samples received from quieried time, and finds the best time sample from each source
        
        clock selection algorithm
        
        determines the most accurate time server on the network
        
        uses information gathered to correct local clock of computer(with clock discipline algorithm)
        
        these are most correct under
        
        conditions of light to moderate network and server loads
        
        might perform poorly under conditions of extreme network congestion
- - - - Procedure
        
        write block is connected to a computer/ built in
        
        Analyst then creates image/ copy by writing to target device
        
        A target device to store image or copy is connected to the read-write port of the write block
        
        original is maintained and documented in chain-of custody form
        
        Hard drive is then connected to the read only port of a firmware write block
        
        Image or copy can then be examined on the analysis platfrom
        
        Analyst removes the systems hard drive
      - write blockers
        
        are devices, either software or hardware, that allow acquisition on a drive without creating the possibility of damaging the drive contents
        
        built in two ways
        
        allows all commands to pass from computer to drive except those on a particular list(black list)
        
        it blocks the write commands and lets everything else through
    - - Memory
      - volume
        
        unencrypted
      - involves collecting data from a running system
        
        creates changes on the system
        
        therefore Documentation is important
        
        changes can bring about doubt about the validity of the collection process if documentation or process is haphazard
      - Files
    - - A forensic image is a special type of copy of the original evidence, it contains all of the data found in the original, but that data is encapsulated in a forensic file format which makes it tamper-proof
      - created in blocks
        
        each byte even if its unallocated is copied in the block
      - storage
        
        compound
        
        EO1
        
        adv
        
        ability to segment image into chunks for backup
        
        image can be compressed, encrypted
        
        ensure validity via checksum
        
        disadv
        
        software specific; only some tools are able to read it
        
        file cannot be mounted as a disk image
        
        raw
        
        dd
        
        adv
        
        can be mounted as a disk image
        
        nearly all analytical tools are able to read them
        
        disadv
        
        image is not compressed
        
        linear searching takes long time
      - is the most common way of maintaining evidence from a computer system
- - - - Volume
        
        contains a file system
      - Partition
        
        table
        
        MBR
        
        has one sector
        
        first sector has
        
        disk signature
        
        primary partition definitions
        
        ends with a signature
        
        bootstrap code
        
        additional sectors...
        
        in the boot record are not accessible to users without tools
        
        MBR formatted disk
        
        extended partition
        
        address limitations of MBR partitioning format
        
        GUID
        
        first volume can be anywhere the MBR defines it
        
        GPT
        
        can contain the entire logical volume or portion of a volume
      - is required for OS to access storage space on the physical disk
    - - RAID or LVM
        
        take advantage of multiple drivers or virtual drives to create file systems that are redundant, faster, larger
  - - - control drive
      - send + receive data via interface
        
        hard drive interfaces
      - send + receive data through an interface, interpreted by computer system
  - - - read-write devices 2 per platter
    - - smallest writable area on a file system
      - maximum sector
      - def:
    - - concentric tracks
    - - smallest addressable data on a file file system
    - - is the leftover space on a drive where a file is stored. each cluster on a disk has a storage threshold hence files do not use the entire hard drive space