Dissertation/ Thesis
Forensic methodology for Windows 7 and windows 8
| Τίτλος: | Forensic methodology for Windows 7 and windows 8 |
|---|---|
| Συγγραφείς: | Σούλας, Μάριος Β. |
| Συνεισφορές: | Κάτσικας, Σωκράτης |
| Έτος έκδοσης: | 2015 |
| Συλλογή: | University of Piraeus: Dione / Πανεπιστημίο Πειραιώς: Διώνη |
| Θεματικοί όροι: | Forensic genetics -- Computer programs, Διαδίκτυο (Internet) -- Μέτρα ασφαλείας, Windows (Computer operating systems) |
| Περιγραφή: | In this thesis it is proposed a methodology for digital data analysis in Windows 7 and Windows 8 environments. The aim of this research is to map out how the analyst should be thinking and how he should modify the available tools in order to make them fit fully in his operational needs. When a new version of an operating system is released, the adaptation of the analyst is usually difficult. Through this work we try to emulate a proper way of thinking, in order to allow the analyst to have a full and smooth transition into the new version. In order to follow a specific forensics plan, one must first break the methodology into small independent processes. After that, one must come up with the tools that one is going to use in each process. The forensics methodology follows a basic rule, namely that we should make as few changes as possible to the system under review. The first step is to make sure that we have an incident. We achieve that with the process of incident handling (response). After we ascertain that we have an incident, we move on the next steps which are making copies of the memory, the registry and the hard disk. By using the mirror tool, we take a copy of the memory in order to make as few changes to the system (memory) as possible. We use some other tools for the registry and the hard disk copy. The work finishes with the analysis of the memory, the registry and the hard disk. This thesis is structured as follows: firstly we discuss the tools and the working environment chosen for this particular research. Second the methodology is applied to the windows 7 op¬erating system. After that, the tools we use are modified and applied again in the windows 8 operating system. In conclusion we make a comparison of our results between these two op¬erating systems. |
| Τύπος εγγράφου: | master thesis |
| Περιγραφή αρχείου: | application/pdf |
| Γλώσσα: | Greek, Modern (1453-) |
| Relation: | http://dione.lib.unipi.gr/xmlui/handle/unipi/6257; 614.1 ΣΟΥ |
| Διαθεσιμότητα: | http://dione.lib.unipi.gr/xmlui/handle/unipi/6257 |
| Rights: | Αναφορά Δημιουργού-Μη Εμπορική Χρήση-Όχι Παράγωγα Έργα 4.0 Διεθνές ; http://creativecommons.org/licenses/by-nc-nd/4.0/deed.el |
| Αριθμός Καταχώρησης: | edsbas.BD8E1652 |
| Βάση Δεδομένων: | BASE |
| FullText | Text: Availability: 0 CustomLinks: – Url: http://dione.lib.unipi.gr/xmlui/handle/unipi/6257# Name: EDS - BASE (ns324271) Category: fullText Text: View record from BASE |
|---|---|
| Header | DbId: edsbas DbLabel: BASE An: edsbas.BD8E1652 RelevancyScore: 772 AccessLevel: 3 PubType: Dissertation/ Thesis PubTypeId: dissertation PreciseRelevancyScore: 771.549072265625 |
| IllustrationInfo | |
| Items | – Name: Title Label: Title Group: Ti Data: Forensic methodology for Windows 7 and windows 8 – Name: Author Label: Authors Group: Au Data: <searchLink fieldCode="AR" term="%22Σούλας%2C+Μάριος+Β%2E%22">Σούλας, Μάριος Β.</searchLink> – Name: Author Label: Contributors Group: Au Data: Κάτσικας, Σωκράτης – Name: DatePubCY Label: Publication Year Group: Date Data: 2015 – Name: Subset Label: Collection Group: HoldingsInfo Data: University of Piraeus: Dione / Πανεπιστημίο Πειραιώς: Διώνη – Name: Subject Label: Subject Terms Group: Su Data: <searchLink fieldCode="DE" term="%22Forensic+genetics+--+Computer+programs%22">Forensic genetics -- Computer programs</searchLink><br /><searchLink fieldCode="DE" term="%22Διαδίκτυο+%28Internet%29+--+Μέτρα+ασφαλείας%22">Διαδίκτυο (Internet) -- Μέτρα ασφαλείας</searchLink><br /><searchLink fieldCode="DE" term="%22Windows+%28Computer+operating+systems%29%22">Windows (Computer operating systems)</searchLink> – Name: Abstract Label: Description Group: Ab Data: In this thesis it is proposed a methodology for digital data analysis in Windows 7 and Windows 8 environments. The aim of this research is to map out how the analyst should be thinking and how he should modify the available tools in order to make them fit fully in his operational needs. When a new version of an operating system is released, the adaptation of the analyst is usually difficult. Through this work we try to emulate a proper way of thinking, in order to allow the analyst to have a full and smooth transition into the new version. In order to follow a specific forensics plan, one must first break the methodology into small independent processes. After that, one must come up with the tools that one is going to use in each process. The forensics methodology follows a basic rule, namely that we should make as few changes as possible to the system under review. The first step is to make sure that we have an incident. We achieve that with the process of incident handling (response). After we ascertain that we have an incident, we move on the next steps which are making copies of the memory, the registry and the hard disk. By using the mirror tool, we take a copy of the memory in order to make as few changes to the system (memory) as possible. We use some other tools for the registry and the hard disk copy. The work finishes with the analysis of the memory, the registry and the hard disk. This thesis is structured as follows: firstly we discuss the tools and the working environment chosen for this particular research. Second the methodology is applied to the windows 7 op¬erating system. After that, the tools we use are modified and applied again in the windows 8 operating system. In conclusion we make a comparison of our results between these two op¬erating systems. – Name: TypeDocument Label: Document Type Group: TypDoc Data: master thesis – Name: Format Label: File Description Group: SrcInfo Data: application/pdf – Name: Language Label: Language Group: Lang Data: Greek, Modern (1453-) – Name: NoteTitleSource Label: Relation Group: SrcInfo Data: http://dione.lib.unipi.gr/xmlui/handle/unipi/6257; 614.1 ΣΟΥ – Name: URL Label: Availability Group: URL Data: http://dione.lib.unipi.gr/xmlui/handle/unipi/6257 – Name: Copyright Label: Rights Group: Cpyrght Data: Αναφορά Δημιουργού-Μη Εμπορική Χρήση-Όχι Παράγωγα Έργα 4.0 Διεθνές ; http://creativecommons.org/licenses/by-nc-nd/4.0/deed.el – Name: AN Label: Accession Number Group: ID Data: edsbas.BD8E1652 |
| PLink | https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=edsbas&AN=edsbas.BD8E1652 |
| RecordInfo | BibRecord: BibEntity: Languages: – Text: Greek, Modern (1453-) Subjects: – SubjectFull: Forensic genetics -- Computer programs Type: general – SubjectFull: Διαδίκτυο (Internet) -- Μέτρα ασφαλείας Type: general – SubjectFull: Windows (Computer operating systems) Type: general Titles: – TitleFull: Forensic methodology for Windows 7 and windows 8 Type: main BibRelationships: HasContributorRelationships: – PersonEntity: Name: NameFull: Σούλας, Μάριος Β. – PersonEntity: Name: NameFull: Κάτσικας, Σωκράτης IsPartOfRelationships: – BibEntity: Dates: – D: 01 M: 01 Type: published Y: 2015 Identifiers: – Type: issn-locals Value: edsbas – Type: issn-locals Value: edsbas.oa |
| ResultId | 1 |