Thursday, September 30, 2010
Sunday, September 19, 2010
Saturday, September 18, 2010
Thursday, September 16, 2010
Wednesday, September 15, 2010
1. Not all information-based evidence is the same! Evidence can be organized into an “order of volatility” meaning how long it will stick around for you to collect until it automatically is lost.
2. Dan Farmer & Wietse Venema created the below table of evidence volatility, which is commonly referenced by forensic professionals. For example, information stored on a CD-R or some optical storage media can last for about 10-100 years depending on the brand used. Information stored in a computer’s main memory, by contrast, will last for only tens of nanoseconds before it is wiped out by the computer’s normal processing.
TYPE OF DATA
Registers, peripheral memory, caches, etc.
Nanoseconds or less
Floppies, backup media, etc.
CD-ROMs, printouts, etc.
Tens of years
3. Very critical from forensics point of view.....most people would want to turn a computer off (or at the very least unplug it from the network) when they realize an incident has occurred. However, as noted in the chart above, one will lose evidence in main memory and “network state” information (which other systems the computer is connected with and what information they are exchanging) with such an approach. Even shutting down a computer the “normal” way (Start / Turn Off Computer / Turn Off in Windows XP) can delete evidence, as Windows performs a number of housekeeping tasks in the shutdown process, such as closing opened files and clearing out the temporary disk cache.
4. Thanks Peter C. Hewitt (Read from Browser Forensics).
Monday, September 13, 2010
Monday, September 06, 2010
Thursday, September 02, 2010
- Criminals buy blocks of advertisement space on websites, intermittently slipping in a tainted advertisement.
- Just visiting a webpage with a tainted ad causes a fake warning box to appear.
- Clicking "OK" or "Cancel" launches the same thing: a "free scan."
- The bogus scan will purport to find a virus infestation.
- Ensuing boxes steer the user to activate "Personal Antivirus," on left.
- The activation prompts take the user to a shopping cart.
- Declining to place an order triggers endless fake scans.