In computer forensics, digital evidence related to time is both important and complex. The rules of changes in time associated with digital evidence, such as files or folders, can be used to analyze certain user behaviors like data access, modification or transfer. However, the format and the rules in time information for user actions are quite different for different file systems, even for different versions of operating systems with the same file system. Some research on temporal analysis has already been done on NTFS and FAT file systems, while there are few resources that describe temporal analysis on the Hierarchical File System Plus (HFS+), the default file system in Apple computer. Moreover, removable devices like USB disks are used frequently; transferring files and folders between different devices with different file systems and operating systems happens more and more frequently, so the changes of times across different file systems are also crucial in digital forensics and investigations. In this research, the changes in time attributes of files and folders resulting from user actions on the HFS+ file system and across file systems are analyzed, and the rules of time are generated by inductive reasoning to help reconstruct crime scenes in the digital forensic investigation. Since inductive reasoning is not definitely true compared with deductive reasoning, experiments are performed to validate the rules. The usage of the rules is demonstrated by analyzing a case in details. The methods proposed here are efficient, practical and easy to put into practice in real scenarios. / published_or_final_version / Computer Science / Master / Master of Philosophy

Computer security is a crucial area for any organization based on electronic devices that process data. The security of the devices themselves and the data they process are the backbone of the organization. Until today there have been no completely secure systems or procedures until and a lot of research is being done in this area. It impossible for a machine or a mechanical procedure to "guess" all possible events and lead to conclusive, cohesive and comprehensive secure systems, because of: 1) the human factor, and 2) acts of nature (fire, flood etc). However, proper managerial control can alleviate the extent of the damage caused by those factors.The purpose of this study is to examine the different frameworks of computer security. Emphasis is given to data/database security and the various kinds of attacks on the data. Controls over these attacks and preventative measures will be discussed, and high level language programs will demonstrate the protection issues. The Oracle, SOL query language will be used to demonstrate these controls and prevention measures. In addition the FORTRAN high level language will be used in conjunction with SOL (Only the FORTRAN and COBOL compilers are available for embedded SOL). The C language will be used to show attacks on password files and also as an encryption/decryption program.This study was based mainly on research. An investigation of literature spanning the past decade, was examined to produce the ideas and methods of prevention and control discussed in the study. / Department of Computer Science

802.11-based wireless networking has invaded cities, offices, homes and coffee shops over the last five years, and has become a widely used and accepted technology. It has revolutionised computer networking and automation and added a social aspect to personal computing. Accompanying this widespread usage is the presence of crime; the more popular technology, the more opportunity exists for its misuse. / This dissertation studied 802.11-based wireless networking environment from a forensic computing perspective. It sought to understand the current state of wireless misuse: present misuses; potential forms of misuse involving 802.11-based wireless networks; and current tools and techniques used in its identification, containment and analysis. The research highlights the lack of current tools and procedures for forensic computing investigations that are able to effectively handle the presence of wireless devices and networks, and that there are forms of misuse that may escape detection by forensic investigation teams. This work was then developed into a taxonomy of wireless misuse. / Once the current state was known, this research sought to readdress the current state of forensic computing teams, through analysing the need for software tools and procedural changes to counter the misuses that this technology allows. Once software outcomes were developed, the legal and technical feasibility of their use was ascertained. Based on the outcomes of this work, a final set of software requirements was developed and the proposed methodology for their development was discussed. / A new series of procedures was also developed for forensic investigators to identify, contain and analyse sources of electronic evidence with 802.11-networking. Much of this work was based upon but extending current procedural guides for law enforcement. / The final outcome of this research was the development of a series of recommendations for forensic teams and research that incorporates short, medium and long term development for forensic teams as well as research and development. This work intended to provide mechanisms for future research that are jurisdictionally independent able to be adapted for each individual forensic team. The short term recommendations were primarily changes to procedure, whereas the medium and long terms changes sought to address the larger issues raised by wireless networking devices being the target of or involved in crime or misuse. / Much of this dissertation is exploratory in nature and much of its length is devoted to determining the current state of the misuse and current mechanisms employed to counter it. In such a rapidly developing field of study, this work will need constant revision as new technologies emerge and new forms of misuse take advantage of them. / Thesis (PhDInformationTechnology)--University of South Australia, 2007

802.11-based wireless networking has invaded cities, offices, homes and coffee shops over the last five years, and has become a widely used and accepted technology. It has revolutionised computer networking and automation and added a social aspect to personal computing. Accompanying this widespread usage is the presence of crime; the more popular technology, the more opportunity exists for its misuse. / This dissertation studied 802.11-based wireless networking environment from a forensic computing perspective. It sought to understand the current state of wireless misuse: present misuses; potential forms of misuse involving 802.11-based wireless networks; and current tools and techniques used in its identification, containment and analysis. The research highlights the lack of current tools and procedures for forensic computing investigations that are able to effectively handle the presence of wireless devices and networks, and that there are forms of misuse that may escape detection by forensic investigation teams. This work was then developed into a taxonomy of wireless misuse. / Once the current state was known, this research sought to readdress the current state of forensic computing teams, through analysing the need for software tools and procedural changes to counter the misuses that this technology allows. Once software outcomes were developed, the legal and technical feasibility of their use was ascertained. Based on the outcomes of this work, a final set of software requirements was developed and the proposed methodology for their development was discussed. / A new series of procedures was also developed for forensic investigators to identify, contain and analyse sources of electronic evidence with 802.11-networking. Much of this work was based upon but extending current procedural guides for law enforcement. / The final outcome of this research was the development of a series of recommendations for forensic teams and research that incorporates short, medium and long term development for forensic teams as well as research and development. This work intended to provide mechanisms for future research that are jurisdictionally independent able to be adapted for each individual forensic team. The short term recommendations were primarily changes to procedure, whereas the medium and long terms changes sought to address the larger issues raised by wireless networking devices being the target of or involved in crime or misuse. / Much of this dissertation is exploratory in nature and much of its length is devoted to determining the current state of the misuse and current mechanisms employed to counter it. In such a rapidly developing field of study, this work will need constant revision as new technologies emerge and new forms of misuse take advantage of them. / Thesis (PhDInformationTechnology)--University of South Australia, 2007

802.11-based wireless networking has invaded cities, offices, homes and coffee shops over the last five years, and has become a widely used and accepted technology. It has revolutionised computer networking and automation and added a social aspect to personal computing. Accompanying this widespread usage is the presence of crime; the more popular technology, the more opportunity exists for its misuse. / This dissertation studied 802.11-based wireless networking environment from a forensic computing perspective. It sought to understand the current state of wireless misuse: present misuses; potential forms of misuse involving 802.11-based wireless networks; and current tools and techniques used in its identification, containment and analysis. The research highlights the lack of current tools and procedures for forensic computing investigations that are able to effectively handle the presence of wireless devices and networks, and that there are forms of misuse that may escape detection by forensic investigation teams. This work was then developed into a taxonomy of wireless misuse. / Once the current state was known, this research sought to readdress the current state of forensic computing teams, through analysing the need for software tools and procedural changes to counter the misuses that this technology allows. Once software outcomes were developed, the legal and technical feasibility of their use was ascertained. Based on the outcomes of this work, a final set of software requirements was developed and the proposed methodology for their development was discussed. / A new series of procedures was also developed for forensic investigators to identify, contain and analyse sources of electronic evidence with 802.11-networking. Much of this work was based upon but extending current procedural guides for law enforcement. / The final outcome of this research was the development of a series of recommendations for forensic teams and research that incorporates short, medium and long term development for forensic teams as well as research and development. This work intended to provide mechanisms for future research that are jurisdictionally independent able to be adapted for each individual forensic team. The short term recommendations were primarily changes to procedure, whereas the medium and long terms changes sought to address the larger issues raised by wireless networking devices being the target of or involved in crime or misuse. / Much of this dissertation is exploratory in nature and much of its length is devoted to determining the current state of the misuse and current mechanisms employed to counter it. In such a rapidly developing field of study, this work will need constant revision as new technologies emerge and new forms of misuse take advantage of them. / Thesis (PhDInformationTechnology)--University of South Australia, 2007

Thesis (Ph.D.) -- Mississippi State University. Department of Computer Science and Engineering. / Title from title screen. Includes bibliographical references.

Thesis (Ph. D.)--University of Florida, 2004. / Title from title page of source document. Document formatted into pages; contains 97 pages. Includes vita. Includes bibliographical references.

Thesis (M.S.)--West Virginia University, 2004. / Title from document title page. Document formatted into pages; contains x, 134 p. : ill. (some col.). Includes abstract. Includes bibliographical references (p. 97-99).

Thesis (M.A. in Security Studies (Combating Terrorism: Policy and Strategy))--Naval Postgraduate School, June 2010. / Thesis Advisor(s): Denning, Dorothy ; Russell, James. "June 2010." Description based on title screen as viewed on July 13, 2010. Author(s) subject terms: Cyber attack, international law, China, Russia, United States, al Qaeda, Hamas, Hezbollah, FARC, Botnet, worm, virus, malicious code, hack, jus in bello, jus ad bellum, Law of Armed Conflict (LOAC), laws of war, counterterrorism operations (CT), cyber strategy, military strategy, foreign policy, national policy, use of force, armed attack, enforcement, evaluation Includes bibliographical references (p. 55-60). Also available in print.

Thesis (M.S.C.I.T.)--Regis University, Denver, Colo., 2010. / Title from PDF title page (viewed on Jul. 14, 2010). Includes bibliographical references.