A Geek's Guide to Digital Forensics

Google Tech Talk (more info below)
June 16, 2011

Full Title: "A Geek's Guide to Digital Forensics, or How i Learned to Stop Worrying and Love the Hex Editor"
Presented by Andrew Hoog.

ABSTRACT

This talk will provide a technical introduction to digital forensics geared towards fellow geeks who think tinkering with data in hex is fun and interesting. The talk will provide a brief background on forensics and important concepts including acquisition and verification techniques. Forensic analysis, the really fun stuff, will be covered in detail including specific a walkthrough on how to carve YAFFS2 timestamps from a nandump of an Android device. Finally, we will cover the emerging intersection of digital forensics and traditional security, specifically mobile app security and continuous forensic monitoring of key systems.

Link to slides:
http://viaforensics.com/computer-forensics/google-tech-talk-geeks-guide-to-di...

Speaker Info:
Andrew Hoog is a computer scientist, certified forensic analyst (GCFA and CCE), computer and mobile forensics researcher, author of two forensic and security books, expert witness and co-founder of viaForensics, an innovative digital forensic and security firm. He divides his energies between investigations, forensic software development, and research in digital forensics and security. He also has two patents pending in the areas of forensics and data recovery.

He lives in Oak Park, IL, where he enjoys spending time with his family, traveling, great wine, science fiction, and tinkering with geeky gadgets.

Category:

Science & Technology

Tags:

• google tech talk
• digital forensics
• disk recovery
• security

[tectoism]

Good Guide

[DjAdam16]

@Tolstoievsky No I don't. Just a 4 year grad in Inf. & Security. and current GCFA student. I don't know at all. Do you mind teaching me?

[Tolstoievsky]

@DjAdam16 you don't even know tech, lol

[DjAdam16]

@Tolstoievsky For illiterate people like you, YES.

[KTFKenTheFurry]

I am still waiting for block device encryption for the Android before I will allow its use within my network.

[WyattEpp]

That was a very good intro to this space but I can't like this multiple times without effort. Well done!

[Tolstoievsky]

blablabla techrant blablabla

[droidBasher]

Someone who is serious about destroying evidence will use dban or HDDErase.

[droidBasher]

@disorganizedorg

Not less secure, just more open. Security through obscurity is no defense.

In any case the data comes off, just the wear leveling etc. changes the exact physical image of the device even if no writes are happening, which makes verifying the image less viable.

[disorganizedorg]

@11:40 - So Android is inherently less secure against intrusions such as Mr Hoog does for profit. Good to know.