Digital forensic examiners are investigators who are experts in gathering, recovering, analyzing, and presenting data evidence from computers and other digital media related to computer-based .They might work on cases concerning identity theft, electronic fraud,investigation of material found in digital devices ,electronic evidence, often in relation to cyber crimes.
LastActivityView is a tool for Windows operating system that collects
information from various sources on a running system,
and displays a log of actions made by the user and events occurred on
this computer.
The activity displayed by LastActivityView includes: Running .exe file,
Opening open/save dialog-box, Opening file/folder from Explorer or other
software,
software installation, system shutdown/start, application or system
crash, network connection/disconnection and more...
You can easily export this information into csv/tab-delimited/xml/html
file or copy it to the clipboard and then paste into Excel or other
software.
Command-Line Options
/stext <Filename>
Save the actions and events list into a regular text file.
/stab <Filename>
Save the actions and events list into a tab-delimited text file.
/scomma <Filename>
Save the actions and events list into a comma-delimited text file (csv).
/stabular <Filename>
Save the actions and events list into a tabular text file.
/shtml <Filename>
Save the actions and events list into HTML file (Horizontal).
/sverhtml <Filename>
Save the actions and events list into HTML file (Vertical).
Digital Forensics: CDFE – Certified Digital Forensics Examiner
Last Update 17-8-2020
เตรียมสอบ Certified Digital Forensics เป็นค่ายที่โด่งดังมาก่อนในอดีต แต่ปัจจุบันมีค่ายอื่นๆมาแข่งมากขึ้น
CDFE
Certified Digital Forensics Examiner
The
Certified Digital Forensics Examiner vendor-neutral certification is
designed to train Cyber Crime and Fraud Investigators whereby students
are taught electronic discovery and advanced investigation techniques.
This course is essential to anyone encountering digital evidence while
conducting an investigation. Mile2’s Certified Digital Forensics
Examiner training teaches the methodology for conducting a computer
forensic examination. Students will learn to use forensically sound
investigative techniques in order to evaluate the scene, collect and
document all relevant information, interview appropriate personnel,
maintain chain-of-custody, and write a findings report. The Certified
Digital Forensics Examiner course will benefit organizations,
individuals, government offices, and law enforcement agencies interested
in pursuing litigation, proof of guilt, or corrective action based on
digital evidence. Upon
completion, Certified Digital Forensics Examiner students will be able
to establish industry acceptable digital forensics standards with
current best practices and policies
Certified Digital Forensics Examiner
New website
The CDFE training covers a wide range of topics including:
Forensic Examination
Tools of the trade
Seizure Concepts
Incident Investigation
Fundamentals of conducting an effective computer forensic examination
The smallest area on a drive that data can be written to is a _______while the
smallest area on a drive that a file can be written to is a _______.
a. Bit and byte
b. Sector and cluster
c. Volume and drive
d. Memory and disk
Answer: B
What is found at Cylinder 0, Head 0, Sector 1 on a hard drive?
A. Master boot record
B. Master file table
C. Volume boot record
D. Volume boot sector
Answer: A
Because this file will hold the contents of RAM when the machine is powered off, the ______ file will be the size of the system RAM and will be in the root directory.
A. hiberfil.sys B. WIN386.SWP C. PAGEFILE.SYS D. NTUSER.DAT
Answer: A
What is the length of the cryptographic key used in the Data Encryption Standard (DES) cryptosystem?
A. 56 bits B. 128 bits C. 192 bits D. 256 bits
Answer: A
Under the Windows OS, files have 3 dates attached to them. Pick the 3 timestamps that you’ll find.
A. Date Modified B. Date Copied C. Date Last Accessed D. Date Created
Answer: A, C, D
The smallest area on a drive that data can be written to is a _______while the smallest area on a drive that a file can be written to is a _______.
a. Bit and byte b. Sector and cluster c. Volume and drive d. Memory and disk
Answer: B
The Certified Digital Forensics Examiner exam is taken online through Mile2’s
Assessment and Certification System (“MACS”), which is accessible on your
mile2.com account. The C)DFE exam will take roughly 2 hours and consist of
100 multiple choice questions.
Recover My Email Software recovers deleted email messages and
attachments in all versions of Microsoft Outlook and Outlook Express. It
can also access corrupt Outlook .PST files and corrupt Outlook Express
.DBX files, even if these programs are not installed on the computer.
Source:http://www.recovermyemail.com
2.MailXaminer
Designed from the ground up, as an Email Examination Tool. MailXaminer
supports 20+ email file formats and 750+ MIME types. Thus, leveraging
the examination of 80+ email clients
Source:https://www.mailxaminer.com/
3.eMailTrackerPro
Trace email back to its source and stop spam
Over 97% of all email is
spam. Spam can be harmless but annoying, it can contain viruses or it
can try and trick someone into giving up personal details which in turn
leads to identity fraud. EmailTrackerPro not only offers the ability to trace an email using the email header but it also comes with a spam filter
(advanced edition), which scans each email as it arrives and warns the
user if it's suspected spam. Essentially stopping spam email before it
reaches its intended recipient.
Source:http://www.emailtrackerpro.com
4.Forensic Toolkit (FTK)® | AccessData
FTK provides an intuitive interface for email analysis for forensic professionals. This includes having the ability to parse emails for certain words, header analysis for source IP address, etc. A central feature of FTK, file decryption is arguably the most common use of the software.
Source:https://accessdata.com/
5.Paraben E3:EMX
E3:EMX was designed to be an affordable and comprehensive email
examination tool for local email archives. Paraben has been processing
email since 2002 and has a long history of understanding the issues that
exist with email such as corruption and deleted data recovery. E3:EMX
is the only tool that is priced to be affordable for everyone on a team
processing for forensics or eDiscovery. E3:EMX provides support for over
a dozen email archive types, all with easy-to-use options and automated
deleted data recovery:
Source:https://paraben.com/email-forensics-emx/
6.Stellar Undelete Email for Outlook
Stellar Undelete Email for Outlook is an advanced deleted email recovery software that safely recovers lost or deleted emails from MS Outlook mailbox.'.
Source:https://www.stellarinfo.com
7. Kernel for Outlook PST Repair
Repair corrupted PST files and saves to PST, MBOX, Office 365 and Exchange server
Source:https://www.nucleustechnologies.com
8.Wise Data Recovery
Easily and quickly recover deleted photos, documents, videos, email,
etc. Recover data from local drives, external drive, USB drive, SD card,
mobile phone and other removable devices.
DiskInternals Mail Recovery allows everyone to recover and fix email databases used by Microsoft Outlook, Outlook Express, Windows Mail, Thunderbird and TheBat.
The new version works fully automatically. The tool locates, recovers
and repairs email databases automatically even if the disk is damaged or
inaccessible.
Aid4Mail is a fast, accurate, and easy-to-learn email forensics software
solution. Over the years, it has become an essential tool for computer
forensics and e-discovery professionals around the world.
Source:https://www.aid4mail.com/email-forensics
Email Header Analyzer Tools
12.Email Header Analyzer
This tool will make email headers human readable by parsing them according to RFC 822. Email headers are present on every email you receive via the Internet and can provide valuable diagnostic information like hop delays, anti-spam results and more. If you need help getting copies of your email headers
Source:https://mxtoolbox.com/EmailHeaders.aspx
13.Trace Email (Header Analyzer)
Analyze the email headers and trace the email sender IP location and IP Whois easily.
This plugin will parse .eml or .msg files for email message headers, including x-headers, and will also color IPv4 and IPv6 addresses for ease of readability. Note: requires Sublime Text build 3092 or higher.
