IFIP TC6 Open Digital Library

Digital Forensics 2006: Orlando, Florida, USA

Advances in Digital Forensics II - IFIP International Conference on Digital Forensics, National Centre for Forensic Science, Orlando, Florida, USA, January 29 - February 1, 2006

Martin S. Olivier, Sujeet Shenoi

Springer, IFIP Advances in Information and Communication Technology 222, ISBN: 978-0-387-36890-0



Contents

Themes and Issues

Some Challenges in Digital Forensics.

Eugene H. Spafford

 1-9

Evidence Collection and Handling

AFF: An Open Extensible Format for Disk Imaging.

Simson L. Garfinkel, David J. Malan, Karl-Alexander Dubec, Christopher C. Stevens, Cecile Pham

 13-27

File System Support for Digital Evidence Bags.

Golden G. Richard III, Vassil Roussev

 29-40

Remote Upload of Evidence over Mobile Ad Hoc Networks.

Indrajit Ray

 41-54

Applying Machine Trust Models to Forensic Investigations.

Marika Wojcik, Hein S. Venter, Jan H. P. Eloff, Martin S. Olivier

 55-65

Exploring Big Haystacks: Data Mining and Knowledge Management.

Mark Pollitt, Anthony Whitledge

 67-76

Forensic Techniques

Countering Hostile Forensic Techniques.

Scott Piper, Mark Davis, Sujeet Shenoi

 79-90

Using PLSI-U to Detect Insider Threats from Email Traffic.

James S. Okolica, Gilbert L. Peterson, Robert F. Mills

 91-103

Collusion Detection Using Multimedia Fingerprints.

Anthony G. Persaud, Yong Guan

 105-118

Authorship Attribution for Electronic Documents.

Patrick Juola

 119-130

Linking Individuals to Digital Information.

Shelly Seier, David Greer, Gavin Manes

 131-140

Use-Misuse Case Driven Analysis of Positive Train Control.

Mark Hartong, Rajni Goel, Duminda Wijesekera

 141-155

Operating System and File System Forensics

Mac OS X Forensics.

Philip Craiger, Paul Burke

 159-170

Detecting Data Concealment Programs Using File System Analysis.

Mark Davis, Richard Kennedy, Kristina Pyles, Amanda Strickler, Sujeet Shenoi

 171-183

Assessing Trace Evidence Left by Secure Deletion Programs.

Paul Burke, Philip Craiger

 185-195

Network Forensics

On the Reliability of Network Eavesdropping Tools.

Eric Cronin, Micah Sherr, Matt Blaze

 199-213

Active Traffic Capture for Network Forensics.

Marco Slaviero, Anna Granova, Martin S. Olivier

 215-228

Logical Traffic Isolation Using Differentiated Services.

Tinus Strauss, Martin S. Olivier, Derrick G. Kourie

 229-237

Passive Detection of NAT Routers and Client Counting.

Kenneth Straka, Gavin Manes

 239-246

Analysis of Web Proxy Logs.

Bennie Fei, Jan H. P. Eloff, Martin S. Olivier, Hein S. Venter

 247-258

GSM Cell Site Forensics.

Christopher Swenson, Tyler Moore, Sujeet Shenoi

 259-272

An Architecture for SCADA Network Forensics.

Tim Kilpatrick, Jesús González, Rodrigo Chandia, Mauricio Papa, Sujeet Shenoi

 273-285

Portable Electronic Device Forensics

Identifying Digital Cameras Using CFA Interpolation.

Sevinc Bayram, Husrev T. Sencar, Nasir D. Memon

 289-299

Forensic Analysis of BIOS Chips.

Pavel Gershteyn, Mark Davis, Sujeet Shenoi

 301-314

Training, Governance and Legal Issues

A Training Tool for Internet Crimes Against Children Cases.

Sudhir Aggarwal, Bob Breeden, Peter Henry, Judie Mulholland

 317-330

Process Flow Diagrams for Training and Operations.

Jacobus Venter

 331-342

A Control Framework for Digital Forensics.

Sebastiaan H. von Solms, C. P. Louwrens, Colette Reekie, Talania Grobler

 343-355

Criminal Regulation of Anti-Forensic Tools in Japan.

Tetsuya Ishii

 357-364