CGS 5131: Computer Forensics I

Instructor: Dr. S. Lang Harris Eng Center 207 (407) 823-2474 lang@cs.ucf.edu Office Hours: Monday & Wednesday: 2 - 4 pm	Teaching Assistant: Danny Ho Harris Eng Center yho@cs.ucf.edu

Announcements:
(Nov. 30, 2006) Notes on WIndows Forensics posted; additional instructions for Assignment #5 posted under the Assignments link on WebCT. (Nov. 29, 2006) Templates for computer forensic examination report (courtesy of Sergeant Purcell of SCSO) posted in the Notes section on WebCT. (Nov. 21, 2006) Notes by guest speaker Sergeant Purcell of SCSO will be posted later; additional comments on Assignment #5 posted on WebCT under the Assignment link. (Nov. 14, 2006) Today's guest speakers are Sergeant Stenger of Orange County Sheriff's Office, Computer Crimes Squad, and Sergeant Purcell, Seminole County Sheriff's Office, Economic and Computer Crimes Unit; Assignment #5 files posted. (Nov. 7, 2006) Guest lecture on FTK demo is scheduled, covering topics including Windows XP registry, imaging, efs, word encrpytion, email, searching, aol Im, graphics, and report writing. (Nov. 5, 2006) A utility program ntfstime.exe is posted on WebCT along with a companion Windows DLL cygwin1.dll which can be used to convert NTFS file time to the local time. Details on how to use the ntfstime program is added to the latest version of the assignment and reposted on WebCT. (Nov. 1, 2006) More details added to Assignment #4 and reposted on WebCT. (Oct. 31, 2006) Today's lecture will be about the use of AccessData's FTK and about issues related to NTFS file date/time stamps. Notes on FTK posted. (Oct. 28/29, 2006) Assignment #4 with additional details posted (and reposted) on WebCT, due 11 pm, 11/11/2006. (Oct. 27, 2006) A guest lecture on Mac Forensics is scheduled for 5:30 - 6:30 pm on Friday, Oct. 27, in Rm. 102 of NCFS. The speaker will also talk about job opportunities at DoD's DCITP facility in Washington, DC. (Oct. 26, 2006) No lab this evening (Thursday, 10/26/2006); an updated version of Assignment #4 will be out late tonight (sorry for the delay). (Oct. 18, 2006) Notes on NTFS file system posted; there is an open lab this evening from 6 to 9 pm in Rm. 315 of NCFS. Test #1's questions and answers are released on WebCT. (Oct. 12, 2006) A copy of Assignment #2's answer key posted at this course website, www.cs.ucf.edu/courses/cgs5131/fall2006/homework/hw2-answerkey.doc. (Oct. 12, 2006) There is NO lab today! An answer key to Assignment #2 will be posted later today; please check back here for details. (Oct. 11, 2006) Notes on FAT systems (part 2) posted; Assignment #3's due date is extended to Thursday, Oct. 19; the file hw3-floppy.dd.txt is revised and reposted on WebCT since the previous MD5 value was incorrect (sorry!). (Oct. 9, 2006) Exam #1 is available on WebCT until 11 pm on Friday, Oct. 13. Today's lectures will be on how to use Diskedit and comments regarding the exam. (Oct. 4, 2006) There will be an open lab on Wednesday, 10/04/2006, from 6 to 9 pm in Rm 315 of NCFS. There will NOT be a lab on Thursday, 10/05/2006. (Oct. 3, 2006) Assignment #2's due date extended to Thursday, 10/05/2006. Assignment #3 and two associated files posted. Test #1 is scheduled for the week of 10/9 through 10/13 on WebCT. See the Tests link for more details. (Oct. 3, 2006) The main purpose for today's lecture is to discuss Norton's Diskedit program, and how to use it to do Assignment #3 (to be handed out today). (Sept. 26, 2006) Notes on FAT file systems (incomplete) posted. There will be an open lab on Wednesday, 9/27/2006, from 6 to p pm in Rm. 315 of NCFS. (Sept. 20, 2006) There will be a lab on both Wednesday (9/20) and Thursday (9/21) from 6 to 9 pm in Rm. 315 of NCFS. Be sure to bring your Helix CD and either a floppy disk or USB thumb drive for Assignment #2. (Sept. 19, 2006) Notes on file systems posted; assignment #2 reposted after class with added details. (Sept. 19, 2006) Today's lectures will cover topics of file system analysis (Chapter 5 of Carrier's text); Assignment #2 will also be discussed. (Sept. 18, 2006) Assignment #2 posted on WebCT. (Sept. 14, 2006) No lab today. Assignment #2 will be posted later. (Sept. 12, 2006) New notes posted including a pre-exam and hard disk acquisition form (courtesy of Sergent Purcell of SCSO). (Sept. 12, 2006) Today's lectures will cover topics of volume analysis and DOS-partitions, mainly from Chapters 5 and 6 of Brian Carrier's text; screenshots of partition table tools (Partition Magic 8.0, QTParted of Helix, Carrier's TSK) will also be discussed. (Sept. 6, 2006) There will be an open lab on Thursday, Sept. 7, from 6 to 9 pm in Rm. 315 of the NCFS building. Bring your copy of the Helix CD and a floppy disk for Assignment #1. (Sept. 5, 2006) Addtional remarks added to Assignment #1, posted on WebCT. Today's lecture will cover the following topics: computer foundations (binary, hexadecimal, ascii, unicode, BIOS, booting, POST, disk geometry, and MBR (master boot record)), mainly from Dr. Leeson's notes and from Chapters 2 - 4 of Carrier's text. Notes posted on WebCT. (Aug. 31, 2006) Assignment #1 reposted after slight revisions added. (Aug. 31, 2006) Assignment #1 files posted; there will be a lab today in Rm. 315 of NCFS from 6 to 9 pm for people wishing to use the lab computers for the assignment. (Aug. 29, 2006) Notes on hard disk acquisition and sample warrants posted on WebCT. (Aug. 22, 2006) The class meets at 6 pm today in Rm. 102 of the NCFS Building. Directions to the building can be found at http://www.ncfs.org/directions.html. Notes are posted.