Computer forensics in forensis.pdfVIP

Computer Forensics In Forensis Sean Peisert and Matt Bishop Keith Marzullo Department of Computer Science Dept. of Computer Science Engineering University of California, Davis University of California, San Diego One Shields Ave. 9500 Gilman Dr. #0404 Davis, CA 95616-8562 La Jolla, CA 92093-0404 {peisert,bishop}@ marzullo@ ABSTRACT 1. INTRODUCTION Di↵erent users apply computer forensic systems, models, Who attacked this computer system? What actions did they and terminology in very di↵erent ways. They often make take? What damage did they do? With what degree of cer- incompatible assumptions and reach di↵erent conclusions tainty, and under what assumptions, do we make these asser- about the validity and accuracy of the methods they use to tions? Will these assertions be acceptable in a court? These log, audit, and present forensic data. In fact, it can be hard questions are asked during the computer forensic analysis to say who, if anyone is right. We present several forensic process. They are often hard to answer in practice. Com- systems and discuss situations in which they produce valid puter scientists and forensic practitioners have both made and accurate conclusions and also situations in which their headway on developing functional systems for forensic anal- accuracy is suspect. We also present forensic models and dis- ysis.