Please enable JavaScript.

Coggle requires JavaScript to display documents.

Week 9 - Coggle Diagram

- - - - aim to uncover truth
  - - - means that you document basis for your conclusions well enough for someone else to replicate your analysis
    - - clear and standardized way of expressing conclusions
      - just presentation of evidence
      - 7 grade scale
    - - incriminating and exonerating evidence is considered and taken into account
        
        find correct and objective answer
        
        equal amount of time for evidence supporting a computer was used/wasn't used
    - - means that you account for all findings + methods used
  - - - answer question that the investigation has:
        
        to answer the question you analyse the data +consider data during live investigation
    - - the investigator may not really know what to ask for
        
        follow up questions
      - find the underlying questions and bring conclusions for those
  - - - some info that maybe related to crimes but not directly to the question
        
        take notes and discuss with lead investigator
      - set of basiic info that should always be considered/uncovered from every computer
        
        registered owner
        
        time zone info + clock settings
        
        install date, OS version, users
        
        network drive maps
- - - - cruytpographic algorithm is applied to produce cipher text from plain text
      - best practices in cryptography
    - - data used to encrypt/decrypt info
        
        password/phrase in commonly used as key
      - key space
        
        direct impact on ability to break the encryption. Brute force attack
        
        bf attack tries to break password by attempting every possible key combination until right one is found
        
        using 1 computer guessing 500,000 passwords a second, a password would break in a gazillion years
        
        PGP
        
        radically drop the number of attempts per second to only a few hundred
    - - the data are automatically encrypted and decrypted as they are saved and opened
  - - - both makes things harder to understand
    - - obfuscation is used to protect computer code whilst encryption protect data itself
      - obfuscation protects code from reverse engineering encryption cannot be used this way
  - - - to recover data without having to defeat Bitlocker encryption
        
        files stored in bitlocker-protected area of the hard drive are decrypted when they are requested by system
      - recognizing the presence of BitLocker could make all the difference in a digital forensic case- only chance to recover any evidence
  - - - key space= 256 bits