text:
Edmand Dester Thipursian – [email protected]
Sai Thogarcheti – [email protected]
Abdullah Al Fahad – [email protected]
Chintan Gurjar – [email protected]
Adam Mentsiev – [email protected]
Alams Titus Mammuan – [email protected]
Sai Thogarcheti – [email protected]
Abdullah Al Fahad – [email protected]
Chintan Gurjar – [email protected]
Adam Mentsiev – [email protected]
Alams Titus Mammuan – [email protected]
1. Introduction
Computer technology is the major integral part of everyday human life, and it is growing rapidly, as are computer crimes such as financial fraud, unauthorized intrusion, identity theft and intellectual theft. To counteract those computer-related crimes, Computer Forensics plays a very important role. "Computer Forensics involves obtaining and analysing digital information for use as evidence in civil, criminal or administrative cases (Nelson, B., et al., 2008)".
A Computer Forensic Investigation generally investigates the data which could be taken from computer hard disks or any other storage devices with adherence to standard policies and procedures to determine if those devices have been compromised by unauthorised access or not. Computer Forensics Investigators work as a team to investigate the incident and conduct the forensic analysis by using various methodologies (e.g. Static and Dynamic) and tools (e.g. ProDiscover or Encase) to ensure the computer network system is secure in an organization. A successful Computer Forensic Investigator must be familiar with various laws and regulations related to computer crimes in their country (e.g. Computer Misuse Act 1990, the UK) and various computer operating systems (e.g. Windows, Linux) and network operating systems (e.g. Win NT). According to Nelson, B., et al., (2008), Public Investigations and Private or Corporate Investigations are the two distinctive categories that fall under Computer Forensics Investigations. Public investigations will be conducted by government agencies, and private investigations will be conducted by private computer forensic team. This report will be focused on private investigations, since an incident occurred at a new start-up SME based in Luton.
This report also includes a computer investigation model, data collections and its types, evidence acquisitions, forensics tools, malicious investigation, legal aspects of computer forensics, and finally this report also provides necessary recommendations, countermeasures and policies to ensure this SME will be placed in a secure network environment.
2. Case Study
A new start-up SME (small-medium enterprise) based in Luton with an E-government model has recently begun to notice anomalies in its accounting and product records. It has undertaken an initial check of system log files, and there are a number of suspicious entries and IP addresses with a large amount of data being sent outside the company firewall. They have also recently received a number of customer complaints saying that there is often a strange message displayed during order processing, and they are often re-directed to a payment page that does not look legitimate.
The company makes use of a general purpose eBusiness package (OSCommerce) and has a small team of six IT support professionals, but they do not feel that they have the expertise to carry out a full scale malware/forensic investigation.
As there is increased competition in the hi-tech domain, the company is anxious to ensure that their systems are not being compromised, and they have employed a digital forensic investigator to determine whether any malicious activity has taken place, and to ensure that there is no malware within their systems.
Your task is to investigate the team's suspicions and to suggest to the team how they may be able to disinfect any machines affected with malware, and to ensure that no other machines in their premises or across the network have been infected. The team also wants you to carry out a digital forensics investigation to see whether you can trace the cause of the problems, and if necessary, to prepare a case against the perpetrators.
The company uses Windows Server NT for its servers. Patches are applied by the IT support team on a monthly basis, but the team has noticed that a number of machines do not seem to have been patched.
Your deliverable in this assignment is a 5,000 word report discussing how you would approach the following:
• Malware investigation
• Digital Forensic Investigation
You should discuss a general overview of the methodology that you will use, and provide a reasoned argument as to why the particular methodology chosen is relevant.
You should also discuss the process that you will use to collect evidence and discuss the relevant guidelines that need to be followed when collecting digital evidence.
As a discussion contained within your report, you should also provide a critical evaluation of the existing tools and techniques that are used for digital forensics or malware investigations and evaluate their effectiveness, discussing such issues as consistency of the approaches adopted, the skills needed by the forensic investigators, and the problems related with existing methodologies (especially with respect to the absence of any single common global approach to performing such investigations and the problems that can result when there is a need to perform an investigation that crosses international boundaries).
3. Association of Chief Police Officers (ACPO)
This forensic investigation will be conducted as per Association of Chief Police Officers (ACPO) guidelines and its four principles as well. There are four ACPO principles involved in computer-based electronic evidence. These principles must be followed when a person conducts the Computer Forensic Investigation. The summary of those principles are as follows (ACPO, 2013);
Principle 1: Data stored in a computer or storage media must not be altered or changed, as those data may be later presented in the court.
Principle 2: A person must be competent enough in handling the original data held on a computer or storage media if it is necessary, and he/she also shall be able to give the evidence explaining the relevance and course of their actions.
Principle 3: An audit trail or other documentation of all processes applied to computer-based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.
Principle 4: A person who is responsible for the investigation must have overall responsibility for accounting that the law and the ACPO principles are adhered to.
4. Computer Investigation Model
According to Kruse II, W.G., and Heiser, J.G. (2010), a computer investigation is to identify the evidences, preserve those evidences, extract them, document each and every process, and validate those evidences and to analyse them to find the root cause and by which to provide the recommendations or solutions.
"Computer Forensics is a new field and there is less standardization and consistency across the courts and industry" (US-CERT, 2012). Each computer forensic model is focused on a particular area such as law enforcement or electronic evidence discovery. There is no single digital forensic investigation model that has been universally accepted. However, it was generally accepted that the digital forensic model framework must be flexible, so that it can support any type of incidents and new technologies (Adam, R., 2012).
Kent, K., et.al, (2006) developed a basic digital forensic investigation model called the Four Step Forensics Process (FSFP) with the idea of Venter (2006) that digital forensics investigation can be conducted by even non-technical persons. This model gives more flexibility than any other model so that an organization can adopt the most suitable model based on the situations that occurred. These are the reasons we chose this model for this investigation. FSFP contains the following four basic processes, as shown in the figure:
Figure 1: FSFP Forensic Investigation Model
Source: Kent, K., et.al, (2006)
The "Preserve and Document Evidence" arrow mark indicates that we must preserve and document the all evidences during the course of investigation, as this can be submitted to the court as evidences in some cases. We will discuss each and every process or stage of the FSFP investigation model in following sections.
5. Scope of Investigation
The scopes of the forensic investigations for this case are as follows:
- To identify the malicious activities with respect to 5Ws (Why, When, Where, What, Who).
- To identify the security lapse in their network.
- To find out the impact if the network system was compromised.
- To identify the legal procedures, if needed.
- To provide the remedial action in order to harden the system.
6. Legal Challenges of Investigation
According to Nelson, B., et al., (2008), legal challenges before we start our forensic investigation are as follows:
- Determining whether law enforcement assistance is needed, and if so then they may be available for assistance during the investigation, or else we have to submit the investigation report to them at the end of the investigation.
- Obtaining written permission to conduct the forensic investigation, unless another incident response authorization procedure is present.
- Discussing with the legal advisors to identify the potential issues which can be raised during the improper handling of the investigations.
- Ensuring the clients' confidential and privacy issues are accounted.
7. Initial Preparation
It is obvious that before starting the investigation, we need to have a preparation in order to conduct the investigation efficiently. This is considered a proactive measure of investigation (Murray, 2012). The following steps need to be taken in the preparation stage:
- Gathering all available information from the assessing the incident, such as severity of the incident.
- Identifying the impact of the investigation on the SME business, such as network down time, duration of recovery from the incident, loss of revenue, and loss of confidential information.
- Obtaining information of the networks, network devices such as router, switches, hub, etc., network topology documentation, computers, servers, firewall and network diagram.
- Identifying the external storage devices such as pen drive, flash drive, external hard disk, CD, DVD, memory cards and remote computer.
- Identifying the forensic tools which can be used in this investigation.
- Capturing live network traffic in case the suspicious activities are still running with 'netmon' tools.
- Documenting all the activities during the investigation which may be used in court to verify the course of action that was followed in the investigation.
- Imaging the target devices' hard drive and hashing them with MD5 for data integrity.
8. Collection
"The collection phase is the first phase of this process is to identify, label, record, and acquire data from the possible sources of relevant data, while following guidelines and procedures that preserve the integrity of the data" (CJCSM 6510.01B, 2012). There are two different types of data that can be collected in a computer forensics investigation. They are volatile data and non-volatile data (persistent data). Volatile data is data that exists when the system is on and erased when powered off, e.g. Random Access Memory (RAM), registry and caches. Non-volatile data is data that exists on a system when the power is on or off, e.g. documents in HD. Since volatile data is short-lived, a computer forensic investigator must know the best way to capture it. Evidence can be collected locally or remotely.
8.1 Volatile Data:
The following figure shows how to capture the volatile data. The forensic workstation must be located in same LAN where the target machine, in this case the Windows NT Server, is located. 'Cryptcat' tools can be used in the forensic workstation to listen to the port of the Windows NT server. Create the trusted toolset optical drive in the Windows NT server and open the trusted console cmd.exe and use the following command:
cryptcat <ip address> 6543 -k key
To capture the data at the forensic workstation, we use the following command:
cryptcat -l -p 6543 -k key >> <file name>
Figure 2: Volatile data collection setup
Source: Reino, A., (2012)
The following table shows the Graphic User Interface tools, and their usage and outcome can be used in the computer forensic investigation.
Table 1: Volatile Data Forensic Tools and their usage and outcome
Source: Reino, A., (2012)
We also use various Windows-based tools to capture the volatile data as follows:
HBGray's FastDump – Local Physical memory acquisition.
HBGray's F-Response – Remote physical memory acquisition
ipconfig – Collecting subject system details.
netusers and qusers – Identifying logged-in users
doskey/history – Collecting command history
netfile – Identifying the services and drivers
Finally, collecting the clipboard content is also very important in a computer forensic investigation. More evidence can be found from a machine which is still running, so if the anomalies are still there in the SME, then we can retrieve a lot of important evidence from the running processes, network connection and the data that is stored in the memory. There is a lot of evidence when the machine is in the volatile state, and so it must be ensured that the affected computers are not shut down in order to collect such evidences.
8.2 Non-Volatile Data
Once the volatile data have been captured, then we will look into the non-volatile data. The first step in non-volatile data collection is to copy the content of entire target system. This is also called "forensic imaging". Imaging helps to preserve the original data as evidence without any malfunction or changes in data which occurs during the forensic investigation. Forensic imaging will be created by forensic tools such as EnCase, ProDiscover and FTK. A forensic investigator uses a write blocker to connect to the target system and copy the entire contents of the target drive to another storage device by using any of those forensic tools. Hard drive cloning is nothing but to make a duplicate of the entire system. The difference between forensic imaging and hard drive cloning is that forensic imaging can't be accessed without forensic tools, but hard drive cloning can easily be accessed with a mount drive. Hard drive cloning contains only a raw image, and every bit will be copied, and no other extra content will be added. Forensic imaging contains metadata ie., hashes and timestamps and it compresses all the empty blocks. Forensic imaging will hash with MD5 or SHA-2 to ensure the integrity of digital evidence (Nelson, B., et al., 2008).
Data collection can be done in offline investigation and online investigation. Forensic imaging can be done with offline investigation. Live network traffic can be done with online investigation by using ethereal or Wireshark tools. Firewall logs, antivirus logs, and domain controller logs will be collected for the investigation under the non-volatile data collection. We will also collect the Web server logs, Windows event logs, database logs, IDS logs and application logs. Once we collect all the digital evidences, they must be documented in the chain of the custody log documentation. Chain of the custody log documentation is to maintain the integrity of the evidence from start to end of the investigation until this investigation report will be presented (Nelson, B., et al., 2008).
Before carrying out any further processes, we need to image the disk bit by bit, which will access the entire volume and copy the original media, including the deleted files. After the disk is imaged, we should hash everything which will make sure that the data is authentic and the integrity of the data will be maintained throughout the investigation. The hash values must be recorded in multiple locations and we must ensure that we do not make any changes to the data from the time of collection of the data till the end of the investigation. Most tools help in achieving this by accessing the media in a read-only state (SANS, 2010). Target System Hard drives, External Storage devices, and the Windows NT Server Hard drive must be acquired for the digital forensic investigation in this case.
9. Examination
Once we have gathered all the available evidences, we need to conduct the examination by the help of various computer forensic investigation tools. We also examine the file system, Windows registry, Network and Database forensic examination, as follows:
9.1 Files System Examination
NTFS is the New Technology File System and NTFS Disk is a file. MFT is the Master File Table which contains information about all files and disks, and it is also the first file in NTFS. The records in the MFT are also called metadata. Metadata is data about data (Nelson, B., et. al., 2008). Files can be stored in MFT in two ways: resident and non-resident. A file which is less than 512 bytes can be accommodated in MFT as resident files and a file which is more than 512 bytes can be stored outside the MFT as non-resident files. When a file is deleted in Windows NT, the file will be renamed by OS and moved it to Recycle bin with a unique identity. OS stores information about the original path and original file name in info2 file. But if a file is deleted from the Recycle bin, then associated clusters are marked as available for new data. NTFS is more efficient than FAT, as it is faster in reclaiming its deleted space. NTFS disks are a data stream, which means they can be appended into another existing file. A data stream file can be stored as follows:
C:\echo text_mess > file1.txt:file2.txt
This file can be retrieved by the following command:
C:\more < file1.txt:file2.txt
W2K.Stream and Win2K.Team are viruses which were developed by using a data stream, and they were developed with the intention of altering the original data stream. As an investigator, we must be aware of the Windows file systems FAT and NTFS in depth (Nelson, B., et. al., 2008).
9.2 Windows Registry Examination
According to (Carvey, H., 2005) a registry can be treated as a log file because it contains data that can be retrieved by a forensic investigator the associate key values are called the "Lastwrite" time, which is stored as a FILETIME and considered to be the last modification time of a file. With files it is often difficult to get a precise date and time of file modification, but the Lastwrite shows when the registry was last modified. Fantastic will review some certain steps (Carvey, H., 2005) which are listed below to analyze the windows registry of the organization to ensure the problem within and outside the organization are known and being solved to protect and maintain the company reputation.
Windows registry is an order of databases in a computer used by Microsoft in Windows 98, Windows CE, Windows NT and Windows 2000 to store a user or user application and hardware devices configuration, which is used as a reference point during execution of a program or processes (Windows, 2013). The common structure of the windows registry is divided into "Hives" which are:
- HKEY_CLASSES_ROOT: ensures that required programs are being executed.
- HKEY_CURRENT_USER: contains general information of a user that is currently logged into the system.
- HKEY_LOCAL_MACHINE: contains information about hardware, drives etc. of a system.
- HKEY_USERS: contains all information of users on a particular system.
- HKEY_CURRENT_CONFIG: stores information about the present configuration of the system.
The Windows registry consists of volatile and non-volatile information. This means an investigator must at least be familiar with each meaning and functionality of the hives, keys, data and values of a Window registry before undergoing any forensic investigation of a computer to obtain a successful forensic investigation report.
Autostart Location: is a location in the registry where the applications are set to be launched without a user initiation. With this functionality a malware that affects Luton SME can persistently run when the machine is turned on without a direct user interaction because it was already programed to autostart itself or when a user runs some specific commands or processes.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Image File Execution Option is a Windows registry in which an attacker can use the key for redirection of an application original copy to its trojaned copy (Carvey, H., 2005). Luton SME might be under this attack: a redirect of the customer payment page to an illegitimate one.
A forensics investigator can examine the autostart location to determine if the Luton SME problem results from an action performed by a user, a malware or by an attacker on the organization. According to (Carvey, H., 2005) the reliable way to access the autolocation is using AutoRuns tools from SysInternals.com which can provide listing of autostart locations.
User Activity: action and activities of a user can be investigated in the HKEY_CUREENT_USER hive which is created from HKEY_USER\SID hive. User information is mapped to the HKEY_CURRENT_USER. The NTUSER.DAT holds information about registry specification settings of a user. Examination of this hive will give a forensic investigator a good clue of activities and actions taken by a user.
Most Recent Used (MRU) List: MRU holds recent specific action taken by a user and keeps track of activities for future reference. For example, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU maintains an executed list of commands run by a user. Each executed command in the run box will add a key value entry to the hive, as shown below:
Figure3: Contents of the Explorer\RunMRU key.
Source: Carvey, H., (2005)
A forensic investigator can study this hive to source the lastwrite time of each command from the MRU list as shown above. With this, the SME Luton investigator will be able to analyze from the registry if it was user activity, a malware action or an attack that is affecting the organization.
UserAssist: according to (Carvey, H., 2005) UserAssist which is found under the hives HKEY_CURRENT_USER\Software\Mcirosoft\Windows\CurrentVersion\Explorer\UserAssist consists of two keys that commonly look like globally unique identifiers that keep encrypted records of each object, application, etc. a user has accessed on the system. If an investigator has accessed the encrypted record, which is no longer definitive, it might indicate some action the user did to trigger the Malware through an application or any activity he might have done.
USB removable Storage: according to Farmer, College and Vermont (2008) all devices connected to the system are being maintained in a computer registry under the following key HKEY_LOCAL_MACHINE\System\ControlSet00x\Enum\USBSTOR. The figure below shows an example of drive IDs of a USB thumb drive:
Figure4: Example contents of USBSTOR key, showing device instance IDs.
Source: Carvey, H., (2005)
Using the hives of the mounted drive, an investigator will have a clue when he/she analyzes the device ID content maintained in the registry to know which device was being mounted on the Luton SME organization. With persistent examination of each value key, an investigator can identify removable USB storage devices and map them to the parentidprefix.
Wireless SSIDs: According to (Carvey, H., 2005) SSIDs of wireless networks used on a computer can be found under HKEY_LOCAL_MACHINE\Software\microsoft\WZCSVC\Parameters\Interface. When navigating to key values, they contain subkeys which look like globally unique identifiers, which when opened, an investigator can navigate to the ActiveSettings which reveals each wireless SSID in the form of a binary data type. When right-clicked to modify, it reveals the SSIDs in plain written format. Though IP address and other network information can be found under HKEY_LOCAL_MACHINE\System\Current\ControlSet\Services\TCPIP\Interfaces\GUID, an investigator can use this information to tie a user in the Luton SME organization to a particular timeframe if the person's IP address appears to be discovered under the above Window registry.
Windows registry can also be a vital source of proof in a forensic investigation if the investigator knows where to get available data that can be well presentable to the Luton SME organization. Fantastic has tried to analyze some of the basic Windows registry that might have caused the redirection of its Web page, tracked user activity and all necessary programs a user had executed, devices used on the server or any of the organization's computers, and also revealed the IP address of users.
9.3 Network Forensics Examination
The acquiring, collecting and analyzing of the events that take place in the network is referred to as network forensics. Sometimes it's also known as packet forensics or packet mining. The basic objective of network forensics is the same, which is to collect information about the packets in the network traffic such as the mails, the queries, the browsing of the web content, etc., and keep this information at one source and carry out further inspection (WildPackets, 2010).
Network forensics can be applied in two main ways. The first one is security-related, where a network is monitored for suspicious traffic and any kind of intrusions. It is possible for the attacker to delete all the log files from an infected host, so in this situation the network-based evidence comes to play in the forensics analysis. The second application of network forensics is related to the law enforcement, where the network traffic that has been captured could be worked on to collecting the files that have been transferred through the network, keyword search and analysis of human communication which was done through e-mails or other similar sessions. (Hunt, 2012)
9.3.1 Tools and Techniques of Network Forensics
We can perform any operation with a forensically sound bootable DVD/CD-ROM, USB Flash drive or even a floppy disk. First, we need to dump the memory, and this is preferred to be done with a USB Flash drive with enough size. We must also undertake a risk assessment when we are about to collect volatile data to evaluate if it's safe and relevant to collect such live data, which can be very useful in an investigation. We should use forensics toolkits throughout the process, as this will help meet the requirements of a forensics investigation. These tools should be trusted, and it can be acquired from among the freely distributed ones to the commercial ones. (7safe, 2013)
Some very important and discreet information should be collected from a running machine, with the help of trusted tools such as:
- Process listings.
- Service listings.
- System information.
- Logged on and registered users.
- Network connections.
- Registry information.
- Binary dump of memory.
(7safe, 2013)
There are many different kinds of network forensics tools, each with different functions. Some are just packet sniffers and others deal with identification, fingerprinting, location, mapping, email communications, web services, etc. The table below lists some of the open-source tools that can be used for network forensics and their functionalities. (Hunt, 2012)
Tool | Platform | Web Site | Attributes |
TCPDumpWindump | Unix & Windows | www.tcpdump.org | F |
NetStumbler | Windows | www.netstumbler.com | F |
Wireshark | Unix & Windows | www.wireshark.org | F |
Sleuth Kit | Unix | www.sleuthkit.org | F R C |
Argus | Unix | www.qosient.com/argus | F L |
SNORT | Windows /Unix | www.snort.org | F |
F: Filter & collect; L: Log analysis; R: Reassembly of data stream; C: Correlation of data; A: Application Layer view
Table 2: Network Forensic Tools
Source: (Hunt, 2012)
9.4 Database Forensics Examination
A database is a collection of data or information which is represented in the form of files or a collection of files. Retrieving the data from the database can be done with a set of queries. Database forensics can be defined as the application of computer investigation and the analysis techniques to gather the evidences from the database to present them in a court of law. A forensic investigation needs to be done on the databases, because a database has sensitive data where there is a high chance of a security breach by the intruders to get this personal information.
In the case study it is mentioned that a large amount of data is being sent out of the database, so now the task of the Fantastic team is to perform a forensic investigation on the database with the help of forensic tools. Database forensics focuses on the identification, preservation and analysis of data. According to Khanuja, H.K., and Adane, D.S., (2011), to access the database the users need to get permissions like authorization and authentication from the database servers. Once the authorization is done, only the user can access the data and if intended he/she can alter the data. Now if we check the audit logs of the database, we can get a list of the users who got permissions to access the data. The team needs to look up in the database for the IP addresses which are remotely connected, because there are chances of altering the data by the authorized user or unauthorized user.
According to Dave, P., (2013), with the help of the investigation we can retrace the operations of the DDL (Data Definition Language), which are used to define the database structure, and DML (Data Manipulation Language), which are used for managing the data within the database and can identify if there are any pre and post transactions happened in the database. This investigation can also help us to know if there are any data rows that are deleted by the user intentionally, and is able to recover them, and it also helps us to prove or disprove that a data security breach has occurred within the database, and it helps us in determining the scope of the intrusion of database. Windows forensic tool v1.0.03 is used with a customized configuration file which will execute DMV (Distributed Management Views) and DBCC (Database Consistency Checker) commands to gather the data which is sufficient to prove or disapprove the intrusion as stated earlier (Fowler, K., 2007).
10. Analysis
Initially we need to analyze the evidences which we gathered and examined. We will look into the data to see whether any hidden files or unusual files are presented or not. Then if there is any unusual process running and if there are any sockets opened unusually. We will also look if any application requests occurred unusually. Then we will check the account, whether any unusual account is presented or not. We will also find the patching level system, whether it is been updated or not. By the outcome of those analyses, we will come to know whether any malicious activities are presented or not. Then we will develop a further strategy for the forensic investigation, such as complete analysis of memory, complete analysis of file systems, event correlation, and timeline analysis (Nelson, B., et. al., 2008). According to this case study, there are malicious activities present in their network system and it is also been confirmed by our initial analysis. In order to find the malicious code capabilities and its aim, we have to do the malware executable analysis. The malware executable analysis can be divided into Static Analysis and Behavioural Analysis.
11. Malware Analysis
According to the report of the Verizon "2012 Data Breach Investigations Report", 99% of the vulnerabilities have led to the data being compromised for a few days or less, while 85% took several weeks to investigate. This is a serious challenge for the security departments, as attackers get a lot of time to work in a compromised environment. More "free time" leads to more stolen data and more serious damage. This is mainly due to the fact that current security measures are not intended to deal with more complex threats (2012 Data Breach Investigations Report, Verizon, 2012).
The point when performing a malware crime scene investigation: certain parts of a Windows PC are well on the way to hold data identifying with the malware installation and utilization. Legal examinations of the traded off frameworks incorporated an audit of record hash values, signature confuses, packed files, collision logs, System Restore points, and the pagefile. A worldly investigation of the File Systems and Event Logs may be directed to distinguish exercises around the time the malware was animated on the system. Advanced specialists additionally may as well review the Registry for unordinary entrances such as in Autostart areas, and adjustments around the time of the malware installation. Keyword hunts may be performed to discover references to malware and associations with other bargained hosts. Normal attack vectors are recognized, incorporating email attachments, Web browsing history, and unauthorized logons.
According to Syngress "Malware Forensics – Investigating and Analyzing Malicious Code, 2003" there should be done an investigation based on the following:
- Search for Known Malware
- Review Installed Programs
- Examine Prefetch
- Inspect Executables
- Review Auto-start
- Review Scheduled Jobs
- Examine Logs
- Review User Accounts
- Examine File System
- Examine Registry
- Restore Points
- Keyword Searching
Before starting the malware analysis, we need to create the malware analysis environment such as VMware and Norton Ghost. VMware is virtual based malware analysis environment and Norton Ghost is dedicated malware analysis environment.
11.1 Static Analysis
Static analysis is the type of malware analysis which is used to conduct the analysis without running the malware programming. Static analysis is better than Dynamic analysis in terms of safe analysis. Since the malware program is not running, there is no fear of deleting or changing the files. It is always best to do the static malware analysis in a different operating system, where the malware is not designed to run or impact. Because an investigator can accidently double click the malware program to run, and it will affect the system. There are so many ways to do the static analysis such as File Fingerprinting, Virus Scanning, Packer Detection, Strings, Inside the FE File Format and Disassembly (Kendall, K., 2007).
11.2 Dynamic Analysis
Dynamic Analysis is the type of malware analysis where malware code runs and observes its behaviour. It is also called Behaviour Malware Analysis. Dynamic Analysis is not safe to conduct unless we are ready to sacrifice the malware analysis environment. We can analyze the malware by simply monitoring the behaviour of the malware functions. There are many tools to conduct the dynamic malware analysis, but Process Monitor from SysInternals and Wireshark are the most used and freeware tools (Kendall, K., 2007).
According to Kendall, K., (2007), in almost all malware cases, a simple static and dynamic malware analysis will find all the answers which will be required by the malware investigators for the particular malware code.
12. Findings
After our investigation, we summarize our findings as follows:
- Identified the attacker's persistent remote access to the company's computers.
- The forensic analysis identified that the systems had been compromised.
- OS patches were not installed in some systems.
- Suspected malware was found in compromised system.
- Identification of that malware and its functionality & aim of malware led us conclude that it is 'spamming' malware.
- Determined the attackers had access to the client's systems using the malware by supplying in appropriate website link for payment gateway.
13. Remedial Actions
There were considered above the most common ways of malicious software into the network. From the foregoing, it is possible to make two important conclusions:
- Most of the described methods are somehow related to the human factor, therefore, training of employees and periodic training on security will enhance the network security;
- Frequent cases of hacking legitimate sites lead to the fact that even a competent user can infect his computer. Therefore, we come to the fore classical measures of protection: antivirus software, the timely installation of last updates, and monitoring the Internet traffic.
According to Shiner, D.L.D., and Cross, M., (2002), there are major countermeasures to protect against malware:
- Authentication and password protection
- Antivirus software
- Firewalls (hardware or software)
- DMZ (demilitarized zone)
- IDS (Intrusion Detection System)
- Packet filters
- Routers and switches
- Proxy servers
- VPN (Virtual Private Networks)
- Logging and audit
- Access control time
- Proprietary software/hardware is not available in the public domain
In our case, the most useful are the following:
- Firewall
- Logging and Audit
Firewall checks all Web pages entering to the user's computer. Each Web page is intercepted and analyzed by the firewall for malicious code. If a Web page accessed by the user contains malicious code, access to it is blocked. At the same time, it displays a notification that the requested page is infected. If the Web page does not contain malicious code, it immediately becomes available to the user.
By logging, we meant collecting and storing information about events that occur in the information system. For example, who and when tried to log on to the system and how this attempt ended, who and what information resources were used, what and who modified information resources, and many others.
Audit is an analysis of the accumulated data, conducted promptly, almost in real time (Shiner, D.L.D., and Cross, M., 2002). Implementation of logging and audit has the following main objectives:
- Accountability of users and administrators;
- Providing opportunities for reconstruction of events;
- Detection attempts violations of information security;
- Providing information to identify and analyze problems.
13.1 Security Policies
The fullest criteria for evaluating organizational level security mechanisms are presented in the international standard ISO 17799: Code of Practice for Information Security Management, adopted in 2000. ISO 17799 is the international version of the British Standard BS 7799. ISO 17799 contains practical rules for information security management and can be used as criteria for assessing the organizational level security mechanisms, including administrative, procedural and physical security measures (ISO/IEC 17799:2005).
Practical rules are divided into the following sections:
- security policy;
- organization of information security;
- asset management;
- human resources security;
- physical and environmental security;
- communications and operations management;
- access control;
- information systems acquisition, development and maintenance;
- information security incident management;
- business continuity management;
- compliance.
These sections describe the organizational level security mechanisms currently implemented in government and commercial organizations worldwide (ISO1799, 2005).
Several questions arise after considering the above need for some combination of business requirements for the Internet. What software and hardware and organizational measures must be implemented to meet the needs of the organization? What is the risk? What should be the ethical standards for the organization to carry out their tasks with the help of the Internet? Who should be responsible for that? The basis of the answers to these questions is a conceptual security policy for the organization (Swanson, M., 2001).
The next section contains fragments of hypothetical security policies of safe work in the Internet. These fragments were designed based on the analysis of the major types of safety equipment.
Security policies can be divided into two categories: technical policy implemented using hardware and software, and administrative policy, performed by the people using the system and the people running it (Swanson, M., 2001).
Common Security Policy for an Organisation:
- Any information system must have a security policy
- The security policy must be approved by the management of the organization
- The security policy should reach out to all employees in a simple and understandable form
- The security policy should include:
- definition of information security, its main objectives and its scope as well as its importance as a mechanism, which allows collectively use the information
- the position of leadership on the purposes and principles of information security
- identify general and specific responsibilities for providing information security
- links to documents related to security policies, such as detailed safety guidelines or rules for users
- The security policy must satisfy certain requirements:
- correspond to national and international legislation
- contain provisions for training personnel on security issues
- include instructions of detection and prevention of malicious software
- define the consequences of violations of the security policy
- consider business continuity requirements
- There must be defined a person who is responsible for the procedure of reviewing and updating the provisions of the security policy
- Revision of the security policy must be carried out as a result of the following cases:
- changes in the organizational infrastructure of the organization
- changes in the technical infrastructure of the organization
- Subject to regular review of security policy are the following characteristics:
- the cost and impact of countermeasures on the organization's performance(ISO/IEC 17799:2005)
14. Reporting
A forensic report highlights the evidences in the court and it also helps for gathering more evidences and can be used in court hearings. The report must contain the investigation's scope. A computer forensic investigator must be aware of the type of computer forensic reporting such as formal report, written report, verbal report and examination plan. A formal report contains the facts from the investigation findings. A written report is like a declaration or an affidavit which can be sworn to under oath so that it must be clear, precise and detailed. A verbal report is less structured and is a preliminary report that addresses the areas of investigation not covered yet. An examination plan is a structured document that helps the investigator to understand the questions to be expected when he/she is justifying the evidences. An examination plan also helps the attorney to understand the terms and functions which were used in computer forensic investigation (Nelson, B., et al., 2008). Generally a computer forensic report contains the following functions:
- Purpose of the Report
- Author of the Report
- Incident Summary
- Evidence
- Analysis
- Conclusions
- Supporting Documents
There are many forensic tools to generate the forensic investigation report such as ProDiscover, FTK and EnCase (Nelson, B., et al., 2008).
15. Conclusions
This report contains how to conduct the Computer Forensic Investigation and Malware Investigation in various methods and using various tools. This report also contains the ACPO's four principal and IS017799 security policy procedures which must be implemented in every organization to improve the security network architecture. It also analysed the First Four Step Forensic Investigation model and why we chose this model to conduct the forensic investigation for this case. It also has important preparation steps before starting the investigation. Then this report has an analysis part where we analysed the data which we gathered by various methods to yield the findings. This report also has the recommendations to avoid the security breach in future.
Digital forensic investigation is a challenging process, because every incident differs from other incidents. A computer forensic investigator must be competent enough in Technical and Legal to conduct the investigation. Since the evidence which is provided by a computer forensic investigator can be an important part the case, the investigation report must be precise and in detail.
16. References
- 7safe, (2013) "Good Practice Guide for Computer-Based Electronic Evidence", Available at: http://www.7safe.com/electronic_evidence/ACPO_guidelines_computer_evidence.pdf, Accessed on 12th January 2014.
- ACPO (2013), "Good Practice Guide for Computer-Based Electronic Evidence", V4.0
- Adams, R., (2012), "Evidence and Digital Forensics", Australian Security Magazine, Available at http://www.australiansecuritymagazine.com.au/, accessed on 31st December 2013.
- Aquilina, M.J., (2003), "Malware Forensics, Investigating and Analyzing Malicious Code", Syngress,
- Carvey, H., (2005), "Windows Forensics and Incident Recovery", Boston: Pearson Education Inc.
- Case studies, PwC CybercrimeUS Center of Excellence, PricewaterhouseCoopers LLP, 2010, http://www.pwc.com/us/en/forensic-services/assets/cyber-crime-data-breach-case-studies.pdf
- CJCSM 6510.01B, 2012, "Cyber Incident Handling Program", Chairman of the Joint Chiefs of Staff Manual, J6.
- Dave, P., (2013), "SQL – A Career in Database Forensics!, Available at http://blog.sqlauthority.com/2013/12/24/sql-a-career-in-database-forensics/, accessed on 2nd January 2014.
- Fowler, K., (2007), "Forensic Analysis of a SQL Server 2005 Database Server", Available at https://www.sans.org/reading-room/whitepapers/application/forensic-analysis-sql-server-2005-database-server-1906, accessed on 2nd January 2014.
- Han, D.R., (2012), "SME Cyber security and the Three Little Pigs", ISACA journal, Vol 6, available at www.isaca.org/journal, accessed on 05th Jan 2014
- Hunt, R., (2012), "New Developments In Network Forensics – Tools and Techniques", New Zealand, IEEE, pp. 377 – 381.
- ISO/IEC 17799:2005, (2005), "Information technology — Security techniques — Code of practice for information security management", Available at http://www.iso.org/iso/iso_catalogue/catalogue_ics/catalogue_detail_ics.htm?csnumber=39612, Accessed on 10th January 2014.
- ISO1799, (2005), "ISO 17799 Information and Resource Portal", Available at http://17799.denialinfo.com/ , Accessed on 10th January 2014.
- Kendall, K,(2007), "Practical Malware Analysis", Mandiant Intelligent Information Security, Available at http://www.blackhat.com/presentations/bh-dc-07/Kendall_McMillan/Paper/bh-dc-07-Kendall_McMillan-WP.pdf, Accessed on 10th January 2014.
- Kent, K, and Grance, T., (2006), "Guide to Integrating Forensic Techniques into Incident Response", Available at: http://csrc.nist.gov/publications/nistpubs/800-86/SP800-86.pdf, Accessed on 13th January 2014.
- Kent, K., et.al., (2006). "Guide to Integrating Forensic Techniques into Incident Response", National Institute of Standards and Technology (Ed.) (Vol. 800-86): U.S. Department of Commerce.
- Khanuja, H.K., and Adane, D.S., (2011), "Database Security Threats and Challenges in Database Forensic: A Survey", IPCSIT vol.20 (2011), Singapore: IACSIT Press.
- Kruse II, W.G., and Heiser, J.G. (2010), "Computer Forensics: Incident Response Essentials", 14th edn, Indianapolis: Pearson Education
- Microsoft, (2013), "Windows Registry Information for Advanced Users" Available at https://support.microsoft.com/kb/256986, Accessed on 10th January 2014
- Nelson, B., et. al., (2008), "Guide to Computer Forensics and Investigations", 3rdedn, Massachusetts: Course Technology.
- Nolan, Richard, et. al. Forensics Guide to Incident Response for Technical Staff. http://www.cert.org/archive/pdf/FRGCF_v1.3.pdf
- Reino, A. (2012), "Forensics of a Windows System", Roche.
- SANS, (2010), "Integrating Forensic Investigation Methodology into eDiscovery", Available at: https://www.sans.org/reading-room/whitepapers/incident/integrating-forensic, Accessed on 13th January 2014.
- Shiner, D.L.D., and Cross, M., (2002), " Scene of the Cybercrime", 2nd edn, Syncress: Burlington.
- Swanson, M., (2001), "NIST Security Self-Assessment Guide for Information Technology Systems" Available at http://www.itl.nist.gov/lab/bulletns/bltnsep01.htm, Accessed on 9th January 2014.
- US-CERT, (2012), "Computer Forensics", Available at http://www.us-cert.gov/reading-room/forensics.pdf, accessed on 30th December 2013.
- Venter, J. P., (2006), "Process Flows for Cyber Forensics Training and Operations", Available at http://researchspace.csir.co.za/dspace/bitstream/10204/1073/1/Venter_2006.pdf, accessed on 30th December 2013.
- Wong, L.W.,(2006) "Forensic Analysis of the Windows Registry" Available at http://www.forensicfocus.com/downloads/forensic-analysis-windows-registry.pdf Accessed on 10th January 2014
From : https://resources.infosecinstitute.com/computer-forensics-investigation-case-study/#gref


text:
Construction Cleaning Lethbridge
Whether you are building a new office or remodeling an existing one in the Lethbridge area, it's an extremely exciting time up until you see how much dust and debris gets created by the contractors carrying out the construction. It can sometimes feel so overwhelming that you wonder if your new home or office will ever be clean. The good news that with the help of a professional cleaning company, the mess creating by the construction is no big deal.
No matter where you are in the construction process, Universal Services Ltd.'s professional cleaners are available to step in at any time to get rid of the dust and debris that's accumulating onsite to freshen it up. Typically, cleaning companies only come in to clean when construction is complete, but we believe that you and your contractors deserve a clean space to work in. After all, cleanliness is one of the easiest way to promote productivity and minimize any hazards.
For many years, Universal Services Ltd. has been providing exceptional cleaning services to all manner of projects in the Lethbridge area. Whether you have just begun or about to wind down, our construction cleaning services continue to rank among the best in the area thanks to our team's dedication and high standards. No detail is too small and no project is too large for us to handle. Our team is familiar with all modern equipment and the highest-quality cleaning products to make sure construction dust, dirt and other clutter is gone as efficiently as possible. Our team also is familiar with the practices of contractors, so we know the best way to respond to any given task that's been completed.
Whether you need a last minute clean up or you want daily construction clean ups, we can handle it. Just give Universal Services Ltd. a call today to get a free estimate on the construction cleaning service you have in mind.
How We Can Help
Universal Services Ltd.'s biggest asset has always been our flexibility. All of our cleaning services maintain a certain level of flexibility to better serve our clients, but they really come in handy when we are dealing with construction cleaning. Schedules are constantly changing whenever construction is involved, which is why we make sure that our crews are available on short notice for any size task.
All you have to do is give us a call and let us know the latest and we'll adapt to your schedule. And when we do, we can assist you with:
- Floor cleaning, waxing and buffing
- Carpet cleaning
- Window, windowsill and frame cleaning
- Debris and gravel removal
- Pressure washing
- High dust removal
- Full disinfection of kitchens and bathrooms
- Washing walls, doors, baseboards and ceilings
Again, what sets Universal Services Ltd. apart from the competition is our flexibility and it goes far beyond our schedule. We can adapt our construction cleaning plans, techniques and materials used to meet your every need. Just let us know what you want and we will be there to get the job done exactly the way you want it done.
Contact Us Today
To get the best construction cleaning services in the Lethbridge area, contact Universal Services Ltd. today.

subset: commoncrawl


text:
Tyre Services
Tyre Fitting
Need tyres fitted in Young? At Young Tyrepower our tyre experts can assist you.
Free Tyre Safety Check
Tyres are your vehicle's only point of contact with the road, get a free tyre check from Young Tyrepower today for peace of mind.
Puncture Repairs
Have you had a tyre puncture? Young Tyrepower in Young can fix or replace your tyre for you.
Agricultural Tyres
At Young Tyrepower, we know our area and stock the right brands and tyres that will keep you rolling.
Bobcat Tyres
Our qualified technicians can provide you with trusted advice on earthmoving tyres to ensure you find a bobcat tyre that's right for the job.
Earth Moving Tyres
Young Tyrepower is your one stop shop for earth moving tyres in Young.
Industrial Tyres
Looking for industrial tyres? Our knowledgeable team can assist you in finding the right tyres for your business.
Light Truck Tyres
Our knowledgeable team can assist you in finding the right light truck tyre for the job.
Trailer / Caravan Tyres and Accessories
Trailer and caravan tyres have a very different job to do than the tyres on your tow vehicle. We specialise in tyres for tow applications.
Tyre Recycling
Young Tyrepower is committed to supporting Tyre Stewardship Australia to promote the increase in environmentally sustainable collection and recycling


text:
Featured Instructor
User Login
New User Registration
Forgot Your Password?
Can't Log in?
Another Way to Log in
Your Email Address:
Password (case sensitive):
Live Webinar Schedule
PDH Course Search
Enter a Keyword, Phrase or Course No. (e.g. C101)
Engineering Jobs Board
Positions Available
Advertise Your Jobs
Free Resume Builder
Special Referral Discount
on all PDH online courses. Click
to get coupon code.
Free PDH Course
Free PDH Tracking
Free PDH Reporting
Corporate Discount
Approved Provider
Money-Back Guarantee
State PDH Requirements
PDH Record Form
Help Center
Our Premier Partners
Technical Resource
Engineering Forums
Free Technical Manuals
Free Publications
Free Engineering Software
Free Business Forms
User Feedback
Love the format.
B. Guenther, PE, Oklahoma
Excellent coverage in a few pages...
R. Lewis, Ph.D., PE, Texas
Was quick and easy access. Very convenient.
W. Hamilton, PE, Florida
Very informative course!
C. Horn, PE, Alabama
Good content, good format and great topics. Thank you.
L. Carpenter, PE, Arizona
I will use your program for all my future PDH needs.
W. Beard, Jr., PE, North Carolina
We are a Board-Approved Continuing Education Provider
for Professional Engineers, Architects, Geologists, and Land Surveyors
FL PE Board Approved CE Provider
FL PLS Board Approved
CE Provider #0002496
MD PE & PLS Board Approved CPC Provider;
NJ PE & PLS Board Approved CPC Provider
NC PE & PLS Board Approved CPC Sponsor
Board Approved CE Sponsor;
IN PE Board Approved Provider per IC 25-1-4-0.2; MO TX VT PLS Board Approved CE Provider
Our courses have been accepted in AK, AL, AR, DE, FL, GA, IA, ID, IL, IN, KS, KY, LA, MD, ME, MI, MN, MO, MS, MT, NC, ND, NE, NH, NJ, NM, NY, NV, OH, OK, OR, PA, SC, SD, TN, TX, UT, VA, VT, WI, WV, WY and ...
more states
R225 - Florida Laws and Rules for Engineers (Biennium Cycle 2023-2025)
R181 - Florida Engineers: Professional Ethics (Biennium Cycle 2023-2025)
R503 - Sexual Harassment Prevention Training - Illinois
F100 - Life Safety Code 101
R902 - Indiana Laws and Rules for Professional Engineers
OH PE & LS: The Ohio Board accepts only 6 PDHs from self-paced online courses in each renewal cycle. The remaining 24 PDHs must be obtained through tracked/monitored courses. Check out our "
Live Webinars
" that meet the Ohio Board requirement.
For your convenience, we offer live web seminars on weekdays and weekends, including evenings.
We also offer "
Timed & Monitored Online Courses
" that meet the Ohio Board requirement.
Taking a course at our site is fast and easy! You can preview the course content before your purchase, and print the course material and quiz for offline study. Here is a detailed step-by-step guide:
PDH Online Course Library
Over 3,500 Courses & Growing!
General Topics
Ethics, Board Laws & Rules
Renewable Energy and Sustainability
Architectural Engineering
Green Building & Construction Technology
Bridge, Roadway & Transportation
Chemical & Petroleum Engineering
Human Resources & Leadership
Flood, Hydrology & Hydraulics
Civil & Environmental Engineering
Legal Issues & Risk Management
Water, Wastewater & Stormwater
Electrical & Computer Engineering
Life Safety and Building Codes
HVAC, Plumbing & Fire Protection
Geotechnical Engineering
ADA, EPA, FEMA and OSHA Regulations
Pumps, Valves & Piping Systems
Historical Architecture and Engineering
New York Approved Courses for Architects
Computer & Software Application
Material Science & Engineering
Florida Approved Courses for PE
Control System and Instrumentation
Mechanical & Industrial Engineering
Indiana Approved Courses for PE
Engineering & Environmental Geology
Pharmaceutical & Biotech Engineering
Maryland Approved Courses for PE & LS**
ABIH Approved Courses for CM Points
Power Systems & Nuclear Engineering
New Jersey Approved Courses for PE
Landscape Architecture
Structural Engineering
New York Approved Courses for PE & LS
On-Demand Video Courses
Surveying & Mapping
Ohio Approved Courses for PE & LS
Timed & Monitored Online Courses
Health, Safety & Welfare
Webinars Accepted by All States
PDH Course Package Deals
Project, Cost & Business Management
Free Course & Special Offers
All Courses - Grouped by PDH
* IA PE, WI PE and NY PE/LS must complete 20, 13 and 18/16 hours, respectively, through live interactive courses in each renewal cycle.
** PE in Indiana and PE & LS in Florida, Maryland, New Jersey and New York are required to take courses through approved providers only.
Ohio PE & LS are required to complete at least 24 hours in live webinars or timed & monitored online courses in each renewal cycle.
State-specific courses for land surveyors are listed under Surveying & Mapping category.
Benefits of Teaching for
Worldwide Exposure
Recognition from Peers
Up to 30% Revenue Sharing
Become a PDHonline Provider Today
Benefits of Affiliating with
Increased Web Traffic
More Value to Membership
Discount for Employees
Up to 10% Revenue Sharing
Become a PDHonline Affiliate Today
Benefits of Learning on
Available 24/7
Unlimited Open Book Exams
Instant Certificate of Completion
Free PDH Tracking & Reporting
Become a PDHonline User Today
Civil and Environmental Engineering Courses
Electrical and Mechanical Engineering Courses
Engineering and Surveying Courses
Architectural and Structural Engineering Courses
Laws, Rules, Ethics and Project Management Courses
Our courses are accepted by the following state licensing boards & organizations
Alabama AL
Illinois IL
Maryland MD
Nebraska NE
Oklahoma OK
Texas TX
Arkansas AR
Iowa IA
Massachusetts* MA
New Hampshire NH
Oregon OR
Utah UT
Delaware DE
Kansas KS
Minnesota MN
New Jersey NJ
Rhode Island* RI
Vermont* VT
Florida FL
Kentucky* KY
Mississippi MS
New Mexico NM
South Carolina SC
Utah UT
Georgia GA
Louisiana LA
Missouri MO
New York NY
Pennsylvania PA
West Virginia WV
Idaho ID
Maine ME
Montana MT
North Carolina NC
Tennessee TN
Wyoming WY
*RA board only **LS & RA boards only ***civil structural mechanical electrical chemical engineer architect surveyor **** ASCE NSPE ASHRAE IEEE ASME ASEE ACI ACEC AISI AIA PCA AWC APA AISC AASHTO AWS AWPA CRSI PTI NCEES SEA OSHA FEMA EPA USGS USACE EDUCATOR CEU PDH ENGINEER PDH COURSE NY CEP CPD PDU CPC LIVE COURSE SEMINAR ONLINE


text:
STATUS: Just got the new Korean copies for ENCHANTED, INC. Man, I'm just so tickled because I think the cover is darling.
Random House JoongAng/Korea
What's playing on the iPod right now? WALKING IN MEMPHIS by Mark Cohn
I want to say first off that I can completely sympathize with authors concerning the trauma involved in having a headshot taken.
My current picture on my website (see it here) was taken during the Denver Magazine 5280 photo shoot for the profile they did on me. Great photographer. Good lighting. But I'm telling you, that young lad took over 200 pictures of me and when it was time to select a photo for the magazine spread, there were only two shots I remotely liked. I'm not that photogenic super close up.
So I feel your pain. Get out the photoshop, baby!
But I want to caution authors to resist that particular temptation. Why? Because I think you should look like your author shot. There is nothing more startling than meeting an author in person and he or she looks nothing like the photo and if the photo is better than the in-person moment, well, it's downright awkward. I'm as politically correct as the next person but it sometimes hard to hide the shock.
And that's certainly not the response you want your fans to have when meeting you.
Now I do think you should like your author shot and redo it until you get it right (however you define that.) You have to live with it after all.
If you detest the whole author photo thing, than you can get creative. I think it's Kim Harrison whose author photo consists of a long shot of her from behind walking down a wooded road. I love that shot. Very dramatic and mood setting which kind of fits the books she writes.
No contract ever stipulates that it has to be a headshot of the author (at least none that I've seen.) I've also seen great author shots where the writer is anonymous because they are wearing a hat dipped low or something similar.
Photoshop is not the only option.


text:
Artist Robert Indiana says love hurt him.
Love, as in his world-famous LOVE image -- stacked letters with a tilted O -- that became a symbol of the "make love, not war" 1960s counterculture revolution and as the centerpiece of Philadelphia's famous Center City park.
That one image eclipsed all his other work. But now the artist's first major retrospective titled "Robert Indiana: Beyond LOVE" at the Whitney Museum of American Art that opened Thursday could change that.
"It's a dream come true, a little late," Indiana, who turned 85 this month, said in an interview at the Manhattan, N.Y. museum this week surrounded by 95 works he created over the past five decades.
The image both "blessed and cursed" him, said Barbara Haskell, the exhibition's curator. It's so famous and so ubiquitous -- reproduced on everything from coffee cups to T-shirts without Indiana's permission -- that "it has obscured the depth and breadth of everything else he did."
His paintings and sculptures are filled with images of highway signs, roulette wheels, circles, stars within circles, numbers and simple words -- Eat, Die, Hug.
"The subtext of what he does is very profound. He really touches on issues of survival, forgiveness love and racial injustice," Haskell said.
Breaking news and the stories that matter to your neighborhood.
Indiana, who sat in a wheelchair but mostly uses a cane, said a favorite piece in the show is his monumental diptych EAT/DIE, an homage to his mother whose dying words to him were "Have you had enough to eat?" he said.
Born Robert Clark in 1928, Indiana changed his name in 1958 in honor of his home state. He was closely associated with the leading pop artists of the 1960s and first received acclaim when Alfred Barr, director of the Museum of Modern Art, purchased his "American Dream 1" in 1961.
But Haskell said Indiana's work is more conceptually layered than that of a Roy Lichtenstein comic book image or an Andy Warhol Marilyn Monroe silkscreen.
"There are myriad interpretations you can make on any one of his works," she said.
Among his earliest works are anthropomorphic figures made from wood salvaged from warehouses that were being torn down in his lower Manhattan neighborhood in the early 1960s.
His themes are American. Some consist of stenciled lettering that reference words or phrases from classic American literature. Others address racism as in his powerful Confederacy Series -- four paintings in which he uses stars to identify cities where violence occurred during the civil rights movement.
But there's LOVE, too.
There are nine monumental LOVE sculptures, all original, in different colors and some slightly different in size. They are in New York, Philadelphia, Indianapolis, Bentonville, Ark., Scottsdale, Ariz., New Orleans, Singapore, Tokyo and Taipei, Taiwan.
In the exhibition, there's a LOVE painting in the form of a cross and a small aluminum model that served as a template for all his other LOVE pieces. And there's Electric Love, a monumental sculpture with tiny electric lights that move up and down until the entire piece glows -- a psychedelic throwback to the days where it all started.
"It's quite staggering," Indiana said of the exhibition, which will travel to the McNay Art Museum in San Antonio, Texas, on Feb. 5. "I can't believe I did all this work. I should be exhausted, and I am exhausted."


text:
Can I use History of Parliament material in my own work/website?
The History of Parliament website contains material that is the copyright of the History of Parliament Trust or is Crown Copyright, 1964-2011. Some of the material, mostly images, belongs to other copyright holders. Details relating to copyright are contained in the terms and conditions document. Basically, you can retrieve and download material on this web site only for personal, educational and non-commercial use. You can cite from it and make short quotations from it without asking us, as long as you provide a reference to the original (up to about 250 words, as long as this does not constitute the entire article). Any other use requires written permission from the History of Parliament or from the other copyright holder.
How should I cite material on the website?
The urls for each article are permanent and citable: e.g., http://www.historyofparliamentonline.org/volume/1690-1715/member/gardiner-francis-1634-1714
We plan to correct the articles on an ongoing basis, and therefore it is adviseable to include a date in your citation.
Why does one person sometimes have more than one biography?
The online History of Parliament reflects the way in which the print volumes were researched, written and published over a long period of time. Projects were undertaken on a chronological basis, with the volumes covering 1754-90 appearing first, then those covering 1715-54, then the 1660-90, 1509-58 and 1558-1603 volumes, and so on. Many men had careers as Members of Parliament which crossed these chronological boundaries and therefore they have biographies in more than one of the sections into which the History is divided. In the longer term we would like to edit these biographies so that there is only article relating to any Member of Parliament, and also update and correct them at the same time. However it will be a long time before we are able to do this.
Where there is more than one biography of one person, why are the details sometimes different?
The biographies have been researched and written over a long period of time. Often, an article written later may correct information on a particular individual that was published in a previous set of volumes. The articles on the website (with minor exceptions) give the text as it was published; no attempt has been made to update articles published earlier with information provided in articles published more recently.
Where the details are different in two biographies of the same man, which ones are right?
Details in the biography published most recently should be preferred. Publication dates are:
1386-1421 published in 1992
1509-1558 published in 1982
1558-1603 published in 1981
1604-1629 published in 2010
1660-1690 published in 1983
1690-1715 published in 2002
1715-1754 published in 1970
1754-1790 published in 1964
1790-1820 published in 1986
1820-1832 published in 2009
What do all the abbreviations mean?
We are working on expanding the various abbreviations found in the History's articles. In the meantime, click here for a list of common abbreviations.
I've found a mistake. How can I get it corrected?
We're delighted to hear from people who have corrections or additions to the material published about a particular MP, or constituency. Please write using the contact address given on the website, firstname.lastname@example.com, or by using the form under the 'contact us' tab above. Don't expect any changes to be made quickly, though! We need to make sure that the corrections are right, and we don't have a lot of spare capacity to do that. We are also working on creating a way of showing corrections and additions to individual articles.
The website suggests that there is material available for 1422-1509 and1640-60 but I can't get to it. Why?
We are currently working up to the publication of the material for 1422-1509 and 1640-60, which should be in around five or six years' time. At the moment we are not making the draft articles for these periods available online. The articles will be available online two years after their print publication date. For more information, visit our current research section.
There seems to be a gap between 1629 and 1640. Why?
There was no Parliament between these years, a period often referred to as the 'Personal Rule' of Charles I, for this reason. Therefore we don't claim that our volumes are covering the period.


text:
How to Find the Right Church: What To Look For and 7 Signs of an Unhealthy One To Avoid
top of page
Hey there! I'm Brisa.
Thanks for stopping by.
Grow in your faith.
The Blameless Life
One of the reasons I created this is because I've always looked for a certain type of faith-based blog. I couldn't find what I was looking for, so I decided to make that blog myself. God laid it on my heart for some time and it has become a reality. I hope The Blameless Life encourages you as you grow in your faith.
Read // Blog Post
The Blameless Life Store
Check out the TBL Store for Christian apparel. Brand new modern designs are live monthly. Clothing includes t-shirts, hoodies, and sweatshirts. And more products to come. Grow in your wardrobe as you grow in your faith. What are you waiting for click the button below!
bottom of page


text:
Left Hand Drive
Keep your device within easy sight and reach in your car! The ProClip makes it easier and safer to use handheld devices in vehicles. The ProClip is a mounting bracket that you attach to the dashboard of your car. Onto the ProClip, you can install any accessory, e.g. a holder for mobile phone or other communication device.
The ProClip is car specific, it is customized for each car model and has a perfect fit. The ProClip offers a firm mounting platform and is available in multiple positions for most vehicles. Discreet design that blends in well with the interior. Safe, neat and convenient!
The ProClip is easy to install, you can do it in a minute! You simply snap the ProClip into place in gaps in the interior, you do not need to drill holes or use special tools or dismantle the dashboard. Detailed mounting instructions included. The ProClip has AMPS holes for easy installation of a holder. Made of high grade ABS/Acetal plastic. Color: Black. Developed and produced in Sweden.
Please read all of the instructions and look at the pictures before attaching the ProClip.
1. Use the enclosed alcohol pad to clean the area where the ProClip is to be installed. Peel off the adhesive tape cover on the ProClip. Hook the upper part of the ProClip over the center console frame.
2. Press down on the right side of the ProClip and hook the lower edge under the center console side wall.
3. Press on the lower part of the ProClip so the angled edge hooks into place properly.
4. The ProClip is in place.
All orders received before 15:00, Monday - Friday (excluding holidays), will be despatched the same day, providing all of the ordered items are in stock.
If we cannot completely fulfil your order due to an item being unavailable from stock, your order will be held and despatched when the order is complete.
Basket Price |
Courier Service |
Shipping Costs |
Under £5 |
Royal Mail 1st Class |
£0.99 |
£5 - £49.99 |
Royal Mail 24 Service |
£4.99 |
£50 - 149.99 |
Royal Mail 24 Tracked |
FREE delivery |
Over £150 |
DPD Next Working Day |
FREE delivery |
Orders will be shipped using our chosen delivery partner after considering size of order and location. Cost is £16.66.
Any customs or import charges are the responsibility of the purchaser. UK tax is removed at checkout.
As we ship to most countries and will choose an appropriate courier depending on the size of order and destination. Costs vary by country and are calculated in the checkout.
When goods are despached you will receive an email containing tracking information from the chosen courier company. Please allow upto 48 hours after goods have shipped to receive this notification.
Please understand that during peak periods - including Black Friday, Christmas and other holidays - same day shipments can be delayed.
Situations beyond our control may also affect despatch times - these include strike actions, adverse weather and industrial disputes.
For further details, do not hesitate to contact us


text:
I can still feel the cold metal between my hands. I can smell the sweaty clothes in my gym bag and see particles of lifting chalk sprinkling through the air. The taste of artificially flavored pre-workout supplement lingers in my mouth. Out of the corner of my eye I spot a lovely female figure gliding oh-so gracefully on the treadmill. Through the other eye I see a balding, mustachioed man air drumming to his favorite classic rock ballad and another man of comparable age complaining about some "young punk" who didn't re-rack his weights after using the bench press. Believe it or not these are my people. They are family — both irritating and comforting. They are the older brother who leaves a slice of half-eaten pizza in your bed after watching TV. They are the little sister who won't stop kicking the back of your seat on a road trip. But they are also the loving mother who stays with you in the hospital when you're sick and the distant cousin who rekindles your bond after years apart. Even the self-consumed "meathead" grunting under the squat rack makes the gym feel like home — a symbiotic collective of agonists and antagonists. The community that is the gym has, at one time or another, been my salvation from the trauma and struggle of life.
Like most humans, I'm capable of loving both people and things. And because people aren't things and things aren't people, I tend to love them in different ways. Not necessarily with more or less fervor, well maybe, but differently — I obviously love my mom more than I love a set of dumbbells. But damn, I do love a good set of dumbbells.
I've loved often in my life and my point is this: I've felt such strong connections to both people and things I couldn't have possibly expected anything more from love. I've experienced kindness and care from people I never would have expected to come to my aid. And similarly, I've become so attached to inanimate objects it's made me roll my eyes.
Of all that, of all the love I've felt for people and things, I'm almost ashamed to say it is the latter that has given me joy and a purpose of which no person has bestowed upon me. It is a certain satisfaction and an even more certain attachment, and I get it from exercise. It is a magnificent fusion of passion, achievement, and countless other feelings brought together like a wonder drug with endlessly addictive properties.
Why do people run ultra-marathons, or do obstacle courses through barbed wire and blazing fire, or swim long distance in frigid water? It's not for their health. Although some people may say otherwise, speaking from experience I know most people test their bodies in such ways not because it'll make them live longer, but because, well, they enjoy it. Of course they do, that's why they are willing to risk their health. It's why I was willing to risk mine, although I never thought the risk was so great.
And sure running two dozen or more miles in a day is better for you than eating donuts and sitting on the couch, but extreme exercise has its health risks as well. I am perhaps the best example of the dangerous effects of overtraining.
At the peak of my bodybuilding obsession I was spending more time at the gym each week than some people do in their entire life (the latter is an entirely different problem). I remember having a conversation with a much older and wiser friend about my lifestyle. It wasn't exactly an intervention, but in hindsight it was definitely a hint. He made a point of making sure I knew exactly how much I was exercising — the equivalent of a full-time job. Not to mention I was going to school and had a part-time job. So really I had three jobs.
The exhausting pace of my life may or may not have directly contributed to the decline of my health over the last few years, but it certainly didn't help. Still, if given a mulligan I would live my life similarly, if not exactly the same. Even if my excessive exercising had killed me, I would gladly relive that death over and over because some things — the things that make us feel alive — are totally worth dying for.
There are many moments from my former life as a bodybuilder and fitness fanatic that now stick with me in my sick and sedentary state. Most nearly consume me with a nostalgia so intense it actually feels like my body is in another time and place. Right now that past time and place is where I'd rather dwell.
So this is to be my Gym Tales series, telling some of my favorite stories from working out, there are plenty — some comical, some nostalgic, some gross and painful, but all entertaining. So stay tuned …
And please subscribe if you would like to read more.


text:
When you purchase a SOLIDTEKNICS e-Gift Voucher you will be asked to provide the following details:
- Who the voucher is from (your details).
- The recipients email address.
- The recipients name.
- Your personalised message for the recipient.
- The date and time the voucher must be delivered.
The SOLIDTEKNICS e-Gift Voucher will be sent automatically to the recipient at the date and time specified, with instructions on how to redeem it. Gift vouchers are valid for three years from date of purchase.
Only orders for vouchers that are fully paid and approved will be sent to recipients. An automated process checks every 30 mins for vouchers that need to be sent.
You don't need to manually print or send the gift voucher, as we will manage this process for you. Recipients can redeem their gift voucher at checkout and any credit not used in a shopping session will remain as credit on their account.
SOLIDTEKNICS e-Gift Vouchers cannot be redeemed for cash and can be used only on the Australian SOLIDTEKNICS website.
Valid for three years from the date of purchase for use on the Australian SOLIDTEKNICS website only.
Any purchases made by the recipient will be subject to Solidteknics' famous Multi-Century Warranty.
Be The First To Review This Product!
Help other SOLIDTEKNICS PTY LTD users shop smarter by writing reviews for products you have purchased.


text:
Four SQL professionals gathered from the four corners of the world to share their SQL knowledge with each other and with their readers: Mickey Stuewe from California, USA, Chris Yates from Kentucky, USA, Julie Koesmarno from Canberra, Australia, and Jeffrey Verheul from Rotterdam, The Netherlands. They invite you to join them on their quest as they ask each other questions and seek out the answers in this collaborative blog series. This month we are cooperatively blogging about SQL Prompt by Red Gate.
The Next Mission
What makes up a SQL Prompt power user? Well, they use the SQL prompt commands like they were extensions of SSMS. They know the shortcuts, and they've memorized the key words to call up their favorite scripts. Let's take a look what these short cuts are and how to integrate them seamlessly into your every day SQL Life.
Playing The Ebony Keys
A power user of any software is one who uses the hot keys in lieu of the menus. SQL prompt has a plethora of hot key combination.
Before I use <ctrl> + e to execute my code, I always use <ctrl> + k, <ctrl> + y. This hot key combo will structure your code based on the styles you have set in SQL prompt. This is my most heavily used hot key combo right after <ctrl> + e and <ctrl> + r (hiding the results window).
There is a new hot key combination that is coming out soon in version 6.4, and I'm very excited about it. It adds a semicolon at the end of each statement! I've been trying to add the habit of using semicolons for 2 years now, and it never sticks. Now I can use <ctrl> + b, <ctrl> + c and away I go.
Here is a table of the hot key combinations I use the most, plus the shortcut way I remember them.
Hot Key Combination | Shortcut Hot Key Combo | What It Does | |
<ctrl> + b, <ctrl> + w |
<ctrl> + bw | Expands ALL of the wild cards. | |
<ctrl> + b, <ctrl> + q |
+ bq | Qualifies all the SQL Objects and fixes the capitalization as well. | |
in beta | <ctrl> + b, <ctrl> + c |
<ctrl> + bc | Adds semicolons to the end of each statement. (Available soon in 6.4) |
<ctrl> + k, <ctrl> + y |
<ctrl> + ky | Standardizes the code based on the formatting styles that were set in SQL Prompt. |
As a power user, my key strokes will look like this when I use them all at once:
<ctrl> + bw, bq, bc, ky and finally <ctrl> + e to execute my code. Here is an example of how an ugly duckling turns into a beautiful swan by applying all of these hot keys at one time.
alter procedure [dbo].[salesteamassignment_rptugly](@group as varchar(1000), @startdate as date, @enddate as date)as set nocount on declare @uselessvar as varchar(max) select p.businessentityid ,firstname,lastname,s.name as store,[group] as TerritoryGroup,cr.name as CountryRegion,st.name as Territory,customercount,s.* from adventureworks2008r2.sales.salesperson as sp join adventureworks2008r2.person.person as p on sp.businessentityid = p.businessentityid join adventureworks2008r2.sales.salesterritory as st on sp.territoryid = st.territoryid join [adventureworks2008r2].[person].[countryregion] as cr on st.countryregioncode = cr.countryregioncode join adventureworks2008r2.sales.store as s on s.salespersonid = sp.businessentityid join dbo.fn_split(',', @group) as grps on st.[group] = convert(nvarchar(50), grps.separatedvalue) outer apply (select count(*) as customercount from adventureworks2008r2.sales.customer as c where s.businessentityid = c.storeid ) as cc
ALTER PROCEDURE dbo.SalesTeamAssignment_rptUGLY ( @group AS varchar(1000) ,@startdate AS date ,@enddate AS date ) AS SET NOCOUNT ON; DECLARE @uselessvar AS varchar(MAX); SELECT p.BusinessEntityID ,p.FirstName ,p.LastName ,s.Name AS store ,st.[Group] AS TerritoryGroup ,cr.Name AS CountryRegion ,st.Name AS Territory ,cc.customercount ,s.BusinessEntityID ,s.Name ,s.SalesPersonID ,s.Demographics ,s.rowguid ,s.ModifiedDate FROM AdventureWorks2008R2.Sales.SalesPerson AS sp JOIN AdventureWorks2008R2.Person.Person AS p ON sp.BusinessEntityID = p.BusinessEntityID JOIN AdventureWorks2008R2.Sales.SalesTerritory AS st ON sp.TerritoryID = st.TerritoryID JOIN AdventureWorks2008R2.Person.CountryRegion AS cr ON st.CountryRegionCode = cr.CountryRegionCode JOIN AdventureWorks2008R2.Sales.Store AS s ON s.SalesPersonID = sp.BusinessEntityID JOIN dbo.fn_Split(',', @group) AS grps ON st.[Group] = CONVERT(nvarchar(50), grps.SeparatedValue) OUTER APPLY ( SELECT COUNT(*) AS customercount FROM AdventureWorks2008R2.Sales.Customer AS c WHERE s.BusinessEntityID = c.StoreID ) AS cc;
But Wait, There's More
Formatting your code is only half of the features in SQL Prompt. There are three other features that every power user should use. (Ok, the truth be told, there are more than 3, but my article shouldn't be the length of a book.)
Feature 1:
SQL Prompt offers the ability to save snippets of code. This is really useful for repetitive tasks. Here is a list of articles that I've written talking about specific snippets that I find handy.
Placeholders are one of the most helpful features that SQL Prompt provides for you to work with snippets. The placeholders are reserved words that are variables for specific pieces of information or represent actions that can be applied to your snippet. They are always completely capitalized and are surrounded by dollar signs ($). You can find the current list for SQL Prompt 6 here.
One of the new placeholders is prefect for the power user. It allows you to insert a snippet and have part of it highlighted. Here is an example of how I like to use it. This particular snippen, which I named "st1", will add SELECT TOP 100 * FROM in front of the table name that I"ve highlighted and copied to the copy buffer.
The $PASTE$ placeholder will be replaced with whatever is in my copy buffer. The $SELECTIONSTART$ and $SELECTIONEND$ placeholders will cause the code within the placeholders to be highlighted.
To use it, I follow these steps.
1. I highlight a table I want to use and hit <ctrl> + c to get the table into my copy buffer.
2. I type st1 + to get the snippet. I now have a highlighted SELECT statement ready to execute, so I hit + e to execute it.
3. Finally, I type <ctrl> + z twice to undo the changes I've made.
This allows me to quickly see some sample data from the table without ever leaving my current query window.
Feature 2:
This is a hidden gem. This feature finds all the invalid objects in your database. This is a great feature for those of you who need to perform code reviews and want to make sure that any DDL changes have not broken any existing SQL Objects.
In this example I have a table with a trigger that uses the field ModifiedDTS. I deleted the field and ran the command. It listed all the SQL Objects that are now broken due to the deleted field.
This feature does not have a Hot Key, but it is definitely worthy of a power user.
Feature 3:
This is a great "clean up" feature, especially when you are working with stored procedures with 200 + lines that you have inherited. You know the ones, they are filled with old code and have never been cleaned up. Well, this feature is perfect for it, because it finds all the unused variables and parameters. Simply use the hot key combination + b, + f. SQL Prompt, will then underline in green all the unused variables and parameters for you to evaluate for usefulness.
I encourage you to spend 10 minutes going through the SQL Prompt menu to find out what other goodies exist for you to leverage. There are also new features coming soon in version 6.4. Here is a great reference to all the release notes for each version, plus the release notes for the current beta version.
Don't Stop Yet
If you want to read more about how to work with SQL Prompt, then check out these blog posts:
- Chris Yates: SQL Prompt – The Power Within
- Julie Koesmarno: Clean And Tidy SQL With SQL Prompt
- Jeffrey Verheul: Become a T-SQL Hero with SQL Prompt
To follow our quest for SQL knowledge through this collaborative project, follow the #SQLCoOp tag on Twitter.
See you next month!!
Original Post: On a SQL Collaboration Quest


text:
COVID is wreaking havoc in the Southeastern Conference.
On Wednesday, the conference announced that they postponed the No. 12 Georgia Bulldogs vs. Missouri Tigers football game due to a COVID outbreak within the Tigers football program.
With Missouri already playing Dec. 12, the conference pushed back the Georgia and Missouri's game to Dec. 19, the conference said in a press release.
This is the fourth game the conference has had to postpone this week.
"While it is unfortunate to have multiple postponements in the same week, we began the season with the understanding interruptions to the schedule were possible and we have remained focused throughout the season on the health of everyone around our programs," said SEC Commissioner Greg Sankey said in the news release. "We must remain vigilant, within our programs and in our communities, to prevent the spread of the virus and to manage activities that contribute to these interruptions."
On Tuesday, the conference announced they had to postpone Saturday's Louisiana State Tigers vs. No. 1 Alabama Crimson Tide and No. 5 Texas A&M Aggies and Tennessee Volunteers games due to a COVID outbreak within the LSU and A&M programs.
The SEC rescheduled Alabama at LSU game for Dec. 19 and the A&M-Vols game on Dec. 12.
No. 24 Auburn Tigers vs. Mississippi State Bulldogs was the first SEC game postponed this week due to a coronavirus outbreak within the Bulldogs program.
The conference rescheduled the Auburn-Miss St. game for Dec. 12.


text:
On May 16, the Vatican released its guidelines on how to deal with claims of sex abuse to a mixed reaction. While we found them reassuring and authoritative, there were those, of course, who wouldn't have been happy with anything.
The three most noteworthy features of the Vatican's new guidelines were (a) its commitment to the due process rights of priests (b) its insistence on cooperation with civil authorities and (c) its restatement of episcopal authority in these matters. It was also reassuring to learn that the Vatican said, "The accused cleric is presumed innocent until the contrary is proven." Significantly, the guidelines say that "the prescriptions of civil law regarding the reporting of such crimes to the designated authority should always be followed." It also put the ultimate authority in these matters squarely in the hands of the bishops or major superiors.
The guidelines were respectful of episcopal autonomy and do not attempt a universal template. This was important because cooperation with the civil authorities in some nations is tantamount to suicide: hostile environments for Catholics exist, and any cooperation with the authorities in these nations is bound to come at the expense of justice.
With regard to authority in these matters, the Vatican understands the role that diocesan review boards play, but it also recognizes that they are not a substitute for the authority lodged in the bishop.
The news story by the Associated Press spoke of priests who "rape and molest children," referring to them as "pedophile priests." It was factually wrong: few were raped, most were not children, and pedophilia is not the problem. In fact, the data show that "inappropriate touching" has been the most common form of abuse, and that most of the victims were postpubescent males, meaning that homosexuality was at work.
Finally, we were disappointed to read that John Allen of the National Catholic Reporter, who cited criticism of the guidelines made by SNAP, did not inform his readers that SNAP's comments were made the day before the Vatican's statement was released.


text:
Historic house in Venice
Experience the poetry of Venice staying at an elegant Historic Residence, in the vicinity of San Marco Square, just a short distance from Riva degli Schiavoni and the ancient works of the Arsenal. Located in the characteristic Castello district, the Hotel La Residenza offers refined, comfortable lodgings at convenient prices.
The rooms at this 2 star Hotel in Venice are quiet and attentively renovated, located in the prestigious 15th century Gritti-Badoer Palazzo. This residence, which once belonged to noble Venetian families, stands out for its elegant Gothic-Byzantine architecture and finely restored interiors, featuring period furnishings and 18th century paintings.


text:
FAQs and Links
Your Questions Answered
How can I retain your firm to represent me when I have no money?
Our office handles all personal injury claims on a contingency fee basis and does not charge fees or disbursements to the client unless fair and reasonable compensation is obtained. Our office will also pay for all necessary litigation related expenses including the retaining of experts to conduct assessments. Costs of these assessments can range anywhere between $1,000.00 and $6,000.00. Again, these disbursements will not have to be repaid by the client unless compensation is obtained. In addition, in the Province of Ontario, a Plaintiff who is successful in obtaining compensation for his or her loss is entitled to recover from the Defendant costs in addition to any damages. This occurs whether the matter is settled or proceeds to trial. Typically, the Defendant will pay fifteen percent of the damage award toward legal fees.
How long will it take for my case to settle?
A Court case takes approximately two to three years to resolve either by way of settlement and longer if the matter proceeds to trial. However, the matter cannot be properly settled until a prognosis has been obtained from a physician setting out the manner in which the injuries will affect the claimant into the future.
Will my case go to court?
Most personal injury cases are settled only if the matter is properly prepared for trial. Approximately ninety-eight percent of matters are settled. Only those matters in which liability is in dispute or where the insurer is not prepared to pay fair compensation proceed to trial.
Who will arrange for assessments by a specialist?
Our office will arrange assessments by the appropriate medical specialists to review the injuries and conditions suffered by the claimant. These reports and the retaining of experts are necessary to obtain fair compensation and also to ensure success at trial.
How much is my case worth?
Once all of the appropriate reports from the specialists have been obtained, our office will then be in a position to properly assess the value of the case. It is, however, difficult to assess the case in the initial stages as it is unclear at that time as to the manner in which the injuries will progress and whether they will be permanent and the manner in which they will affect the claimant¹s ability to work and their activities of daily living.
What are the stages of the litigation process?
(a) A Statement of Claim is issued at the commencement of an action and generally must be issued within two years from the date of the accident. The Statement of Claim is then served on the Defendant in the matter who will then deliver a Statement of Defence.
(b) Following the delivery of the Statement of Defence, all relevant documents in relation to the matter are exchanged between the parties at which time examinations for discovery are arranged in which parties are asked a series of questions to be answered.
(c) Following examinations for discovery and assuming that all appropriate experts have been retained and reports have been exchanged, the matter is set down for trial and a trial date is scheduled.
(d) During the course of the proceedings, a settlement meeting or mediation session involving a retained mediator who is employed to attempt to resolve the matter may be scheduled. In addition, depending on the jurisdiction of a law suit, a settlement conference or pretrial conference will be held before a Judge or Court Official in an effort to resolve the matter.
(e) If the matter cannot be resolved, a trial will be scheduled before a judge or jury. Most personal injury trials are conducted before a jury.
- Ontario Brain Injury Association
- Statutes and Regulations of Ontario
- Workplace Safety and Insurance Board
- Guide to Ontario Courts
- Workplace Safety and Insurance Appeals Tribunal
- The Law Society of Upper Canada
- Social Security Tribunal of Canada
- Statutes and Regulations of Canada
- Canada Pension Plan
- Financial Services Commission of Ontario
- Fair Practices Commission
- Ministry of the Attorney General
- Ontario Court of Appeal
- Ontario Human Rights Commission


text:
Fill out our quick free form with details about your move
Receive instant Canadian and USA quotes for your move
Book with the movers that best meet your needs
I just wanted to let you know how impressed we were with how well our move went. We got a great price and no corners were cut. Our furniture was handled so carefully and items that had to be disassembled were put back together in our new home. Great experience overall.
Seattle, WA
I wanted to compare moving companies, but I was too busy to do much searching. BestMovingMovers.com got me quotes to compare from local movers in minutes. It was so fast and easy! And our move went very well.
Toronto, Ontario
Monica: Hello, how can I help you?