text:
Digital Forensic Trends and Future
- Anis Arnold
- 3 years ago
- Views:
1 Digital Forensic Trends and Future Farhood Norouzizadeh Dezfoli, Ali Dehghantanha, Ramlan Mahmoud, Nor Fazlida Binti Mohd Sani, Farid Daryabar Faculty of Computer Science and Information Technology University Putra Malaysia {Farhood1990, {alid, ramlan, ABSTRACT Nowadays, rapid evolution of computers and mobile phones has caused these devices to be used in criminal activities. Providing appropriate and sufficient security measures is a difficult job due to complexity of devices which makes investigating crimes involving these devices even harder. Digital forensic is the procedure of investigating computer crimes in the cyber world. Many researches have been done in this area to help forensic investigation to resolve existing challenges. This paper attempts to look into trends of applications of digital forensics and security at hand in various aspects and provide some estimations about future research trends in this area. KEYWORDS Digital forensics, Image, Memory, Security, Identification, Recovery, Investigation, Intrusion, Validation. 1 INTRODUCTION Digital forensics process involves collection, preservation, analysis and presentation of evidence from digital sources. With the rise of challenges in the field of forensic investigations, problems that are more interesting are looming on the horizon for both victims and investigators. As computers become smaller, faster and cheaper, computers are increasingly being embedded inside other larger systems which allow information to be created, stored, processed, analyzed and communicated in ways that are unpredicted. Once we gathered digital evidence from monolithic, stand-alone mainframes whereas today we have PCs, supercomputers, distributed client-server networks, laptops and smart phones, and LANs and WANs to convey information across the world, each of which is a potential source of digital evidence. Evidences stored in a computer is not unique with regard to relevancy and materiality, but because it can be easily duplicated and modified, often without leaving any traces and is readily available to a miscreant using another computer half a world away and hence, should be constrained by evolving legal standards and constraints to defend privacy issues. In general, privacy means allowing or disallowing access to information. The code of ethics requires the forensics professionals to maintain the privacy of the client. In the event of proper investigation of cases, depending on the sensitivity of the issue and the requirement of the result, the privacy of the client may need to be compromised. 48
2 But it is also possible the victim organization might lose out the trust over forensics team. Moreover there are organizations where in any slight leakage of the issue may attract huge media attention resulting in endangering the reputation and finally the business of organization.in such situations, privacy rights and law enforcement s need to search and seize digital evidence during digital forensic belong together.it may also be possible that the forensics expert may not share the information with any third party but takes the advantage of the confidential information of the client himself, which is also a case of violation of right to privacy. That is why, it is the policy maker s responsibility to see the impact of forensics in the broader context of business goals and make the hard decisions that trade off forensics capabilities with issues of privacy and, correspondingly, morale. Key strategies for digital forensics in order to protect privacy are selective revelation, strong audit and rule processing technologies. In the present situation, the dilemmas are How to monitor digital forensics while keeping search information secret? How do we keep private information from being improperly disclosed in the name of forensics? This paper comprises of 3 Sections and will be presented as such: Section 2 narrate the data collection procedure for this review as well as the limitations of the collected data. Section 3 discusses all the collected papers and analyses the result of each paper. Finally, section 4 concludes the paper and summarizes the overall development of technology in digital forensic. 2 CURRENT TRENDS IN DIGITAL FORENSIC This section identifies the limitation of this work and explains the procedure of data collection. 2.1 Limitations of the Study It is unlikely that this approach will capture the true picture of privacy protection in current digital forensic landscape, as they are delicate in each research specimen. The papers read are more interested to discuss exploiting security mechanism and framework rather than privacy protection techniques. The numbers of papers provided are also too few to adequately sustain very significant research value. Most of the papers reviewed are too specific in their corresponding research field and purpose; it is difficult to generalize the specimen into statistical data with higher accuracy. The research nature and scenarios used cannot be fully depended upon as they are not necessarily applicable in another similar scenario. Since the publications go through a lengthy peer review process that adds a long time lag to the publication route, they are not so responsive to the current security trends and issues. Hence, they tend to be a following rather than a leading indicator of information security trends. We also realize that almost all specimens are from the Elsevier journal platform, and thus there is a limitation on the availability of more related research publications in other sources. We also identified another limitation, which is the lack of graphical statistical data, as most of the papers researched do not necessarily belong to statistically based research. It is not practical to add statistical assumptions depending on the given articles only rather it has the 49
3 unavoidable possibility to divert the accurate picture of the research. 2.2 Data Collection Procedure In this research, a passive data collection procedure is executed in three phases depending on 97 articles from 31 journals. We focus on statistical analysis based on trends not older than 2008 to obtain a view of recent interests in the arena of digital forensics. A wide range of well-established journals is chosen that have digital forensics as its primary focus fulfilling both academic & business purposes. Phase 1: Keyword Analysis. The data collection process started with keyword analysis in order to identify the focus of each article studied. We found out that the keywords used by authors do not necessarily reflect the picture of techniques and theories that are being emphasized within the timeframe of a paper. At the same time, some keywords are too generic and may not bring any significant research value unless paired with other keywords. Figure 1 summarizes the frequency of the keywords in all the articles included for this survey. It is rather evident that the current focus of forensics is now more towards computer, multimedia and network forensics with 31, 24 & 22 papers focusing on those areas respectively. 14 articles explaining present & future forensic tools and applications also receive significant focus, as these are the foundation of many digital security solutions. With the rapid development of image processing techniques, tampering with digital images without leaving any obvious traces is becoming easier and thus, image forensics evolved quickly during the last few years and has been studied in 12 papers. Figure 1. Coverage of topics in journal papers Phase 2: Topics Covered in the Journals. The collected keywords were then grouped into broad category topics based on their representation to 50
4 accommodate most of the topics identified in recent digital forensics, as shown in table-1. For example, articles containing keywords like image splicing detection, edge detection, image tampering, JPEG compression, image segmentation were grouped as image forensics and fell into a broader category of multimedia forensics. Articles, grouped in one category, can actually fit into multiple broader categories, such as articles with paired-keyword memory & windows registry and memory & mobile phone were both categorized as memory forensics, but the former is more suitable to computer forensics whereas the latter is appropriate in mobile device forensics. The same strategy applies to all the other broad topics. All the topics that appear not to be part of any of the broad topics were categorized as other. This category included topics like: Forensic Psychiatry, Microelectronics Reliability, Evidence Validation and Anti-forensics Approaches to name just a few. Table 1. Keyword categories. Categories Computer Mobile Network Database Multimedia Cloud Other Total Forensics Device Forensics Forensics Forensics Forensics Forensics Forensic Investigation Forensic Tools and Applications Image Forensics Security Mechanism Memory Forensics Personal Identification File Forensics 5 5 Artificial 4 4 Intelligence Information Recovery Video Analysis Cybercrime Legal Compliance Intrusion 2 2 Detection Attack Trace/Pattern Analysis Investigation Incidence 2 2 Response Forensic vendors 2 2 Anti-forensic 2 2 Approaches Network Data 1 1 Analysis Data Integrity 1 1 USB Forensics 1 1 Evidence Validation
5 Location Analysis Phase 3: Results Obtained from the Journal. Individual analytic platform is conducted as a final data collection. This is done by picking up a summary of each paper and giving a brief explanation of what the paper is trying to prove and possible benefits from the publications. 2.3 Comparing Journal Result with Existing Survey-Reports A survey was conducted among the experienced researchers and practitioners in the computer forensics field in 2008 during the Digital Forensics Research Workshop. Nine volunteers from the digital forensics practitioner group within the United States participated and were asked to describe the type of cases that are involved in their investigations [98]. The result is shown in Figure 2. The most common digital forensic investigation cases, 77.8% of overall cases, are those that deal with single personal computer (PCs). Surprisingly, the second-most common digital forensic investigation cases, 55.6% of overall cases, involve mobile media. The third-most common digital forensic investigation cases, 44.4% of overall cases, involve networks, hacking, and multimedia. Only a small number of cases, i.e., 11.1% of overall cases, are concerned with stenography and other sophisticated computer techniques. Note that the total percentage is over 100% because some cases may involve multiple devices. For example, a cell phone, PDA, as well as desktop PCs, laptops, etc. may be part of the same case. Figure 2. The percentage of Different digital forensics investigation cases [98] 52
6 3 DISCUSSION AND ANALYSIS OF RESULTS Digital Forensic Investigation is a rapidly growing field involved in Information Technology era emergent. It indicates the numerous techniques how the crime in a computer system is handled which occupied from the very lowest part end user to the highest level. In this paper, our summarization is based on every part of keywords mention in the Introduction section. We believe all the methods are not synchronous. We compare all compiled methods which have been used for ages ago to the newest techniques respectively. Part of the summary, we enclosed with the future work that we believed would be significantly important to the further research onward. 3.1 Forensic Investigation In a computer system, Forensic Investigation (F.I) is a practice to establishing the evidence and facts to be presented in court. It may involve in multiple number of system layer. Different network architecture would demand different F.I approach and different level of difficulties. In [7], the author discusses the issue that makes the F.I. in cloud computing system more complex when it comes to the decentralized authority issue. The provider of cloud computing differentiated by location and the location and some of them will encrypt the data before delivered to the public network. The usage of the peer-to-peer software may cause to complexity of F.I recovery. As it capable of searching and downloading files from or to any node/computer, it also becomes a factor of exposing company private data to any attack. In peer-to-peer (P2P) F.I, the analyst have to determine the configuration parameter; password, username, log time, installation time and etc [9]. They also advocate the LANGuard software application to monitor P2P activities within the network. As mobilephones become more advance nowadays, the more vulnerable they are to attack. More users of Smartphone are doing the personal private activities through Smartphone; online banking transaction or e-commerce. The misuse of mobile application involves obtaining and spreading confidential information, fraud, theft, money laundering, copyright infringement and indecent image [6]. The author emphasizes the digital acquisition method on the Subscriber Identity Module (SIM), memory card and flash memory by applying bit-to-bit copy. On the other hand, copying acquisition is also discussed by the author in [80] using the hash verification process. The author proposes a new software Chain of Custody (CoC) which is able to print, custody and transfer any piece of evidence recorded. During F.I. process, it is important to maintain the privacy of honest users while the system is under investigation. In [47], the author proposes the Enhanced-Respect Private Information Not Abuser (E-RPINA) to provide privacy of honest user yet accountability to the attacker. In cloud computing system, it potentially involves great data exposure to the security threat and privacy breach. In addition, the users activity can be traced out using the audit trail process [51]. The forensic analyst has to handle the 53
7 information carefully or otherwise it might fall into the wrong hand. The data can be either software or hardware encrypted in order to keep it private and confidential. High demands to protect user's personal data and files led to the introduction of encrypted disk. In [86] the author reveals an open source encryption software known as TruCrypt. It is freely available and able to encrypt the whole partition contain of operating system file. Nowadays, it takes more consideration upon attack prevention process and technique. The monitoring and visualization of network activities are a crucial mechanism within an organization's network. In [66] the author exposes the development of Enterprise Network Activities Visualizations (ENAVis) as an aid to network administrator to manage and monitor network activities. Nevertheless, still the computer systems are potentially exposed to attack with the minimal information given. It affects the privacy of user when suing the encrypted traffic and believed they are securely protected. In [97] the author demonstrates the attacking method on Secure Shell (SSH) and Skype software. 3.2 Forensic Tools and Applications To run a F.I, the correct tools and software play important role as aiding to the efficiency and effectiveness of the investigation. As P2P is widely used for sharing illicit material, the author discusses a tool to extract information from binary evidence based on Java Object Serialization (JOS) as implemented in P2P [67]. Based on the JOS specification, personal information about users can be extracted using a tool known as AScan. However, this tool only available for the law enforcement community. On the other hand, another great tool is used to render back the HTML file through the tcpdump program, which is known as PyFlag. Any recorder network can be capture and replicate the content. The same goes to Flash Memory in the Smartphone, the application can be used to determine any related application logs and multimedia file upon a user [42]. The author develops a Mobile Internal Acquisition Tool (MIAT) in order to target the Symbian OS. However, because of the conflict issue regarding the user privacy information, the software is not to be released under open source license. There are special forensic tool involves in different operating system (OS) respectively. The introduction of Macintosh Evidence Gathering and Analysis (MEGA) describes how the implementation of system analysis works in Mac OSX [72]. It has great capabilities in manage and monitor the network and even can handle Mac FileVault encrypted home directory. Nevertheless in the Linux OS, the author in [92] mentioned about the uses of Forensic Automated Correlation Engine (FACE) as an image analyzer of the Linux partition. It may obtain any personal information of victim for forensic investigator or unauthorized personnel. 3.3 Image Forensic Image analysis is used in image forensic to expose the information using the image support machine with decision fusion techniques [4]. The author proposes a model that identifies the source model or device of an image by using the support vector machine approach along with decision fusion 54
8 techniques. The paper considers feature selection algorithms as features in optimal subsets are generated in a series of inclusion and exclusion steps and count based aggregation as the algorithm of decision fusion. The algorithm selects the top λ features from 43 features in order to get the highest identification rate and the SVM trained model is built where test images is fed into the trained model to predict the camera source model. The flowchart of the model is illustrated in Figure 3. Figure 3. Flow Chart [4] In [56] the author introduces image meta-description approach suitable for different image inference applications named as progressive randomization (PR). This technique is based on perturbations on the values of the Least Significant Bits of images that makes it different from the state-of-the-art algorithms. As the imaging analysis being enhanced, [55] contributes reviewing the state-ofthe-art image registration methods that lays the foundations on evolutionary computation and analyzes the 3D modelling of forensic objects. The paper includes different evolutionary approaches in order to represent the wide variety of techniques within the EC paradigm and an IR method based on the classical ICP algorithm proposed by Liu. The paper reveals that the majority of the EIR methods following a parameterbased approach achieve the best and the most robust performance and the poor performance obtained by the matchingbased methods. With the highly advanced application, the forensic tool is able to differentiate between the fake and real image. By using multi resolution decomposition and higher order local autocorrelations (HLACs) image features are extracted and determine if it is real or fake [23]. They are used and as by right of the inner product lemma of higher order autocorrelation, the feature extraction and SVM are joined and the computation complexity is decreased significantly. The paper suggests Two dimensional discrete wavelet transformation (2D- DWT), a powerful multi resolution analysis tool. The signal characteristics in detail can be localized in different position, orientation and scale and multi resolution decomposition contains many intrinsic characteristics of natural images and fake images. As Noise degradation causes failure to blind forgery detection methods, in [9] the author proposes a model that divides a suspected image into different partitions with homogenous noise levels. However, the authentic images also can contain various isolated regions with very different variations, which make the proposed method a supplement to other forgery detection methods rather than a standalone forgery detector. The proposed method is not able to find the corrupted regions, when the noise degradation is very small (σ < 2). The proposed method can be achieved by omitting the blocks merging step. 55
9 In image analysis, the image can be detected and located the duplicate regions with rotation, using an efficient and robust passive authentication method [64].It uses circle block and the Hu moments for detection and location. In this method Gaussian pyramid is used for decomposition and to overcome the possible distortion caused by JPEG compression and noise contamination, produced sub-image in low frequency is chosen. The sub-image is divided into many circle blocks overlapping each other and from them the features of Hu moments are extracted. Here, the circleblock mode and the Hu moments are able to eliminate the effect of rotation. We believe that the new rotationinvariant features should be constructed directly on the circle region. The corresponding robust detection method will be investigated for other intermediate processing such as resizing, cropping etc. In order to detect image splicing the common form of image tampering, the author in [33] proposes an approximate run length based scheme. Proposed scheme only computes run lengths on the edge pixels and what makes it better is that splicing normally introduces extra edges to the image. This method introduces to a threshold t. If the absolute value of the difference of two neighboring pixels grayscale value is not greater than the threshold t, the two pixels are considered as they are in an approximate run. We believe further research should be done on the fluctuation of grayscale values of consecutive pixels that tends to be more dramatic in an image with complex texture. Hence makes the authentic images and the spliced one less distinguishable. The exposure to a new extraction algorithm as proposed by the author in [25] is able to extract the block artifacts grids (BAG) and then abnormal BAGs due to interpolate or concealing objects can be detected with a marking procedure by copy paste operations. The author suggests that with extracting weak horizontal and vertical edges with periodicity of 8 separately and then combining them the BAGs are found. The image tampering applications like image cropping, painting and copy-paste operation can be detected by BAG using mismatching phenomena. In order to detect image forgery, it does not require any other prior information about the image, for detecting image forgery [20]. This paper includes all the existing surveys and references that directly deal with blind image forensics. Nevertheless, this method only implies that leaving the ideal lab conditions and applying the existing methods to real-life applications, higher rate of false positives are considered than reported. Lack of automation is another drawback of existing methods. To localize the forgery, existing methods need to have knowledge of various modification regions containing some inconsistencies. Many of the existing methods deals only with JPEG and compression properties. Ideally the method to prove the authenticity of a picture in legal proceedings is not straightforward, an easier approach would be matching an image back to the type of device that last modified it, either hardware or software. [71] explains how quantization tables, which is generally used for JPEG compression, can be used for image source identification since it can identify if images have been processed by software or not, thus can benefit forensic examiner to only consider the unaltered 56
10 ones from a large volume of given pictures. For this, the author classified quantization tables into several categories used by the JPEG images that vary by different camera models and software program. A software library developed known as Calvin to identify the type of quantization tables used by the existing images that the library contains. For excellent solution of image forensic, we are recommending that the knowledge of JPEG quantization table combining with image factor EXIF data, signature program or color signature for real skin may produce an excellent work of image analysis. The image of computer generated and real image can be distinguished based on human visual system. In [38] it describes a series of psychophysical experiments that used images of varying resolution, JPEG compression, and color to explore the ability of observers. From the experiments conducted, it reveals that the image is in fact photographic when an observer believes it to be photographic that can be expressed as the following conditional probability, P (I = photo R = photo) where R denotes the user response and I the image category. By replacing photo with CG, the conditional probability that an image is CG if an observer says it is CG, P (I = CG R = CG) However, the accuracies reported in the paper are a lower bound on human performance, unlike time rendering technologies; observer performance can likely be improved. To identify the source camera-model of a digital image, [99] utilizes traces of demosaicing operation in digital cameras and employing two methods and defining a set of image characteristics which are used as features in designing classifiers that distinguish between digital camera models. the paper identifies demosaicing artifacts associated with different camera-models. By determining the differences in the image formation pipeline, e.g., processing techniques and component technologies, the first method in this paper tries to detect the source cameramodel of the image. Two methods namely Expectation Maximization algorithm that analyzes the correlation of each pixel value to its neighbors and analysis of inter-pixel differences are used to detect and classify the traces of interpolation operation in images. Experiment proposes to feed the images to the classifier to verify the consistency of demosaicing artifacts. Hence, the final decision is made by the classifier. It is expected that the use of combined method would eliminate some of the false-positives due to mismatch of the reference pattern. 3.4 Security Mechanism In [81], author confers the importance of computer forensics as a standard for electronic crime investigations and the expertise required. As the computer forensic field is growing, the field of operation and the number and complexity of the managed cases determine required tools or equipments. Computer forensics, in this paper is termed as mechanism of prevention, compliance and assurance rather than investigation and response. [26] proposes information hiding techniques as an alternative to encryption. This paper uses the FAT file system as a proof-of-concept example of a covert communication medium. In simple approach, the information to be hidden is embedded in the arrangement 57
11 of the clusters of a file. In an alternative approach, the distribution of the cover file clusters can be used to create a covert channel. The approach proposed is undetectable of encrypted or random data. [43] reveals the fact that Portable Document Format is not impervious from some privacy related issues. Two issues, how changes made to PDF documents handled and interactive features of PDF, are investigated in this paper. This paper shows while trigger events like opening or closing of documents takes place, other programs might be executed or external link might be resolved without user awareness. [57] emphasis on building up of technological advancement for fraud. It marks phone specially Smartphone as a modern threat to confidentiality. This paper states that Smartphones have a dual personality - one that is loyal to the employer s exchange server, VPN and security systems, the other which can operate on public WiFi, alternative SIM cards and other seemingly anonymous networks, as described in Figure 4. Figure 4. The Dual Personality of Smart Phones [57] [42] proposes a highly robust protection algorithm that is based on an information hiding technique known as Steganography. Embedding the secret message in the first level 2D Haar DWT with the Symmetric-padding mode is the elementary concept of this paper. Fourier transform (FFT) together with the output of Hash Algorithm 1 (SHA-1) forms a strong image encryption setting Moreover, using DWT gives advantage of the possibility of converting the document into compressed formats without losing details. [33] discusses the implementation of robust watermarking with the EXIF metadata of images and integrated errorcontrol codes for copyright protection. The proposed algorithm is DCT-based watermarking techniques with necessary modifications for integrating with the BCH-protected EXIF metadata. For verification of the algorithm, attacks are performed by JPEG compression, lowpass filtering (LPF), and median filtering (MF). These papers discuss methods and algorithms to secure information and increase in digital privacy in sharing information. 3.5 Memory Forensic Memory forensics examines the information captured from memory at the time the computer is seized. As less focus has been paid to extracting information from Windows drivers, developing a methodology to minimize the effort of analyzing these drivers. [17] first describes a general methodology for reverse code engineering of Windows drivers memory structures. Proposed process for reconnaissance and analysis is shown in Figure 5. 58
12 Figure 6. System Overview [5] Figure 5. Methodology for reversing drivers [17] As modern Windows operating systems aggressively cache file data in memory. Current forensic tools and techniques, however, do not take mapped-file information into account. [49] describes a method for recovering files mapped in memory and to link mapped- file information process data. It discusses three methods for recovering files from memory-allocated filemapping structures; unallocated filemapping structures and Unidentified file pages. [5] proposes an automated system to support the mobile phone s live memory dynamic properties analysis on interactive based applications, as depicted by Figure 6. The paper describes the experiments and presents the results on identifying the memory region of a process where the message exchange can be observed, and investigating the cached data and the volatile evidence data persistency. [54] analyzes the pool allocation mechanism of the Microsoft Windows operating system. It describes a test environment, which allows obtaining a time series of physical memory images and allocations from the non-paged pool. [14] describes an algorithm to locate paging structures in a memory image of an x86 platform running either Linux or Windows XP that can be used to find potential processes. The first pass of the algorithm searches the potential page directory for kernel mappings. The second pass of the algorithm inspects the potential page directory by (0e767) entries. [90] exhibits technique that enables full access to the registry data cached in memory and shows that there are attacks that cannot be detected without examining the registry in memory. To counter attacks, the paper recommends collecting registry data from both RAM and the hard drive. The papers propose and analyze methods and techniques to extract data hidden in memory and investigation of attacks examining memory to strengthen digital privacy of data. 3.6 Personal Identification [58] proposes a recognition scheme, different from traditional, starts with the 59
13 dynamic partition of the noise-free iris into disjoint regions from which MPEG- 7 color and shape descriptors are extracted. [18] presents an automated system for shoe model identification from outsole that can provide information in timely manner impressions taken directly from suspect s shoes. Once Maximally Stable Extremal Region is identified as being robust and having a high repeatability, it is detected as a match. After detection, the paper employs a feature descriptor Scale Invariant Feature Transform to code the appearance or properties of the local features. [74] proposes a stochastic vision model based on a Markov Random Fields (MRF). The model employs a skin model and human affine-invariant geometric descriptor. For skin detection, the paper proposes the use of CIE-Lab due to its popularity in some real world application domains. In addition to the CIELabcolor space, the proposed skin model employs texture, another lowlevel. [73] suggests that in developing technologies and internet era, it is problematic to prove an individual that is suspected of a crime based on technology beyond doubt. The paper looks for reasons that effected proof of identity and what makes it difficult for identifying a crime suspect. Diversity of devices has put increasing pressure on an already limited resource. Malicious software usage and vulnerability of authentication of credentials made it difficult for forensic investigator to determine who had breached a system. [53] proposes Automated Impersonator Image Identification System (AIIIS) that allows investigators to track down impersonator attackers. AIIIS uses a combination of dynamic fingerprinting and spread spectrum data hiding. These papers present system and techniques of personal identification for the authentication information protection and investigation of impersonation. 3.7 File Forenisc As mentioned in [22], in the file system FAT-32 the route table entry with the file name will point to the first cluster of the file, which in turn will point to the next cluster and so on until the last cluster of the file. When a file is deleted, only the file s entry is removed from the table not the actual content that located in several clusters in the storage device. It will recover the file from the unallocated space declared by the file system. In this paper, the authors mentioned that the main problem in to recover a file in digital forensic is file carver still fail to recover a fragmented file. In [19], the author compared two published techniques to recover a fragmented file, the Bifragment Gap Carving (BGC) and Parallel Unique Path (PUP) technique. The author discussed the process of information concealment in [15]. The method described in this paper utilizes the trash sector space (slack space in allocated sectors) and empty space (unallocated sectors) of MS Office files. The author shows how to conceal information into the file based on the format. The author also demonstrates the detection of the concealed information in MS Word file. They create a C# program to detect the concealed information. The program detects the concealed information by analyzing the unknown relationship in the file. [37] discusses about the method to perform forensic analysis. The issues 60
14 highlighted by the author discuss whether visual analysis of a file in forensic analysis is a new or old trend. The article mainly discusses about how we can identify the content of a file by looking into its graphical representation and how much time it can reduce for investigators who need to analyze a large number of files. The issues with privacy mentioned in this article is at a minimal level if the method is used by authorized persons. [87] highlights the importance of visual forensics that may help investigator identify the important files in their list of evidences. The author describes how a single string embedded in an image only because light differences in the image brightness that may cause an investigator to exclude the image for further forensic analysis. The article also mentioned that with the help of different color to represent different behavior of http session log file content, a forensic investigator could easily identify the protocol used, destination and source of the packet. In [93], the authors investigate two types of algorithm to predict the type of the fragmented file. The authors also illustrate the results of implementation of the two algorithms mentioned above. The paper demonstrates how the algorithms can be implemented as a proof of concept and not as practical application because there are some aspect that need to consider to implement the algorithm as practical application. These papers help investigators with file forensics to face issues with digital privacy. 3.8 Artificial Intelligence The objective of the author in [82] is to introduce an open source tool for analyzing file systems that allow investigators to work on the same shared cases reducing the workload and also expediting the results. GUI features, administrator options and main features of the system are discussed in the paper. [69] discusses the applications of probabilistic graphical models and also focuses on the class of optimization methods that use probabilistic graphical models to organize the search on a search space. The paper proposes Estimation of distribution algorithms (EDAs) are evolutionary algorithms is based on the assumption that it is possible to build a probabilistic model of the search space that can be used to guide the search for the optimum where the construction of this probabilistic model is a crucial step. The discussion of [2] involves the limitation of Classical forensic reporting that provides only identification or exclusion/elimination decisions and way around solution of the limitations. The analysis infers the identity of the probe, but it gives the likelihood ratio for the two competing hypotheses. In forensic engine likelihood ratio serves as an indicator of the discriminating power. Thus, it can be used in assessing authentication performance. [95] describes the need for training in digital forensics and briefly describes a virtualized training platform for network defense and computer forensics, Cyber Defense Trainer (CYDEST) as shown in Figure 7. 61
15 Figure 7. CYDEST Architecture [95] It uses virtual machines to provide tactical level exercises for personnel such as network administrators, first responders, and digital forensics investigators. These papers describe methods and techniques for virtualization of digital forensics to help prevent cyber attack. 3.9 Information Recovery Information recovery is one of the important processes in digital forensics. Evidence of a crime may reside in a deleted . So a proper technique should be used to recover the information back without changing the original content of the . As mentioned by (John Shaw et al) the solution to recover the deleted is by expose reverse engineering on how the was deleted. The may be manually deleted by the user or criminal to remove the evidences, or it might happen in some cases that the database is corrupted or hacked by unauthorized personnel. To recover the removed , the recovery process will be performed from vendor site that can provide a backup plan, which is called as Cache Exchange mode. The data must be synchronized to the server. The deleted will remain as deleted mail until someone tries to up it back, when the machines or servers get synchronize together. The second method is using parents and orphanage method which recover the based on the type of file or software used, for example using Microsoft Outlook. The can be recovered by looking at history of for a particular period. This is due to the Windows method that delete the depends on the flag. The second issue is to recover the password protected account or system in organization. Khawla et al discussed on the paper [53] how to generate individual- related electronic profile and recover the password protected account or system and save time consuming. There are several methods that can be used to recover the password. It can be a complex method like recovering from Random Access Memory (RAM) or even use the social engineering method. Social engineering is proven to be an effective method to gain the password upon a password-protected system or machine. It utilizes the vulnerability of human factor to recover the password. The factor of an individual behavior also plays an important part in recovery password. Some people are sharing the same password with their colleagues for different machine Password also can be recovered back by using software like PRTK, John theripper, L0phtCrack, Cain & Abel and Paraben s Decryption Collection. All these software also can be used in brute attack. The privacy issues related to the topic is that the investigators who perform information recovery shall not hold the interesting data, which is not relevant to the case for their own agenda. For example, the recovered password, which has been used by the user, may be used to access different machine or accounts that used the same password. If the password has been used for the purpose 62
16 other than evidence recovery, it may violate the users privacy Video Analytics There are many tools that can be applied to aid in the digital forensic analysis, whether it is a software tool or hardware tool. Some manufacture like Samsung providing the device like digital video recorder (DVR) to perform an analysis in imaging digital forensic [48]. The device designed with two separated hard disk to perform particular recording and testing. It is also for minimizing the error occurs during the video forensic investigation. This device is able to compress the video recorded in the form of MPEG-4 format and store in the video file. Furthermore, it is capable to transfer the video into a PC (Samsung 2005) in real-time connection. The investigation of video recorded can refer to the time and date stated on the image display. The primary and secondary hard disks are divided into three partitions. The first partition is ect whixh is used to store event and system log file. The second partition is bin directory which contains operating system executable files. The third partition is root directory that is used for bookkeeping files for example. db and.eve files. Therefore, the history of logged files will be recorded in hard disks accordingly. In addition, Closed Circuit Television (CCTV) also an effective way in providing an image for digital forensics investigation [59]. The video data will be extracted before it can gain access to manufacturer s application software. The image will be stored on the CCTV disk as well as digital video recorder. However, the disk must not overload with data in order to provide the best result of the initial investigation. The papers mentioned in this topic contain the related issues with privacy regarding the structure of the hard disk. The information about the structure may be a copyrighted information which should be available on the manufacturer side only and not for other parties. The history in the log file may reveal user activity that may be private to the user and should be accessible by other person Cybercrime The author describes the method of Strategy of Triple-E (SeTO) in solving trojan defense in cyber crime in [28]. It is used to defend the computer from any risk of trojan effects on any matters. The trojans can be used to track the password of a machine. The result used in the log history and kept on the server cannot be trusted to keep the best data or information. The computer/cyber/it forensic helps the examiner to investigate and undercover the data that may not be immediately obvious. The author express to use M-N method where M is the path, N is the period of login and logout. In evidential part, the collected data must be handled with care so that it will not cause any problem in the court. The company or organization must have a well structured for employment and management. This may protect the company network from being attacked by intruders. If the is saved on the computer, then the comes together with the header details (date, sender, subject &etc). If the s are investigated as a disciplinary measure, the organization/company should abide by that law. 63
17 3.12 Legal Compliance Computer forensics investigation includes legal aspects of handling computer forensics as well as forensic investigation. This is including the creation of law or act implementation and the involvement of management in the relevance of computer forensic investigation. In [10] the author has discussed regarding the implementation of computer forensic and forensic investigation in United State. Generally, the aim of the computer forensic policy is to protect the organization with the private data and the employee. A corporate computer policy should ideally cover the installation of unauthorized software within the employee machines, including the digital portable storage device and also the home use of the corporate network. The IT Manager should implement the policy precisely in order to allow or restrict which website can be accessed from internal network. There might be very hard to control and manage the portable storage device and home corporate network. However, the computer forensic policy should cover this level of application to ascertain the organization parameter during any misuse. Moreover, the sensitive company information can be at particular risk from home based computer or any portable device. The author declared that the security of home-based computer could be increased if the company policy might include the appropriate rule and standard like; changing the password regularly, disable USB port and use the office machine to prevent spyware. In paper [11], it describes the legal actions towards an s investigation approach. The investigation activities gather all the information sent through an conversation regarding a criminal activity. The forensic handler can gain the information about the event, the people or organization involved, that take a biggest evidence to bring to court. It also involve of recovery method. Basically, there are two types of technique, which is employed in investigating ; content-based analysis and event-based analysis. The content-based analysis requires the examiner to read the content of and figure out the critical information inside. It provides the rich information about the whole picture of crime. While the event-based analysis required the examiner to figure out about the time and date that the has been sent from a person to another. It can provide the pattern collection of who are the persons involved in the specific crime. These papers are providing a discussion about the boundaries in the view of legal aspect involved in a digital forensic area that also relate to the privacy of the users Intrusion Detection Even though wireless communications are good in providing mobile internet access to the user, it is still vulnerable and easily exposed to interception of eavesdropper along the way of information transmission. The security mechanism such as Wired Equivalent Privacy (WEP) and WiFi Protected Access (WAP) are not sufficiently capable of providing a guaranteed security in wireless communication. The tools like clock skew and click print are able to provide the information of IP addresses or websites that the user browses the most. The user identity including the Medium Access Control (MAC) and IP address are not 64
18 sufficiently protected if they are using the wireless transmission medium. This information are captured by using tools like Wireshark and tcpdump, while the WiGLE.net tool is able to track the location of which the Access Point device is logging from. On the other hand, the network traffic can be investigated through monitoring methodologies that are able to analyze and access to the network performance [12]. The monitoring mechanism can be either in wired or wireless techniques. The wired monitoring system is connected to a sniffer, which illegally accesses the network through a wired connection to any machine. It collects the information of network traffic. Furthermore, the network can be monitored using the Simple Network Management Protocol (SNMP) statistic. In a wireless network, the monitoring behavior is more sensitive to the physical information. It is deployed with portable mechanism, which is allowing users to access in mobile. The Access Point must be carefully organized with appropriate authorization by the network administrator. In order to detect any unauthorized AP in the network, an advanced monitoring fingerprint scheme is suggested in 4-tupple. Furthermore, the misbehavior of MAC Layer can be detected using compromise the protocol parameter. In conclusion, network traffic analysis can be diagnosed using the user fingerprinting technique. The intrusion detection system also might expose users private information traveling on the network. In the hand of authorized person the privacy issues is not severe as if the system controlled by unethical person. The unethical person might use the private information available in a system that violates user s privacy Attack Trace/Pattern Analysis Collecting a huge amount of data can be a tough procedure for a cyber forensic practitioner during the investigation. An appropriate framework of data collection is discussed in [50]. There are few methods to be implemented but one after all is graph-based clustering. The experiment applied by placing the 44 honeypot sensors in different locations using the different IP address. The graph or result illustration is using the Symbolic Aggregate Approximation (SAX). Based on the graph, it showed that the attack came in small traffic volume [53]. To be flexible in doing analysis, the analyst plugs into the machine with different application. The more flexible the machine, the more malicious attack can be investigated. The framework mentioned in the paper includes a certain flexibility that allows analysts to plug in different feature vectors and appropriate similarity metrics to be used in the clustering step, depending on the attack features they might find relevant to investigate. The contribution is being able to draw knowledge out of honeynet data by discovering attack patterns via attack trace similarity, rather than via a rigid signature. The relationship between the topic and privacy issues that can be concluded is that, the investigator must maintain the ethical behavior while performing analysis of the patterns/traces in their collected data because some of the data contain private information that belongs to another user and not the attacker Investigation In [56], the author described about the method to recover the data or lost 65
19 in the digital forensic investigation. The fastest method is by using the reverse engineering from how the is deleted (the exchange server is corrupted, the laptop is purposely crashed). The evidence of lost file in said to be handled with care since the file can be very fragile. It is important to establish the authenticity of an electronic file or in the organization. An incident handler is able to discover the evidence that is buried within temporary files, replicated files, swap files, other system-created files or in a computer s unallocated space. The task is performed thorough searches of storage media relating to previous deleted or erased documents, parts of documents or drafts of documents. Parts of the document may consist of private data which irrelevant to the crime. Therefore, the investigator must differentiate and prioritize the content to avoid any privacy issue Incidence Response Incident responder is the main body to recover the cyber forensic investigation of a company or organization. The level of complexity relies on the size and nature of a company. In paper [78] it discussed on the responsibilities of an incident responder who may carry out planning, preparing, management toward incident in network, system, mobile device or even in a cloud computing. Planning and preparing involves drafting the guideline and the development of training programs. Incident responder is the one who educating their internal workers upon the security on the network and regularly monitor whether the workers are continuously following the network security rules and approach. Educating might take throughout the message or up to workshop program. Besides that, they should provide internal consultation regarding the technical nature. From time to time, they are responsible to execute the computer forensic tasks throughout the digital evidence management process. In order to have up-to-date point of vulnerabilities of hacking, the incident response team has to give support for analysis of IT company and network architecture [81]. The incident response can be handled using technological alternatives locally or remotely. The most important issue during an investigation is the availability of the media required. To resolve this kind of problem, some IT vendor implemented the agent-based architectural approach to allow access in multiple level or authenticity, from a most volatile data until to the most static data [88]. For the small cost forensic investigation, the remote forensic is applicable without requiring the agentbased analysis. The remote forensic cost is so low and currently it is available in ISCSI standard which allowing readonly access toward the targeted machine. The most application medium to run the remote-forensic is through VPN network. Some vendors develop the interesting agent-based architectural solution to allowing the multiple accesses to target machine. With highly concern demand in today network security implementation, an organization is hiring an incident responder to apply the best evidence collection and preservation practices. Therefore, the income of the incident responders should be justified with their responsibility to avoid any illegal action like gathering private data of the company or other employee that will lead to violation of the privacy issues. 66
20 3.17 Forensic Vendors The author describes about the similarities and differences between Private Investigation (PI) and Digital Investigation (DI). Generally, PI is a profession regulated by state, federal or international law [79]. Both PI and DI investigator have to follow the code of ethic and technical guidelines. They also required to have professional insurance. Performing an investigation also considered to be properly authorized by a legal organization background. The violation of a simple rule could result in legal liability. As an incident responder, they could be asked to perform a sort of wiretapping, eavesdropping and be specialized in electronic surveillance program. A PI and DI must maintain a behavior based on integrity and ethic. Otherwise, they might break the privacy of the data that should be handled by ethical people Anti-Forensic Approaches The paper [89], discuss about the vulnerabilities involve in digital forensic software. As widely marketed, the forensic software may lead to defenseless state which might expose the collected information to the third party. The level of vulnerabilities is unlimited and can be exploited through software architecture, type of file, level of patching and etc. Thus, it is crucial to practice the administrative and authentication policy in IT system. As explained in [92] there will be no software is completely crash proof, as there will be an abnormality that involves of disfigure the data Network Data Analysis Nowadays, the demand for IT gadget become rapidly increasing. The issues of networking become crucial in providing a connection between users. Besides providing the unlimited access to internet application and able to communicate between each other, the reliability of other IT gadget networking lies on how effective they can correspond to another device. In [45], the communication among those gadgets depends on lower-layer binary network signature like socket and packet data structure. In order to carve the network, the open source forensic tool is developed called as scan_net. On network ground truth data, the data is securely erased and the Windows is installed with a virgin copy of the OS. The machine then connected to multiple numbers of servers, run the file transfer process and the packet entering and leaving the network is monitored using the promiscuous recorder. The tool carves the network on a specific level accordingly; IP address, Socket Structure, Windows and Ethernet level. On IP address carves, the potential IP address will be checked either in TCP or UDP protocol. Once it is possible, the IP address checksum will be performed in order to validate the correct IP address. On Socket Structure carving, the correct socket and port will be identified Data Integrity The popularity of cloud storage services (CSS) grows rapidly in recent years. The cloud storage services provide lower cost to the data owner and it does not depend on a specific location for the data owner to consider. The client or the data 67
Digital Forensic Trends and Future
Digital Forensic Trends and Future Farhood Norouzizadeh Dezfoli, Ali Dehghantanha, Ramlan Mahmoud, Nor Fazlida Binti Mohd Sani, Farid Daryabar Faculty of Computer Science and Information Technology UniversityMore information
2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetectedMore information
Hands-On How-To Computer Forensics Training
j8fm6pmlnqq3ghdgoucsm/ach5zvkzett7guroaqtgzbz8+t+8d2w538ke3c7t 02jjdklhaMFCQHihQAECwMCAQIZAQAKCRDafWsAOnHzRmAeAJ9yABw8v2fGxaq skeu29sdxrpb25zidxpbmznogtheories...ofhilz9e1xthvqxbb0gknrc1ng OKLbRXF/j5jJQPxXaNUu/It1TQHSiyEumrHNsnn65aUMPnrbVOVJ8hV8NQvsUEMore information
Ensuring Security in Cloud with Multi-Level IDS and Log Management System
Ensuring Security in Cloud with Multi-Level IDS and Log Management System 1 Prema Jain, 2 Ashwin Kumar PG Scholar, Mangalore Institute of Technology & Engineering, Moodbidri, Karnataka1, Assistant Professor,More information
Chapter 1: Introduction
Chapter 1 Introduction 1 Chapter 1: Introduction 1.1 Inspiration Cloud Computing Inspired by the cloud computing characteristics like pay per use, rapid elasticity, scalable, on demand self service, secureMore information
Ten Deadly Sins in Wireless Security
Ten Deadly Sins in Wireless Security The emergence and popularity of wireless devices and wireless networks has provided a platform for real time communication and collaboration. This emergence has createdMore information
information security and its Describe what drives the need for information security.
Computer Information Systems (Forensics Classes) Objectives for Course Challenges CIS 200 Intro to Info Security: Includes managerial and Describe information security and its critical role in business.More information
Unified Security Management
Unified Security Reduce the Cost of Compliance Introduction In an effort to achieve a consistent and reliable security program, many organizations have adopted the standard as a key compliance strategyMore information
10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft)
1- A (firewall) is a computer program that permits a user on the internal network to access the internet but severely restricts transmissions from the outside 2- A (system failure) is the prolonged malfunctionMore information
Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation
Computer Forensics and Digital Investigation Computer Security EDA263, lecture 14 Ulf Larson Lecture outline! Introduction to Computer Forensics! Digital investigation! Conducting a Digital Crime SceneMore information
7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. riskMore information
ERNW Newsletter 29 / November 2009
ERNW Newsletter 29 / November 2009 Dear Partners and Colleagues, Welcome to the ERNW Newsletter no. 29 covering the topic: Data Leakage Prevention A Practical Evaluation Version 1.0 from 19th of novemberMore information
GFI White Paper PCI-DSS compliance and GFI Software products
White Paper PCI-DSS compliance and Software products The Payment Card Industry Data Standard () compliance is a set of specific security standards developed by the payment brands* to help promote the adoptionMore information
Digital Forensic. A newsletter for IT Professionals. I. Background of Digital Forensic. Definition of Digital Forensic
I Digital Forensic A newsletter for IT Professionals Education Sector Updates Issue 10 I. Background of Digital Forensic Definition of Digital Forensic Digital forensic involves the collection and analysisMore information
Monitoring Traffic manager
Monitoring Traffic manager eg Enterprise v6 Restricted Rights Legend The information contained in this document is confidential and subject to change without notice. No part of this document may be reproducedMore information
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design Learning Objectives Identify common misconceptions about firewalls Explain why a firewallMore information
Top Three POS System Vulnerabilities Identified to Promote Data Security Awareness
CISP BULLETIN Top Three POS System Vulnerabilities Identified to Promote Data Security Awareness November 21, 2006 To support compliance with the Cardholder Information Security Program (CISP), Visa USAMore information
Incident Response. Six Best Practices for Managing Cyber Breaches. www.encase.com
Incident Response Six Best Practices for Managing Cyber Breaches www.encase.com What We ll Cover Your Challenges in Incident Response Six Best Practices for Managing a Cyber Breach In Depth: Best PracticesMore information
Incident Response and Computer Forensics
Incident Response and Computer Forensics James L. Antonakos WhiteHat Forensics Incident Response Topics Why does an organization need a CSIRT? Who s on the team? Initial Steps Detailed Project Plan IncidentMore information
Concepts of digital forensics
Chapter 3 Concepts of digital forensics Digital forensics is a branch of forensic science concerned with the use of digital information (produced, stored and transmitted by computers) as source of evidenceMore information
Deploying Firewalls Throughout Your Organization
Deploying Firewalls Throughout Your Organization Avoiding break-ins requires firewall filtering at multiple external and internal network perimeters. Firewalls have long provided the first line of defenseMore information
The Benefits of SSL Content Inspection ABSTRACT
The Benefits of SSL Content Inspection ABSTRACT SSL encryption is the de-facto encryption technology for delivering secure Web browsing and the benefits it provides is driving the levels of SSL trafficMore information
Network Security 網 路 安 全. Lecture 1 February 20, 2012 洪 國 寶
Network Security 網 路 安 全 Lecture 1 February 20, 2012 洪 國 寶 1 Outline Course information Motivation Introduction to security Basic network concepts Network security models Outline of the course 2 CourseMore information
Building A Secure Microsoft Exchange Continuity Appliance
Building A Secure Microsoft Exchange Continuity Appliance Teneros, Inc. 215 Castro Street, 3rd Floor Mountain View, California 94041-1203 USA p 650.641.7400 f 650.641.7401 ON AVAILABLE ACCESSIBLE BuildingMore information
e-discovery Forensics Incident Response
e-discovery Forensics Incident Response NetSecurity Corporation 21351 Gentry Drive Suite 230 Dulles, VA 20166 VA DCJS # 11-5605 Phone: 703.444.9009 Toll Free: 1.866.664.6986 Web: www.netsecurity.com Email:More information
Guideline on Auditing and Log Management
CMSGu2012-05 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Auditing and Log Management National Computer Board MauritiusMore information
MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1
MSc Computer Security and Forensics Cohort: MCSF/09B/PT Examinations for 2009-2010 / Semester 1 MODULE: COMPUTER FORENSICS & CYBERCRIME MODULE CODE: SECU5101 Duration: 2 Hours Instructions to Candidates:More information
Information Technology Audit & Forensic Techniques. CMA Amit Kumar
Information Technology Audit & Forensic Techniques CMA Amit Kumar 1 Amit Kumar & Co. (Cost Accountants) A perfect blend of Tax, Audit & Advisory services Information Technology Audit & Forensic TechniquesMore information
A Review of Anomaly Detection Techniques in Network Intrusion Detection System
A Review of Anomaly Detection Techniques in Network Intrusion Detection System Dr.D.V.S.S.Subrahmanyam Professor, Dept. of CSE, Sreyas Institute of Engineering & Technology, Hyderabad, India ABSTRACT:InMore information
Symantec Cyber Threat Analysis Program Program Overview. Symantec Cyber Threat Analysis Program Team
Symantec Cyber Threat Analysis Program Symantec Cyber Threat Analysis Program Team White Paper: Symantec Security Intelligence Services Symantec Cyber Threat Analysis Program Contents Overview...............................................................................................More information
Second-generation (GenII) honeypots
Second-generation (GenII) honeypots Bojan Zdrnja CompSci 725, University of Auckland, Oct 2004. firstname.lastname@example.com Abstract Honeypots are security resources which trap malicious activities, so theyMore information
ICTN 4040. Enterprise Database Security Issues and Solutions
Huff 1 ICTN 4040 Section 001 Enterprise Information Security Enterprise Database Security Issues and Solutions Roger Brenton Huff East Carolina University Huff 2 Abstract This paper will review some ofMore information
Overview of Computer Forensics
Overview of Computer Forensics Don Mason, Associate Director National Center for Justice and the Rule of Law University of Mississippi School of Law [These materials are based on 4.3.1-4.3.3 in the NationalMore information
PSG College of Technology, Coimbatore-641 004 Department of Computer & Information Sciences BSc (CT) G1 & G2 Sixth Semester PROJECT DETAILS.
PSG College of Technology, Coimbatore-641 004 Department of Computer & Information Sciences BSc (CT) G1 & G2 Sixth Semester PROJECT DETAILS Project Project Title Area of Abstract No Specialization 1. SoftwareMore information
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In aMore information
Certified Information Systems Auditor (CISA)
Certified Information Systems Auditor (CISA) Course Introduction Course Introduction Module 01 - The Process of Auditing Information Systems Lesson 1: Management of the Audit Function Organization of theMore information
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry EnterpriseMore information
Getting Physical with the Digital Investigation Process
Getting Physical with the Digital Investigation Process Brian Carrier Eugene H. Spafford Center for Education and Research in Information Assurance and Security CERIAS Purdue University Abstract In thisMore information
Advanced File Integrity Monitoring for IT Security, Integrity and Compliance: What you need to know
Whitepaper Advanced File Integrity Monitoring for IT Security, Integrity and Compliance: What you need to know Phone (0) 161 914 7798 www.distology.com firstname.lastname@example.com detecting the unknown IntegrityMore information
Computer Intrusion Forensics Literature Review
Computer Intrusion Forensics Literature Review Nathan Balon CIS 544 October 20, 2003 Title Computer Forensics: Incident Response Essentials by Warren G. Kruse II and Jay G. Heiser Reviewed by Nathan BalonMore information
Network Management and Monitoring Software
Page 1 of 7 Network Management and Monitoring Software Many products on the market today provide analytical information to those who are responsible for the management of networked systems or what theMore information
Managing IT Security with Penetration Testing
Managing IT Security with Penetration Testing Introduction Adequately protecting an organization s information assets is a business imperative one that requires a comprehensive, structured approach toMore information
CERIAS Tech Report 2003-29 GETTING PHYSICAL WITH THE DIGITAL INVESTIGATION PROCESS. Brian Carrier & Eugene H. Spafford
CERIAS Tech Report 2003-29 GETTING PHYSICAL WITH THE DIGITAL INVESTIGATION PROCESS Brian Carrier & Eugene H. Spafford Center for Education and Research in Information Assurance and Security, Purdue University,More information
SECURITY AND PRIVACY ISSUES IN A KNOWLEDGE MANAGEMENT SYSTEM Chandramohan Muniraman, Meledath Damodaran, Amanda Ryan University of Houston-Victoria Abstract As in any information management system securityMore information
Semantic based Web Application Firewall (SWAF V 1.6) Operations and User Manual. Document Version 1.0
Semantic based Web Application Firewall (SWAF V 1.6) Operations and User Manual Document Version 1.0 Table of Contents 1 SWAF... 4 1.1 SWAF Features... 4 2 Operations and User Manual... 7 2.1 SWAF AdministratorMore information
Loophole+ with Ethical Hacking and Penetration Testing
Loophole+ with Ethical Hacking and Penetration Testing Duration Lecture and Demonstration: 15 Hours Security Challenge: 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once said,More information
Linux Technologies QUARTER 1 DESKTOP APPLICATIONS - ESSENTIALS QUARTER 2 NETWORKING AND OPERATING SYSTEMS ESSENTIALS. Module 1 - Office Applications
NETWORK ENGINEERING TRACK Linux Technologies QUARTER 1 DESKTOP APPLICATIONS - ESSENTIALS Module 1 - Office Applications This subject enables users to acquire the necessary knowledge and skills to use OfficeMore information
Network Based Intrusion Detection Using Honey pot Deception
Network Based Intrusion Detection Using Honey pot Deception Dr.K.V.Kulhalli, S.R.Khot Department of Electronics and Communication Engineering D.Y.Patil College of Engg.& technology, Kolhapur,Maharashtra,India.More information
Wireless Network Security
Wireless Network Security Bhavik Doshi Privacy and Security Winter 2008-09 Instructor: Prof. Warren R. Carithers Due on: February 5, 2009 Table of Contents Sr. No. Topic Page No. 1. Introduction 3 2. AnMore information
Detecting Threats in Network Security by Analyzing Network Packets using Wireshark
1 st International Conference of Recent Trends in Information and Communication Technologies Detecting Threats in Network Security by Analyzing Network Packets using Wireshark Abdulalem Ali *, Arafat Al-Dhaqm,More information
Features of AnyShare
of AnyShare of AnyShare CONTENT Brief Introduction of AnyShare... 3 Chapter 1 Centralized Management... 5 1.1 Operation Management... 5 1.2 User Management... 5 1.3 User Authentication... 6 1.4 Roles...More information
Plain English Guide To Common Criteria Requirements In The. Field Device Protection Profile Version 0.75
Plain English Guide To Common Criteria Requirements In The Field Device Protection Profile Version 0.75 Prepared For: Process Control Security Requirements Forum (PCSRF) Prepared By: Digital Bond, Inc.More information
INSTANT MESSAGING SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in partMore information
Device Fingerprinting and Fraud Protection Whitepaper
Device Fingerprinting and Fraud Protection Whitepaper 1 of 6 Table Of Contents 1 Overview... 3 2 What is Device Fingerprinting?... 3 3 Why is Device fingerprinting necessary?... 3 4 How can Device FingerprintingMore information
Applying machine learning techniques to achieve resilient, accurate, high-speed malware detection
White Paper: Applying machine learning techniques to achieve resilient, accurate, high-speed malware detection Prepared by: Northrop Grumman Corporation Information Systems Sector Cyber Solutions DivisionMore information
Microsoft Technologies
NETWORK ENGINEERING TRACK Microsoft Technologies QUARTER 1 DESKTOP APPLICATIONS - ESSENTIALS Module 1 - Office Applications This subject enables users to acquire the necessary knowledge and skills to useMore information
WHITE PAPER MANAGED FILE TRANSFER: 10 STEPS TO SOX COMPLIANCE 1. OVERVIEW Do you want to design a file transfer process that is secure? Or one that is compliant? Of course, the answer is both. But it sMore information
Driving Company Security is Challenging. Centralized Management Makes it Simple.
Driving Company Security is Challenging. Centralized Management Makes it Simple. Overview - P3 Security Threats, Downtime and High Costs - P3 Threats to Company Security and Profitability - P4 A RevolutionaryMore information
Seven Things To Consider When Evaluating Privileged Account Security Solutions
Seven Things To Consider When Evaluating Privileged Account Security Solutions Contents Introduction 1 Seven questions to ask every privileged account security provider 4 1. Is the solution really secure?More information
Keyword: Cloud computing, service model, deployment model, network layer security.
Volume 4, Issue 2, February 2014 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com An EmergingMore information
Data Security Initiatives. The Layered Approach. Melissa Perisce Regional Director, Global Services, South Asia April 25, 2010
Data Security Initiatives The Layered Approach Melissa Perisce Regional Director, Global Services, South Asia April 25, 2010 2009 Verizon. All Rights Reserved. PTEXXXXX XX/09 Intel Case Study Asia NorthMore information
The Impact of Wireless LAN Technology on Compliance to the PCI Data Security Standard
The Impact of Wireless LAN Technology on to the PCI Data Security Standard 339 N. Bernardo Avenue, Suite 200 Mountain View, CA 94043 www.airtightnetworks.net Wireless LANs and PCI Retailers today use computersMore information
Usage of OPNET IT tool to Simulate and Test the Security of Cloud under varying Firewall conditions
Usage of OPNET IT tool to Simulate and Test the Security of Cloud under varying Firewall conditions GRADUATE PROJECT REPORT Submitted to the Faculty of The School of Engineering & Computing Sciences TexasMore information
Getting Ahead of Malware
IT@Intel White Paper Intel Information Technology Security December 2009 Getting Ahead of Malware Executive Overview Since implementing our security event monitor and detection processes two years ago,More information
Ten Deadly Sins of Computer Forensics
Ten Deadly Sins of Computer Forensics Cyber criminals take advantage of the anonymity of the Internet to escape punishment. Computer Forensics has emerged as a new discipline to counter cyber crime. ThisMore information
A SECURITY ARCHITECTURE FOR AGENT-BASED MOBILE SYSTEMS. N. Borselius 1, N. Hur 1, M. Kaprynski 2 and C.J. Mitchell 1
A SECURITY ARCHITECTURE FOR AGENT-BASED MOBILE SYSTEMS N. Borselius 1, N. Hur 1, M. Kaprynski 2 and C.J. Mitchell 1 1 Royal Holloway, University of London 2 University of Strathclyde ABSTRACT Future mobileMore information
SCADA SYSTEMS AND SECURITY WHITEPAPER Abstract: This paper discusses some of the options available to companies concerned with the threat of cyber attack on their critical infrastructure, who as part ofMore information
From Network Security To Content Filtering
Computer Fraud & Security, May 2007 page 1/10 From Network Security To Content Filtering Network security has evolved dramatically in the last few years not only for what concerns the tools at our disposalsMore information
THE ROLE OF IDS & ADS IN NETWORK SECURITY The Role of IDS & ADS in Network Security When it comes to security, most networks today are like an egg: hard on the outside, gooey in the middle. Once a hackerMore information
Cisco Advanced Malware Protection for Endpoints
Data Sheet Cisco Advanced Malware Protection for Endpoints Product Overview With today s sophisticated malware, you have to protect endpoints before, during, and after attacks. Cisco Advanced Malware ProtectionMore information
The SIEM Evaluator s Guide
Using SIEM for Compliance, Threat Management, & Incident Response Security information and event management (SIEM) tools are designed to collect, store, analyze, and report on log data for threat detection,More information
DIGITAL RIGHTS MANAGEMENT SYSTEM FOR MULTIMEDIA FILES Saiprasad Dhumal * Prof. K.K. Joshi Prof Sowmiya Raksha VJTI, Mumbai. VJTI, Mumbai VJTI, Mumbai. Abstract piracy of digital content is a one of theMore information
RingStor User Manual. Version 2.1 Last Update on September 17th, 2015. RingStor, Inc. 197 Route 18 South, Ste 3000 East Brunswick, NJ 08816.
RingStor User Manual Version 2.1 Last Update on September 17th, 2015 RingStor, Inc. 197 Route 18 South, Ste 3000 East Brunswick, NJ 08816 Page 1 Table of Contents 1 Overview... 5 1.1 RingStor Data Protection...More information
Protecting Your Organisation from Targeted Cyber Intrusion
Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technologyMore information
Windows Operating Systems. Basic Security
Windows Operating Systems Basic Security Objectives Explain Windows Operating System (OS) common configurations Recognize OS related threats Apply major steps in securing the OS Windows Operating SystemMore information
FORBIDDEN - Ethical Hacking Workshop Duration
Workshop Course Module FORBIDDEN - Ethical Hacking Workshop Duration Lecture and Demonstration : 15 Hours Security Challenge : 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood onceMore information
Comprehensive Advanced Threat Defense
1 Comprehensive Advanced Threat Defense June 2014 PAGE 1 PAGE 1 1 INTRODUCTION The hot topic in the information security industry these days is Advanced Threat Defense (ATD). There are many definitions,More information
Digital Forensic Techniques
Digital Forensic Techniques Namrata Choudhury, Sr. Principal Information Security Analyst, Symantec Corporation Professional Techniques T23 CRISC CGEIT CISM CISA AGENDA Computer Forensics vs. Digital ForensicsMore information
Workflow Templates Library
Workflow s Library Table of Contents Intro... 2 Active Directory... 3 Application... 5 Cisco... 7 Database... 8 Excel Automation... 9 Files and Folders... 10 FTP Tasks... 13 Incident Management... 14 SecurityMore information
Technical Standards for Information Security Measures for the Central Government Computer Systems
Technical Standards for Information Security Measures for the Central Government Computer Systems April 21, 2011 Established by the Information Security Policy Council Table of Contents Chapter 2.1 General...More information
Information Security Basic Concepts
Information Security Basic Concepts 1 What is security in general Security is about protecting assets from damage or harm Focuses on all types of assets Example: your body, possessions, the environment,More information
Preparing for a Cyber Attack PROTECT YOUR PEOPLE AND INFORMATION WITH SYMANTEC SECURITY SOLUTIONS
Preparing for a Cyber Attack PROTECT YOUR PEOPLE AND INFORMATION WITH SYMANTEC SECURITY SOLUTIONS CONTENTS PAGE RECONNAISSANCE STAGE 4 INCURSION STAGE 5 DISCOVERY STAGE 6 CAPTURE STAGE 7 EXFILTRATION STAGEMore information
nwstor Storage Security Solution 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4.
CONTENTS 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4. Conclusion 1. EXECUTIVE SUMMARY The advantages of networked data storage technologies suchMore information
Penetration Testing Service. By Comsec Information Security Consulting
Penetration Testing Service By Consulting February, 2007 Background The number of hacking and intrusion incidents is increasing year by year as technology rolls out. Equally, there is no hiding place yourMore information
The evolution of data connectivity
Leveraging the Benefits of IP and the Cloud in the Security Sector The CCTV and alarm industry has relied on analogue or Integrated Services Digital Network (ISDN) communications to provide data connectivityMore information
AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE THE CHALLENGE: SECURE THE OPEN AIR Wirelesss communication lets you take your business wherever your customers,More information
IS TEST 3 - TIPS FOUR (4) levels of detective controls offered by intrusion detection system (IDS) methodologies. First layer is typically responsible for monitoring the network and network devices. NIDSMore information
Content Teaching Academy at James Madison University
Content Teaching Academy at James Madison University 1 2 The Battle Field: Computers, LANs & Internetworks 3 Definitions Computer Security - generic name for the collection of tools designed to protectMore information
Covert Channels. Some instances of use: Hotels that block specific ports Countries that block some access
Covert Channels Covert Channels Tunnels that are used to bypass filters and intrusion detection systems Use traffic that is thought to be something else (i.e. DNS tunnels) Can also provide encryption (i.e.More information
Guidelines on Digital Forensic Procedures for OLAF Staff
Ref. Ares(2013)3769761-19/12/2013 Guidelines on Digital Forensic Procedures for OLAF Staff 1 January 2014 Introduction The OLAF Guidelines on Digital Forensic Procedures are internal rules which are toMore information
IBM Connections Cloud Security
IBM Connections White Paper September 2014 IBM Connections Cloud Security 2 IBM Connections Cloud Security Contents 3 Introduction 4 Security-rich Infrastructure 6 Policy Enforcement Points Provide ApplicationMore information
PAVING THE PATH TO THE ELIMINATION A RSACCESS WHITE PAPER 1 The Traditional Role of DMZ 2 The Challenges of today s DMZ deployments 2.1 Ensuring the Security of Application and Data Located in the DMZMore information
AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE THE CHALLENGE: SECURE THE OPEN AIR Wirelesss communication lets you take your business wherever your customers,More information
End-user Security Analytics Strengthens Protection with ArcSight
Case Study for XY Bank End-user Security Analytics Strengthens Protection with ArcSight INTRODUCTION Detect and respond to advanced persistent threats (APT) in real-time with Nexthink End-user SecurityMore information
COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL) COURSE DESCRIPTION: Computer Forensics is focused on teachingMore information
Secure Networks for Process Control
Secure Networks for Process Control Leveraging a Simple Yet Effective Policy Framework to Secure the Modern Process Control Network An Enterasys Networks White Paper There is nothing more important thanMore information
BlackBerry 10.3 Work and Personal Corporate
GOV.UK Guidance BlackBerry 10.3 Work and Personal Corporate Published Contents 1. Usage scenario 2. Summary of platform security 3. How the platform can best satisfy the security recommendations 4. NetworkMore information
What IT Auditors Need to Know About Secure Shell. SSH Communications Security
What IT Auditors Need to Know About Secure Shell SSH Communications Security Agenda Secure Shell Basics Security Risks Compliance Requirements Methods, Tools, Resources What is Secure Shell? A cryptographicMore information
THE SMARTEST WAY TO PROTECT WEBSITES AND WEB APPS FROM ATTACKS INCONVENIENT STATISTICS 70% of ALL threats are at the Web application layer. Gartner 73% of organizations have been hacked in the past twoMore information
Enhancing Organizational Security Through the Use of Virtual Smart Cards
Enhancing Organizational Security Through the Use of Virtual Smart Cards Today s organizations, both large and small, are faced with the challenging task of securing a seemingly borderless domain of companyMore information


text:
Paula K. Jones 434-856-8176
Feb. 15, 2016
Roads are snow covered throughout area
LYNCHBURG- Roads throughout much of south-central Virginia are snow covered this morning, with patches of snow or ice in the most southern counties of the Lynchburg District of the Virginia Department of Transportation (VDOT). The Lynchburg District covers the counties of Amherst, Appomattox, Buckingham, Campbell, Charlotte, Cumberland, Halifax, Nelson, Pittsylvania and Prince Edward.
VDOT crews have been working throughout the night on main roadways and will continue to do so as more snow and freezing rain are expected.
Drivers are encouraged to avoid travel if at all possible until the winter weather stops and snow plow operators can make more progress on roads.
While motorists are encouraged to avoid travel during hazardous weather conditions, particularly during periods of icing, if travel becomes necessary, motorists should:
- Knowing road conditions in advance of any travel. Check local media or visit www.511virginia.org and call 511.
- Driving for the conditions: Slow down, ensure that windows and lights are clear of any snow/ice, avoid any sudden stops or turns and allow extra time for travel.
- Be very careful on bridges, overpasses, and other areas prone to icy conditions.
Information in VDOT news releases was accurate at the time the release was published. For the most current information about projects or programs, please visit the project or program Web pages. You may find those by searching by keyword in the search Virginia DOT box above.

subset: commoncrawl


text:
Dr. Opanga graduates with a PhD
Submitted by d.omido on Thu, 2017-01-26 12:01
Dr. Sylvia Opanga during her graduation on 2nd December, 2016 at the University of Nairobi, Graduation Square.
Dr. Sylvia Opanga graduated on 2nd December, 2016 with a PhD in Clinical Pharmacy.
She was the first to attain a PhD in Clinical Pharmacy not only at the University of Nairobi but in Kenya, East and Central Africa.
The School of Pharmacy congratulates her on her achievement.


text:
Best regimen to determine resistance for phen/genotype testing.
Mar 15, 2001
Dear Doctor:
I have been HIV+ since 1986 and been on almost every drug available. I was diagnosed with PCP in 1993 and 1994 and was diagnosed with MAC shortly before starting Crixivan in 1995. At its lowest, my T-Cell count was 8. I had to stop Crixivan due to toxicity, but did achieve an undetectable VL even though I was taking Crixivan with previous antivirals. After Crixivan, I started on Nelfinavir and achieved an undetectable VL but a return to low level VL (less than 30,000) after several months. Part of this regimen included Preveon which caused mild kidney damage. I then started a ritonavir/saquinavir, sustiva, abacavir, 3TC, D4T salvage regimen which achieved an undetectable viral load for over 18 months. This regimen caused severe acid reflux and elevated blood pressure. In June, 2000, I had to stop medicines due to acute kidney failure caused by blood pressure reducing medicine. I have tried to restart my old regimen twice, once in August and again in January, but had to stop both times after a month due to gastrointestinal problems. The gastrointestinal problems are particularly worrisome due to potential for dehydration and further kidney damage.
I have been off meds except for prophylaxis since early February. My doctor and I are looking at what regimen to try next and I need your help. I was hoping I could try a regimen that doesnt include every drug known to man. My doctor wants to do phenotype and genotype resistance testing and wants me to try a bogus regimen of nelfinavir, azt and 3tc or d4t and 3tc. Or, he has suggested my old regimen minus 3tc or d4t. After a month, he would do the resistance testing and make decisions from there.
In 1997, I had a genotype with mutations at HIV gene pol amino acid #41, #67, #70, #135, #184, #210, #215 and #219.
What do you think? Any suggestions on what regimen to try in order to maximize the use of genotype and phenotype testing? Any feedback would be greatly appreciated. Your site has been a godsend over the years.
Response from Dr. Holodniy
The strategy proposed by your doctor has been used by many physicians to elicit resistant virus to come out after an interruption in HIV meds. The resistance test from 97 is helpful in that you have high level resistance to AZT, 3TC and abacavir. Those mutations also suggest that d4T resistance would be present (by virtue of the AZT or thymidine associated mutations). From the old test, there is no evidence of PI or NNRTI (sustiva or nevirapine) resistance. You have been exposed to 4 different PIs and one NNRTI, and we don't know the current status of their resistance, if any. TWo strategies are possible here. Restart ritonavir + either indinavir or saquinavir and sustiva and genotype in 1 month to determine the optimal approach. Or start fresh with Kaletra (lopinavir + ritonavir), ddI EC, and expanded access tenofovir. The likelihood of cross resistance with this regimen would be low.MH
Get Email Notifications When This Forum Updates or Subscribe With RSS
This forum is designed for educational purposes only, and experts are not rendering medical, mental health, legal or other professional advice or services. If you have or suspect you may have a medical, mental health, legal or other problem that requires advice, consult your own caregiver, attorney or other qualified professional.
Experts appearing on this page are independent and are solely responsible for editing and fact-checking their material. Neither TheBody.com nor any advertiser is the publisher or speaker of posted visitors' questions or the experts' material.
Review our complete terms of use and copyright notice.


text:
the debate surrounding the future of the old Royal High has been a passionate one.
When it was built almost 200 years ago, the school's imposing Greek pillars were about as typical of Edinburgh as a glass of ouzo. But generations since then have taken the building to their hearts and today everyone recognises it as one of the city's crown jewels. And everyone has a view on the best way to cherish and preserve it.
That debate has been described in recent weeks as a battle for the city's soul. That is over-dramatic. But at the same time it would be wrong to diminish the importance of this decision for the Capital.
We are lucky enough to live in one of the most beautiful cities in the world and everyone has an interest in keeping it that way. Of course, we all want our children to be able to enjoy the city as much as we do, but for so many of us these days, our jobs are tied up with the tourist trade which relies on our stunning built heritage for its success.
Everyone agrees that Edinburgh would be foolish to sacrifice its beauty – even for the £32 million a year and 640 jobs that the luxury hotel is expected to generate.
But a question that is rarely asked is who decides what makes Edinburgh beautiful? The debate so far has been dominated by a small handful of architects and professional heritage lobbyists. The general consensus – at least from the most vocal of them – seems to be that the "Inca terrace" hotel design would spoil an architectural masterpiece.
They are of course very knowledgeable, highly educated people, and entitled to their opinion as much as the next person. But their views are only that – opinions.
And today's survey of 5000 people on the city streets suggests they are wildly out of step with public opinion on the old Royal High. If Edinburgh belongs to anyone, it belongs to its people, and their views cannot be brushed aside.


text:
Erin Mahoney is a fine art photographer and photographic educator living in the Bay Area. She graduated with a Master of Fine Arts Degree in Photography from the Academy of Art University and also holds a Bachelor of Fine Arts Degree in Professional Photographic Illustration from the Rochester Institute of Technology. Erin teaches and develops various undergraduate photography courses at the Art Institute of California in Silicon Valley. She focuses on creating conceptual self-portraiture that marries contemporary photography with historical printing.
You can see her work here
Classes Erin Mahoney teaches at RayKo
Gum Bichromate Printing: Digital Capture to Historic Print


text:
The ship Indomitable, ca 1910s
Reference Number: 1/2-014697-G
The battle cruiser HMS Indomitable at sea. Taken by an unidentified photographer, circa 1910s.
Key terms:
1 image, related to Indomitable HMS (Ship) and Ships.
Part of:
Kinnear, James Hutchings, 1877-1946 :Negatives of Auckland shipping, boating and scenery, Reference Number PAColl-3053 (100 digitised items)
Extent: 1 b&w original negative(s)Gelatin dry plate negative. Single negative
Conditions governing access to original: Not restricted
Other copies available: File print available in Turnbull Library Pictures387. Indomitable.(PFP-020395)
Usage: You can search, browse, print and download items from this website for research and personal study. You are welcome to reproduce the above image(s) on your blog or another website, but please maintain the integrity of the image (i.e. don't crop, recolour or overprint it), reproduce the image's caption information and link back to here (http://mp.natlib.govt.nz/detail/?id=21809). If you would like to use the above image(s) in a different way (e.g. in a print publication), or use the transcription or translation, permission must be obtained. More information about copyright and usage can be found on the Copyright and Usage page of the NLNZ web site.
External Links:
View Full Descriptive Record in TAPUHI
View and/or order a copy of this image from Timeframes
View Archived Image on NDHA