Title:   

URL:  

Name:   

URL:  

Abstract:   

This is an open source wiki guide to digital forensics.

Name:   

URL:  

Abstract:   

Computer Forensics World is a growing community of professionals involved in the digital forensics industry. It is an open resource, free for all to access and to use. It strongly encourages the sharing of information and peer-to-peer assistance. To support this initiative, a range of interactive facilities is available, including surveys, forums and posting areas for information and papers.”

Name:   

Duration:  

URL:  

Abstract:   

semi-weekly podcast by Bret Padres and Ovie Carroll, both former agents of the Air Force Office of Special Investigations, since 4 Dec 2005. The show usually features at least one interview, although some shows do not have any. The hosts also discuss current issues in the field and give links to new or interesting web sites.
Each show is about an hour long and published over the weekend. A set of detailed show notes are usually posted to a separate web site.

Name:   

URL:  

Abstract:   

A blog on legal issues, news and best practices relating to the dsicovery of electronically stored information published by the e-discovery Analysis & Technology Group at K&L Gates

Name:   

URL:  

Abstract:   

The Open Source Digital Forensics site is a reference for the use of open source software in digital investigations (a.k.a. digital forensics, computer forensics, incident response). Open source tools may have a legal benefit over closed source tools because they have a documented procedure and allow the investigator to verify that a tool does what it claims.

Name:   

URL:  

Description:   

This website provides, in alphabetical order, a listing of educational institutions that offer courses and degree programs in digital/computer forensics. It includes an extensive digital forensics bibliography, links to digital forensics blogs and wikis, a list of current digital forensics projects, topically organized resources and digital forensics links, a list of digital forensics conferences, and a list of useful digital forensics books. This site is holds of wealth of current, relevant information pertinent to the DRF project.

Name:   

URL:  

Description:   

The Federal Judicial Center is the education and research agency for the federal courts. Congress created the FJC in 1967 to promote improvements in judicial administration in the courts of the United States. This site contains the results of Center research on federal court operations and procedures and court history, as well as selected educational materials produced for judges and court employees.

Name:   

URL:  

Description:   

Forensic psychology programs teach individuals the application of psychology in criminal situations. There are many different tracks for forensic psychology, depending upon which industry niche individuals want to build their careers in. Most programs will consist of a great deal of research and reading, but there are some great hands on opportunities as well. Those who plan to enter these programs should know a bit about what to expect in advance.

Name:   

URL:  

Description:   

The Purdue University Cyber Forensics Lab is a national academic leader in Education & Training, Applied & Basic Research, and Investigative Support of Digital Forensic Science and Cyber Forensics. Our strengths lie in the applied research and technological solutions for the technical and theoretical challenges that exist in our specific domains. Our involvement with Local, State, and Federal Law Enforcement Agencies, the Intelligence Community, and other Private Entities keeps us on the cutting edge of identifying and engaging future trends and threats.

Name:   

Duration:  

URL:  

Description:   

The SANS Computer Forensics and e-Discovery Community offers digital forensics professionals an opportunity to learn, discuss, and share current developments in the field. It also provides information regarding forensics training, certification, and events. This site includes webcasts about current digital forensics issues and a blog.

Name:   

URL:  

Description:   

The UBC Law Library supports the study, reference, and research needs of the students and faculty of the Faculty of Law, and other members of the University community. As well, any person may use library resources for study and research in the Library.

The Law Library has a research collection of approximately 225,000 volumes. Primary and secondary legal materials are acquired from the major common law jurisdictions of the world: Canada, the United States, the United Kingdom, Australia, New Zealand, as well as materials from other selected jurisdictions such as the European Community and the Pacific Rim. While the emphasis is on English language materials from common law jurisdictions, civil law materials from Quebec, in both English and French are collected, as well as comparative and international law materials.

Name:   

URL:  

Description:   

This program provides an education in the area of computer forensics and e-discovery). It equips students to conduct forensic investigations (e.g., managing evidence) as part of investigatory teams and to present the results of analyses as part of internal and external audits, in cyber investigation reports and in legal settings.

Name:   

URL:  

Name:   

URL:  

Name:   

URL:  

Name:   

URL:  

Name:   

URL:  

Name:   

URL:  

Name:   

URL:  

Description:   

The Computer Crime and Intellectual Property Section (CCIPS) is responsible for implementing the Department's national strategies in combating computer and intellectual property crimes worldwide. The Computer Crime Initiative is a comprehensive program designed to combat electronic penetrations, data thefts, and cyberattacks on critical information systems. CCIPS prevents, investigates, and prosecutes computer crimes by working with other government agencies, the private sector, academic institutions, and foreign counterparts. Section attorneys work to improve the domestic and international infrastructure-legal, technological, and operational-to pursue network criminals most effectively. The Section's enforcement responsibilities against intellectual property crimes are similarly multi-faceted. Intellectual Property (IP) has become one of the principal U.S. economic engines, and the nation is a target of choice for thieves of material protected by copyright, trademark, or trade-secret designation. In pursuing all these goals, CCIPS attorneys regularly run complex investigations, resolve unique legal and investigative issues raised by emerging computer and telecommunications technologies; litigate cases; provide litigation support to other prosecutors; train federal, state, and local law enforcement personnel; comment on and propose legislation; and initiate and participate in international efforts to combat computer and intellectual property crime.

Name:   

URL:  

Description:   

“The Defense Computer Forensics Laboratory (DCFL) is a world class facility providing comprehensive evidentiary analysis of material. The lab provides services to the Defense Criminal Investigative Organizations and other lab customers and helps efficiently and effectively prove or disprove allegations being investigated.

DCFL has organized digital forensic examinations within an industrial process that is unmatched elsewhere in terms of its scope. It is accredited by the American Society of Crime Lab Directors (ASCLD/LAB), the preeminent authority for accredited crime labs in the United States. The lab’s prime focus is on intrusions, national security cases and Special Access Program support.

In Fiscal Year 2007, the lab processed 171 terabytes of media, the approximate equivalent of 17 Libraries of Congress-worth of information. This media, part of the year’s 758 cases processed, included information from criminal, counterintelligence, data recovery, and trial support cases.”

Name:   

URL:  

Description:   

An RCFL is a one stop, full service forensics laboratory and training center devoted entirely to the examination of digital evidence in support of criminal investigations such as terrorism, child pornography, crimes of violence, trade secret theft, theft or destruction to intellectual property, financial crime,property crime, internet crimes, and fraud.

RCFL Examiners combine the talents and experience of federal, state, and local law enforcement agencies. The RCFL's duties may include seizing and collecting digital evidence at a crime scene, conducting an impartial examination of submitted computer evidence, and testifying as required.

The site offers links to all the RCFLs, news updates, a webcast, and downloadable reports.

Name:   

Duration:  

URL:  

Description:   

Interpol has actively been involved for a number of years in combating Information Technology Crime. Rather than ‘re-inventing the wheel’, the Interpol General Secretariat has harnessed the expertise of its members in the field of Information Technology Crime (ITC) through the vehicle of a ‘working party’ or a group of experts. In this instance, the working party consists of the heads or experienced members of national computer crime units. These working parties have been designed to reflect regional expertise and exist in Europe, Asia, the Americas and in Africa. All working parties are in different stages of development. For instance, the European working party meets three times per year and includes 15 countries. It has completed the compilation of the Computer Crime Manual, now called Information Technology Crime Investigation Manual (ITCIM), a best practise guide for the experienced investigator, which is continually updated; in order to be more practical (in terms of its volume) and cost efficient, the manual has been made available on CD; an updated version of the CD is currently under production. The content of the Computer Crime Manual is also being converted into HTML format, and is digitally available via Interpol's restricted website.

Working groups also provide training for digital forensics professionals.

Name:   

URL:  

Description:   

The mission of NW3C is to provide a nationwide support system for agencies involved in the prevention, investigation, and prosecution of economic and high-tech crimes and to support and partner with other appropriate entities in addressing homeland security initiatives, as they relate to economic and high-tech crimes.

We are a congressionally-funded, non-profit corporation whose membership primarily comprises law enforcement agencies, state regulatory bodies with criminal investigative authority, and state and local prosecution offices.

While NW3C has no investigative authority itself, its job is to help law enforcement agencies better understand and utilize tools to combat economic and high-tech crime.

Name:   

URL:  

Description:   

The function of the Investigation Division of the VPD is to investigate all crimes referred to it for further attention. In most cases these will be crimes that have already been investigated to a certain level by the Patrol Division. Detectives may be called out to the scenes of crimes to assist, take over investigations or given the Patrol report for follow-up work. Once assigned, the specialized investigator will use their expertise, knowledge and skills to bring the case to a conclusion.

The Investigation Section is divided into several sections specializing in various crimes or service. The Forensic Services Section is broken up into the Financial Crime Squad with its own Computer Investigative Support Unit, Forensic Firearm & Tool Mark, and the Forensic Identification Squad.

Name:   

Duration:  

URL:  

Description:   

A non-profit corporation, the mission of ICFP is the standardization, education, and foundation of the principles and practices in digital forensics.

Name:   

URL:  

Description:   

IACIS® is an international volunteer non-profit corporation composed of law enforcement professionals dedicated to education in the field of forensic computer science. IACIS members represent Federal, State, Local and International Law Enforcement professionals. Regular IACIS members have been trained in the forensic science of seizing and processing computer systems.

The site includes a code of ethics, procedural guides, and pertinent digital forensics links.

Name:   

URL:  

Description:   

The High Technology Crime Investigation Association (HTCIA) is designed to encourage, promote, aid and effect the voluntary interchange of data, information, experience, ideas and knowledge about methods, processes, and techniques relating to investigations and security in advanced technologies among its membership.

The site offers resources, news, training and seminars as well as a list of computer crime-related links.

Name:   

Duration:  

URL:  

Description:   

"The purpose of this Organisation shall be to provide an international forum for law enforcement agencies to exchange information concerning computer investigation and computer forensic issues." According to the site, their last conference was held in 2007, but documents from the conferences, including video presentations, are only available for download through 2002. The IOCE website nonetheless offers useful guidelines for digital evidence gathering and principles developed to harmonize methods and practices among nations.

Name:   

URL:  

Description:   

The Scientific Working Group on Digital Evidence (SWGDE) brings together organizations actively engaged in the field of digital and multimedia evidence to foster communication and cooperation as well as ensuring quality and consistency within the forensic community.” The site offers downloads of documents that have resulted from SWGDE conferences as well as links and event announcements.

Name:   

URL:  

Description:   

The Scientific Working Group on Imaging Technology (SWGIT), was created to provide leadership to the law enforcement community by developing guidelines for good practices for the use of imaging technologies within the criminal justice system. SWGIT is part of the International Association for Identification.

Documents and guidelines in draft and final form are downloadable from the site.

Name:   

Duration:  

URL:  

Description:   

Unlike other forensic conferences that are limited to law enforcement only or are vendor specific in nature, this conference will be open to everyone currently involved in computer forensics, digital evidence, or anyone having an interest in these rapidly growing fields.”

Conference topics cover a range of the digital disciplines with which DRF is concerned, including: fundamentals of acquisitions, terabyte storage and preparing for it, building a forensics lab, e-discovery, classes on digital law and evidence handling.

The site offers downloadable “Techo Video Whitepapers” on digital forensics topics. While clearly vendor-driven, some of them are applicable to our work in DRF.

Name:   

URL:  

Description:   

Forensics Toolkit is one of the two leading tools for digital forensics investigation.

Name:   

URL:  

Description:   

EnCase Forensic is one of the two leading tools for digital forensics investigation.

Name:   

URL:  

Description:   

F-Response uses a patent-pending process based on well documented industry standards to create a secure, read-only connection between the examiner’s computer and the computer under inspection. It makes the storage devices on the computer under examination completely accessible to the examiner’s computer where they appear as local, raw, physical storage devices.

F-Response was designed to be completely vendor neutral. If your analysis software reads a hard drive, it will work with F-Response.

The F-Response connection is completely read-only, functioning much like a software write blocker. F-Response software protects the remote examiner, because they cannot – even by mistake – alter any data on the computer during the examination.

Name:   

Country:  

Duration:  

URL:  

Description:   

This site contains research information about digital investigations (a.k.a. Digital forensics and computer forensics) and digital evidence. It contains both general research and information about his research.

Name:   

Country:  

URL:  

Description:   

Maintained by the Sedona Canada Working Group, this site contains downloadable case law documents pertaining to examination of electronic evidence and digital forensic collection and preservation, among other topics.

Name:   

Country:  

URL:  

Description:   

A criteria selection for guiding and assuring activities concerned with the analysis of digital evidence, It covers legal, police and operational aspects. It is not a technical manual for computer forensic analysis, it is a criteria-based manual.

Name:   

Country:  

URL:  

Description:   

This site is in support of a meeting and report entitled Computer Forensics and Born-Digital Content in Cultural Heritage Collections. Both are funded by the Andrew W. Mellon Foundation.

Name:   

Country:  

Duration:  

URL:  

Description:   

Mission statement: “CPSR is a public-interest alliance of people concerned about the impact of information and communications technology on society. We work to influence decisions regarding the development and use of computers because those decisions have far-reaching consequences and reflect our basic values and priorities. As experts on ICT issues, CPSR members provide realistic assessments of the power, promise, and limitations of computer technology. As concerned citizens, we direct public attention to critical choices concerning the applications of computing and how those choices affect society.” Their site includes links to legal references, papers, and other resources for exploring computer crime.

Name:   

URL:  

Description:   

DFRWS is dedicated to the sharing of knowledge and ideas about digital forensics research. Ever since it organized the first open workshop devoted to digital forensics in 2001, DFRWS continues to bring academics and practitioners together in an informal environment. As a non-profit, volunteer organization, DFRWS sponsors annual conferences, technical working groups, and challenges to help drive the direction of research and development. Papers presented at the annual conference are reviewed in a double blind process and the accepted papers can be freely downloaded from this site.

Name:   

Country:  

Duration:  

URL:  

Description:   

Simson L. Garfinkel is conducting postdoctoral computer forensics research in association with the Center for Research On Compuation and Society at Harvard University. In the fall of 2005, Garfinkel enlisted the help of three Harvard College Undergraduates: Matt Gline ('06), Alex Dubec ('09), and Chris Stevens ('09). Dubec and Stevens aided Garfinkel in imaging used hard drives acquired from E-bay. Gline conducted research on the preservation and restoration of data in "destroyed" hard drives.

Name:   

Duration:  

URL:  

Description:   

EDRM was created to develop guidelines and standards for e-discovery consumers and providers. Through the group’s creation of the original model, which outlines the key processes and steps involved with e-discovery, to its development of an XML standard so that e-discovery products can interoperate, EDRM has helped e-discovery consumers and providers reduce the cost, time and manual work associated with e-discovery.

In its on-going effort to provide guidelines and standards, EDRM continues to update and expand the original model with six projects for the 2008-2009 year.

The site includes a comprehensive e-discovery glossary, the downloadable reference model, links to the meetings of the EDRM working groups that include downloadable documents from the meetings, webcasts about the projects, and news.

Name:   

Country:  

Duration:  

URL:  

Description:   

This is a comprehensive website on digital forensics that includes downloadable research papers, The Journal of Applied Digital Forensics and E-Discovery, a glossary of terms, topically sorted recent news articles related to digital forensics, facts about digital forensics, a directory of forensics providers, links to forensic software, links to pertinent legal websites and documents (including examples of cases where digital evidence played an essential role), and much more to explore.

Name:   

Country:  

URL:  

Description:   

This site offers multi-jurisdictional case summaries for preservation and spoliation cases, computer forensics protocols, experts, admissibility, and other topics, in downloadable pdf format or html.

Name:   

Country:  

URL:  

Description:   

NCFS assists the criminal justice system with computer crime challenges by conducting research on digital evidence, university courses on digital evidence and digital forensics, and training in digital forensics for local and state law enforcement agencies.

Of particular interest to DRF is their current research, funded by the National Institute of Justice, regarding the Virtual Digital Evidence Lab. The following are portions from the summary of the research on the website:

Currently, the collection, storage, analysis, and presentation of digital evidence occurs in a single geographic location, typically in a small digital evidence lab within the jurisdiction where the electronic crime occurred. This is an inefficient model in that local and state law enforcement agencies typically and unnecessarily duplicate resources that may be available elsewhere. A further problem is that each law enforcement agency must verify and validate examination tools, a process duplicated by all law enforcement agencies for all tools used in digital forensic examinations.

Digital evidence labs of the future will not be constrained to a specific geographic location. Instead we propose the concept of the virtual lab. A virtual lab consists of the tools and resources required for digital forensic examinations, but these resources may be located in various geographic locations, and administered and maintained by different entities. These geographic locations are connected via a high-speed network. Examiners access the virtual lab through a single portal, over the Internet. Examiners can upload evidence for secure storage to one location and analyze the evidence using tools from a second location. Reports could be located at a third location. Prosecutors and attorneys would access the results through the same portal.

The advantages of this new model over the traditional digital evidence lab include:

1. Reducing or eliminating unnecessary duplication of resources (examination machines, digital forensic tools, terabyte storage, secure storage, etc.)
2. Reducing or eliminating unnecessary duplication of tasks (verification and validation of all tools in a single location, etc.).
3. Provide expert assistance through certified digital evidence examiner specialists (e.g., Mac OS X, Solaris, network forensics, etc.).

The largest benefit of virtual labs would be for smaller law enforcement agencies, even more so in rural areas, which often have to decide whether to buy ammunition or computers.”

Name:   

Country:  

URL:  

Description:   

The Center for Education and Research in Information Assurance and Security (CERIAS) is a center for research and education in areas of information security that are crucial to the protection of critical computing and communication infrastructure. CERIAS takes a multidisciplinary approach to digital forensics problems, ranging from purely technical issues (e.g., intrusion detection, network security, etc) to ethical, legal, educational, communicational, linguistic, and economic issues, and the subtle interactions and dependencies among them.

The site offers links, research, news, tools and resources in digital forensics. CERIAS also holds an annual symposium on information security topics, and the site contains downloadable presentations and papers from the conferences.

Name:   

URL:  

Name:   

Country:  

Duration:  

URL:  

Description:   

"The Sedona Conference exists to allow leading jurists, lawyers, experts, academics and others, at the cutting edge of issues in the area of antitrust law, complex litigation, and intellectual property rights, to come together - in conferences and mini-think tanks (Working Groups) - and engage in true dialogue, not debate, all in an effort to move the law forward in a reasoned and just way."

Of particular interest to the DRF project are the Sedona Canada Working Group, the International Electronic Information Management, Discovery and Disclosure Working Group, and the Electronic Document Retention and Production Working Group.

Sedona Canada first met in May of 2006. In January 2008 they released the Sedona Canada Principles, which are recommendations for lawyers, courts, businesses and others who regularly confront e-discovery issues in Canada.

The International Electronic Information Management, Discovery and Disclosure Working Group first met in July of 2005 in Cambridge, England. It serves as a global forum and think tank for sharing information, developing best practices, and advising and educating on matters of national and international law and policy regarding the disclosure/discovery, management, and protection of electronically stored information.

Several sub-teams have been formed, and the group is working to finalize a Global Survey and guidelines and best practices recommendations for dealing with cross-border conflicts. A second annual meeting was held in Madrid in September 2006. The group is currently completing the global survey and the report on cross-border conflicts, to be published later this year.

The Electronic Document Retention and Production Working Group first met in October of 2002, and works toward development of principles and best practices recommendations for electronic document retention and production.

During 2007, The Sedona Principles and The Sedona Guidelines were updated in light of the new United States Federal Rules of Civil Procedure and case law developments, culminating in the publication of The Sedona Principles, Second Edition. This Working Group also released commentaries on Legal Holds, Email Management and Archiving, and Search and Retrieval Methods. During 2008, they have released commentaries on Discovery of Electronically Stored Information Held by Non-Parties and Authentication and Admissibility of Electronic Evidence. Drafting groups are currently working on commentaries on Legacy Data, Preservation of "Not Reasonably Accessible" Electronically Stored Information, Protecting Privilege and Work Product, and E-Discovery Process and Quality Control. The Sedona Conference Collaboration Project is underway to bring together judges, trial lawyers, corporate and government counsel, technical experts, and academics to develop practical tools to reduce adversarial tension, cost, and delay in the pre-trial discovery process.