SUITCASE.ORG

mscproject.suitcase.org

Computer Forensics: An MSc Project: June 2010

http://mscproject.suitcase.org/2010_06_01_archive.html

Computer Forensics: An MSc Project. VeRa - Software Complete (almost). Monday, 21 June 2010. As a sample filesystem plug-in, a processor for FAT32 was chosen. There were a number of reasons behind this decision:. Well-documented, long established format;. A very simple structure that allowed more time to be dedicated to the general VeRa ecosystem; and,. Volume of potential sample data, due to it being the normal format for devices such as digital cameras and USB memory sticks. The actual values within th...

mscproject.suitcase.org

Computer Forensics: An MSc Project: September 2010

http://mscproject.suitcase.org/2010_09_01_archive.html

Computer Forensics: An MSc Project. Tuesday, 28 September 2010. On Tuesday the 28th of September, 78 pages - 15,500 words - of thesis were submitted. I have spent an entire year's worth of evenings writing the document and associated software, and for obvious reasons have my fingers well and truely crossed. Posted by Adrian Wragg. Subscribe to: Posts (Atom).

mscproject.suitcase.org

Computer Forensics: An MSc Project: FAT32

http://mscproject.suitcase.org/2010/06/fat32.html

Computer Forensics: An MSc Project. VeRa - Software Complete (almost). Monday, 21 June 2010. As a sample filesystem plug-in, a processor for FAT32 was chosen. There were a number of reasons behind this decision:. Well-documented, long established format;. A very simple structure that allowed more time to be dedicated to the general VeRa ecosystem; and,. Volume of potential sample data, due to it being the normal format for devices such as digital cameras and USB memory sticks. The actual values within th...

mscproject.suitcase.org

Computer Forensics: An MSc Project: Thesis submission

http://mscproject.suitcase.org/2010/09/thesis-submission.html

Computer Forensics: An MSc Project. Tuesday, 28 September 2010. On Tuesday the 28th of September, 78 pages - 15,500 words - of thesis were submitted. I have spent an entire year's worth of evenings writing the document and associated software, and for obvious reasons have my fingers well and truely crossed. Posted by Adrian Wragg. Subscribe to: Post Comments (Atom).

mscproject.suitcase.org

Computer Forensics: An MSc Project: November 2010

http://mscproject.suitcase.org/2010_11_01_archive.html

Computer Forensics: An MSc Project. Thursday, 18 November 2010. In my conclusion, I wrote the following:. VeRa, as a software application, meets all the original design and functionality requirements stated at the start of the project. It is capable of parsing complex data structures by following both original and reverse-engineered specifications, with code written from scratch. Instead, its originality comes in the form of being a hosting environment for forensic plug-ins. It allows a developer int...

mscproject.suitcase.org

Computer Forensics: An MSc Project: November 2009

http://mscproject.suitcase.org/2009_11_01_archive.html

Computer Forensics: An MSc Project. Outlook PST file format. XML in Forensics: XIRAF. XML in Forensics: fiwalk and AFF. XML in Forensics: DEX. Creating blank partitioned drives. Friday, 27 November 2009. Creating blank partitioned drives. For a system such as VeRa, testing its filesystem and partition table detection routines on a range of partition combinations is a necessity; however, creating these can be time-consuming. A simple solution to this involves a Linux live ISO and a copy of VirtualBox.

mscproject.suitcase.org

Computer Forensics: An MSc Project: Partition Tables

http://mscproject.suitcase.org/2010/06/partition-tables.html

Computer Forensics: An MSc Project. VeRa - Software Complete (almost). Monday, 21 June 2010. Parsing a partition record is surprisingly easy. The first step is to read the master boot record (MBR) for an image, and specifically the bytes from 0x01BE onwards: this is the partition table itself. These contain up to four-byte records that indicate the starting points of either the individual partition, or further ('extended') partition tables. A typical partition table could be:. Address of partition 1.

mscproject.suitcase.org

Computer Forensics: An MSc Project: Results!

http://mscproject.suitcase.org/2010/11/results.html

Computer Forensics: An MSc Project. Thursday, 18 November 2010. In my conclusion, I wrote the following:. VeRa, as a software application, meets all the original design and functionality requirements stated at the start of the project. It is capable of parsing complex data structures by following both original and reverse-engineered specifications, with code written from scratch. Instead, its originality comes in the form of being a hosting environment for forensic plug-ins. It allows a developer int...

mscproject.suitcase.org

Computer Forensics: An MSc Project: October 2009

http://mscproject.suitcase.org/2009_10_01_archive.html

Computer Forensics: An MSc Project. Friday, 30 October 2009. Detection of the filesystem type is - in theory - relatively simple, as each type differs from the other in a number of different ways; combined, these ways make up that filesystem's 'signature'. The issue then becomes finding enough of these signatures to ensure that the filesystem is accurately guessed; due to the high level of documentation of the formats that exists on the Internet this information is simple to find. Ideally, the method I w...