Hello Possible CEIC Attendee,
I always put my materials up after I give a presentiation. This time since I also made a couple labs to show how to perform this type of investigation into indentifying, detecting and recovering from anti forensic tools I am including those as well. There are 3 labs making up 10gbs of data compressed. The images are e01 and the cases are saved in Encase v7.04 since this was a guidance software conference. There is a lab manual for each lab as well in the root directory to walk you through what you are expected to find.
I'm putting this up on a dropbox account as they are the only file hosting service I could find without max file size limit (that you couldn't pay to increase).
All three labs here:
https://dl.dropbox.com/s/no8w524ecshulz4/dcowen_ceic_labs.zip?dl=1
The ppt slides are here:
https://dl.dropbox.com/s/c0u980a53ipaq7h/CEIC-2012_Anti-Anti_Forensics.pptx?dl=1
As I've said in the prior post, I'm more of a talker than a powerpoint slide maker. So if you have questions based on the presentation/lab please leave them in the comments below and I'll do my best to answer them.
Also Lab 3 contains a preview of our $logfile research that we will hopefully be presenting at blackhat (please pick me blackhat review board).
If this type of lab download/review thing is popular with you readers I can put up more and we can do a forensic challenge style of blogging for a bit!
I always put my materials up after I give a presentiation. This time since I also made a couple labs to show how to perform this type of investigation into indentifying, detecting and recovering from anti forensic tools I am including those as well. There are 3 labs making up 10gbs of data compressed. The images are e01 and the cases are saved in Encase v7.04 since this was a guidance software conference. There is a lab manual for each lab as well in the root directory to walk you through what you are expected to find.
I'm putting this up on a dropbox account as they are the only file hosting service I could find without max file size limit (that you couldn't pay to increase).
All three labs here:
https://dl.dropbox.com/s/no8w524ecshulz4/dcowen_ceic_labs.zip?dl=1
The ppt slides are here:
https://dl.dropbox.com/s/c0u980a53ipaq7h/CEIC-2012_Anti-Anti_Forensics.pptx?dl=1
As I've said in the prior post, I'm more of a talker than a powerpoint slide maker. So if you have questions based on the presentation/lab please leave them in the comments below and I'll do my best to answer them.
Also Lab 3 contains a preview of our $logfile research that we will hopefully be presenting at blackhat (please pick me blackhat review board).
If this type of lab download/review thing is popular with you readers I can put up more and we can do a forensic challenge style of blogging for a bit!
