HOME * THE * Digital Forensics Biblio What's New This Month! Blogs and Wikis Topic-Specific Resources The Other 'Good Stuff' Digital Forensic Books Links to Links About This Site

ARTICLES, PAPERS and PRESENTATIONS --- Authors Beginning with 'C' All Links Current as of June 25, 2007 C.A.T.C.H Team/High Tech Crime CATCH Project Description [PDF] Caldwell, Matthew Security Event Correlation – Security's Holy Grail? [PP Presentation] 2002 California High-Tech Task Force Committee Combating High-Tech Crime in California: The Task Force Approach [PDF] June 1997 Caloyannides, Michael Computer Forensics and Privacy Chapter 6 - Modes of Data Insertion and Acquistion [PDF] 2002 Digital "Evidence" May Not Be "Evidence" At All [PDF - Scroll down] February 2004 Campana, T.J. Microsoft Windows Vista Forensic Jumpstart [PDF Presentation] June 2007 Campbell, Duncan Police Tighten the Net September 1998 CanAudit Perspective Newsletter The Necessity for Computer Forensics January 2002 (from archive.org) Cannon, Richard Computer Forensics; What You Need to Know [PDF Presentation] October 2004 Carbone, M.D.P.A, Geus, P.L. A Mechanism for Automatic Digital Evidence Collection on High-Interaction Honeypots [PDF & PP Presentations] June 2004 Carlin, Anna Teaching Computer Forensics Using Student Developed Evidence Files [PP Presentation] March 2006 Carlin, Anna, Steven S. Curl, & Daniel Manson To Catch a Thief: Computer Forensics in the Classroom [PDF] October 2005 Carlson, Scott & Jim Vaughn eDiscovery Combining Forensics with Data Management: Applying the “Key Players” concept of Zubulake [PDF Presentation] November 2005 Carlton, Gregory H. A Critical Evaluation of the Treatment of Deleted Files in Microsoft Windows Operation Systems [PDF] 2005 Carmichael-Jones, Clive The Enemy Within - Investigating Computer Crime in the 21st Century [PDF] 2005 Carney, Megan & Marc Rogers The Trojan Made Me Do It: A First Step in Statistical Based Computer Forensics Event Reconstruction [PDF] Spring 2004 Carr, John Child Abuse, Child Pornography and the Internet [PDF] December 2003 Carrier, Brian A Crash Course in Digital Forensics [PDF Presentation] June 2006 A Hypothesis-Based Approach to Digital Forensic Investigations [PDF] March 2005 An Investigator’s Guide to File System Internals (From archive.org) [PDF Presentation] June 2002 Basic Digital Forensic Investigation Concepts 2006 Basic Media Analysis & The Sleuth Kit / Autopsy [PDF Presentation] 2004 Defining Digital Forensic Examination and Analysis Tools [PDF] August 2002 Defining Digital Forensic Examination & Analysis [PP Presentation] File System Forensic Analysis Chapter 5 - PC-Based Partitions [PDF] March 2005 Open Source Digital Forensics Tools: The Legal Argument [PDF] October 2002 Performing an Autopsy Examination on FFS and EXT2FS Partition Images: An Introduction to TCTUTILs and the Autopsy Forensic Browser [PDF] 2001 The Sleuth Kit Informer UNIX Computer Forensics [PDF] April 2004 Sample Chapter 12 from Know your enemy Why Recovering a Deleted Ext3 File Is Difficult . . . August 2005 Carrier, Brian & Joe Grand A Hardware-Based Memory Acquisition Procedure for Digital Investigations [PDF] 2003 Carrier, Brian & Clay Shields A Recursive Session Token Protocol For Use in Computer Forensics and TCP Traceback [PDF] 2002 Carrier, Brian & Eugene H. Spafford A Digital Investigation Process Model (Poster) [PDF] 2004 An Event-Based Digital Forensic Investigation Framework [PDF] August 2004 An Event-Based Digital Forensic Investigation Framework [PP Presentation] August 2004 Automated Digital Evidence Target Definition Using Outlier Analysis and Existing Evidence [PDF] August 2005 Categories of digital investigation analysis techniques based on the computer history model [PDF] August 2006 Defining Event Reconstruction of Digital Crime Scenes [PDF] November 2004 Getting Physical with the Digital Investigation Process [PDF] Fall 2003 Carson, Nathaniel Investigating Internet Histories with Internet Explorer 6 Investigating Internet Histories with Netscape Navigator 6 Investigation Internet Usage [HTML-Frames Presentation] January 2002 Carsten, Keith A. Bringing the Cyber-Criminal to Justice: An Essay for the Technologically Impaired 1997 Cartwright, David Architectural Innovations for Enterprise Forensics [PDF] November 2003 Carvalho, T.J. The Coroner's Toolkit (TCT) [PP Presentation] Spring 2002 Carvey, Harlan Carvdawg's Perl Page A collection of perl scripts, some of which may have forensic applications. Data Hiding on a Live System [PP Presentation] January 2004 Detecting and Removing Trojans and Malicious Code from Win2K September 2002 GMU2005 presentations [Zipped PP Presentations] August 2005 Topics: The Windows Event Log file format; Tracking USB storage devices across Windows systems; File/document metadata. Malware analysis for windows administrators [Available by request] 2005 No Stone Unturned Series Part 1 February 2002 Part 2 March 2002 Part 3 April 2002 Part 4 May 2002 Part 5 June 2002 Part 6 August 2002 NT/2K Incident Response Tools August 2001 The Dark Side of NTFS (Microsoft’s Scarlet Letter) Discusses Alternate Data Streams Using the Forensic Server Project November 2004 Win2K First Responder's Guide September 2002 Windows Forensic Analysis Chapter 3 - Windows Memory Analysis [PDF] April 2007 Windows Forensics & Incident Recovery Chapter 8 - Using the Forensic Server Project [PDF] July 2004 Casadei, Fabio, Antonio Savoldi & Paolo Gubian Forensics and SIMS Cards: An Overview [PDF] September 2006 Casey, Eoghan Case study: Network intrusion investigation e lessons in forensic preparation [PDF] November 2005 Creating an Incident Response Team [PP Presentation] April 2003 Digital Evidence and Computer Crime Chapter 1 - Digital Evidence and Computer Crime [PDF] 2004 Chapter 16 - Digital Evidence on Physical and Data-Link Layers [PDF] 2004 Error, Uncertainty and Loss in Digital Evidence [PDF] June 2002 Error, Uncertainty, and Loss in Digital Evidence [PP Presentation] February 2003 (from archive.org) Forensic Computer Analysis [PP Presentation] April 2003 Incident Response and Analysis [PP Presentation] April 2003 Incident Response and Forensics in Higher Education Environment [PP Presentation] April 2004 Investigating Network Intrusions [PDF Presentation] June 2001 Investigating Sophisticated Security Breaches [PDF] February 2006 Network Traffic as a Source of Evidence: Tool Strengths, Weaknesses, and Future Needs [PDF] December 2003 Practical Approaches to Recovering Encrypted Digital Evidence [PDF] August 2002 Profiling Computer Criminals - Methodology or Myth [PP Presentation] July 2002 Tool review - WinHex [PDF] April 2004 Casey, Eoghan & Keith Seglem Handbook of Computer Crime Investigation Chapter 1 - Introduction [PDF] Additional Materials Related to the Book Casey, Eoghan & Aaron Stanley Tool review – remote forensic preservation and examination tools [PDF] December 2004 Cassidy, Kyle What to Do After the Break-in: Preparing an Incident Report for Law Enforcement May 2001 Cassidy, Regis H. Friend Automating Case Reports for the Analysis of Digital Evidence [Abstract & PDF] September 2005 Cathey, Kirt S. Incident Handling I [PDF Presentation] May 2003 (from archive.org) Incident Handling II [PDF Presentation] May 2003 (from archive.org) Cavender, Don Digital Evidence Standards [PP Presentation] November 1999 CDESF (Common Digital Evidence Storage Format Working Group) Survey of Disk Image Storage Formats [PDF] September 2006 Çeliktutana, Oya, Ismail Avcibasa, Bülent Sankurb, & Nasir Memonc Source Cell-phone Identification [PDF] 2005 Celko, Joe Discovering Relationships in Context: Inductive tools for forensic computing [PDF] June 2006 Center for Democracy & Technology Digital Search and Seizure [PDF] February 2006 Ceresini, Tom Maintaining the Forensic Viability of Logfiles [PDF] May 2001 CERT Coordination Center Installing The Coroner's Toolkit and using the mactime utility Steps for Recovering from a Unix or NT System Compromise Using The Coroner's Toolkit : Harvesting information with grave-robber Using The Coroner's Toolkit : Rescuing files with lazarus Virtual Training Environment (VTE) January 2006 CFTT Review Draft GSM Mobile Device and Associated Media Tool Specification [PDF] December 2007 Chan, Fred Challenges of Forensic Investigations Under Corporate Environment [PDF Presentation] June 2006 Chan, Tony K. Y. & Siddhartha Sanyal Computer Forensics [PDF] November 2002 Chappell, Laura Advanced Packet Analysis [PDF Presentation] October 2002 Case Studies in Implementing Packet-Level Analysis-based Security Solutions [PDF Presentation] October 2002 Cybercrime at Packet-Level Part 1 [PDF Presentation] October 2002 Cybercrime at Packet-Level Part 2 [PDF Presentation] October 2002 Introduction to Network and Local Forensics [PDF Presentation] May 2005 Charles, Kellep A. Decoy Systems: A New Player in Network Security and Computer Incident Response [PDF] Winter 2004 Chase, Erkan A. Criminal Computer Intrusion Unit [PDF Presentation] August 2005 Chaski, Carole E. Who’s At The Keyboard? Authorship Attribution in Digital Evidence Investigations [PDF] May 2005 Chawki, Mohamed The Digital Evidence in the Information Era March 2004 Chen, Kevin, Andrew Clark, Olivier De Vel & George Mohay ECF - Event Correlation for Forensics [PDF] 2003 Chen, Patrick S. An Automatic System for Collecting Crime Information on the the Internet 2000 Chen, Yixin, Vassil Roussev, Golden G. Richard III, & Yun Gao Content-Based Image Retrieval for Digital Forensics [PDF] February 2005 Cheng, Derek Freeware Forensics Tools November 2001 Freeware Forensics Tools for Unix November 2001 Step by step instructions for using TCT Cherry, Michael Reasons to Challenge Digital Evidence and Electronic Photography June 2003 Cheung, Eric H. K. Computer Forensics and the Law of Evidence (Hong Kong) [PP Presentation] May 2003 'Chief' Criminal Investigations: Commodore Hardware Leaves No Trail? September 2006 Choo, Kim-Kwang Raymond, Russell G Smith & Rob McCusker Future directions in technology-enabled crime: 2007–09 [PDF] 2007 Chow, K.P., K.Y. Cheng, L.Y. Man, Pierre K.Y. Lai, Lucas C.K. Hui, C.F. Chong, K.H. Pun, W.W. Tsang, H.W. Chan, S.M. Yiu BTM – An Automated Rule-based BT Monitoring System for Piracy Detection [PDF] 2007 BitTorrent Monitoring System (BTM) [Flash Presentation] 2007 Chow, K.P., C.F. Chong, K.Y. Lai, L.C.K. Hui, K. H. Pun, W.W. Tsang, H.W. Chan Digital Evidence Search Kit [PDF] November 2005 Digital Evidence Search Kit [Flash Presentation] 2007 Chow, K.P., Frank Y.W. Law, Michael Y.K. Kwan, K.Y. Lai The Rules of Time on NTFS File System [PDF] 2007 Christiansen, Michael Defending Against Misuse of Forensic Analysis Tools on Windows Systems [PDF] January 2004 Chung, Barbara Developing a Fundamental Computer Investigation Process for Windows [PP Presentation] April 2007 Churchill, Matt Basic Cell Phone and PDA Forensics [PDF Presentation] August 2007 Live Response for Windows Systems [PDF Presentation] August 2007 Chuvakin, Anton FTP Attack Case Study Part I: The Analysis May 2002 FTP Attack Case Study Part II: The Lesson June 2002 Linux Data Hiding and Recovery March 2002 Chval, Keith G. Chain of Custody [PDF] May 2006 Ciardhuáin, Séamus Ó An Extended Model of Cybercrime Investigations [PDF] Summer 2004 CIO Online Magazine CIO Cyberthreat Response & Reporting Guidelines [PDF] CISC Computer Forensics Research Team The Role of IP Address in the Yahoo! Case - A Forensic View [Flash Presentation] Clark, Jonathan Advanced Cell (Mobile) Phone Forensics [PDF Presentation] October 2007 Claassen, Paul First Responders: Training Scene of Computer Crime Investigators [PDF] June 2002 Clark, Franklin A Police Officer’s Guide: Seizure, Handling and Storage of Computer Evidence [PDF] (from archive.org) Clark, Jonathan Forensics: Data Trails and Detection [PDF Presentation] February 2006 Clarke, Roger Technological Aspects of Internet Crime Prevention February 1998 Claus, Earl Computer Forensics - Digging with a Digital Shovel [PDF] April 2005 PDF Presentation Computer Forensics - Digging with the Digital Shovel [PP Presentation] 2006 Forensic Computer Examinations for Small to Medium Size Businesses [PDF Presentation] September 2005 Claycomb, Jason Auditing Tools for Use in Forensic Investigations [PDF Presentation] February 2005 Clearing House for Incident Handling Tools - CHIHT Evidence gathering tools Evidence investigation tools Supportive tools Cleetus, Joe Computer Forensics - Law and Privacy [PP Presentation] Investigating Windows Systems for Forensics Evidence [PP Presentation] Clifton, Chris Forensics [PDF Presentation] December 2003 Discusses The Coroners Toolkit Clowes, Anthony Forensic Computing within the Crime and Misconduct Commission [PDF] 2004 (from archive.org) Cohen, Charles L. Growing Challenge of Computer Forensics March 2007 Cohen, Fred A Day of Cyber Investigation [HTML Presentation] April 2000 Challenges to Digital Forensic Evidence [PDF Presentation] February 2006 Floppy Forensics [PDF Presentation] April 2007 Report on Defendant-Name vs. State-Name November 2001 In this case, the prosecution claims that Mr. Defendant-Name knowingly possessed and accessed specific contraband data. The question posed to Mr. Cohen in regard to this matter is whether these assertions made by the prosecution are supported by the evidence. So Much Evidence... So Little Time November 1999 Cohen, Kevin Digital Still Camera Forensics [PDF] June 2007 Cohen, Dr. Michael Advanced Carving techniques [PDF & Tools] August 2007 Forensic and Log Analysis GUI Tutorial [PDF Presentation] January 2006 Hooking IO Calls for Multi-Format Image Support (using PyFlag) January 2005 PyFlag Forensic and Log Analysis GUI [Presentation] May 2007 RAID Reconstruction - And the search for the Aardvark [PDF Presentation] April 2005 Cohen, Michael & David Collett Disk Forensics (using PyFlag) January 2005 Keyword Searching and Indexing of Forensic Images (using PyFlag) January 2005 Log Analysis (using PyFlag) January 2005 RAID Reassembly - A forensic Challenge (using PyFlag) February 2005 Cohen, Neil, Simon Walker & Ken MacLennan-Brown Retrieval of Video Evidence and Production of Working Copies from Digital CCTV Systems [PDF] March 2006 Cole, Dr. Eric Intrusion Detection Tools [PDF Presentation] November 2005 The Future of Network Digital Evidence [PDF Presentation] November 2005 Cole, Eric, John Millican & Matthew Newfield Security Essentials Toolkit: Forensic Backups Exercise 1: Disk Imaging with Ghost Security Essentials Toolkit: Forensic Backups Exercise 2: Forensics with dd Collet, David Forensic and Log Analysis GUI [PDF Presentation] April 2005 Collie, Byron Collecting and Preserving Evidence after a System Compromise [PP Presentation] 2000 Intrusion Investigation and Post-Intrusion Computer Forensic Analysis 2000 The Compiler Issue of newsletter devoted to 'Computer Crime' [PDF] Summer 1999 Compton, Dr. David Handheld Forensic Challenges – Capturing the Smoldering Cell Phone from Hell [PP Presentation] November 2006 CCIPS - Department of Justice Computer Crime and Intellectual Property Section Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations July 2002 Computer Crime Investigation (Author Unknown) An Emerging Challenge For Law Enforcement December 1999 Article contains a list of Computer Evidence Processing Steps. Computer Forensics Inc. CSI For The Home PC [PDF] 2004 Computer Forensic Associates, Inc. The Computer Under the Microscope Images Computer Security Institute (CSI) & FBI CSI/FBI Computer Crime and Security Survey [PDF] 2005 COMSEC International Computer Forensics and Cyber Investigations [PDF Presentation] 2004 (from archive.org) Conley, Tom Internal Investigations - Procedures and Techniques: An Overview [PDF] April 2001 Connor, Devin & Mubashshar Ahmed Digital Forensics: A Case Study April 2005 Conorich, Douglas Computer Forensics [PDF Presentation] August 2003 Cooper, Peter Speciation in the computing sciences: digital forensics as an emerging academic discipline [PDF] September 2005 (Registration required) Corby, Michael J. Computer Forensics in a LAN Environment [PDF] 1999 Operational Computer Forensics - The New Frontier [PDF] 2000 Corey, Vicka, Charles Peterman, Sybil Shearin, Michael S. Greenberg, and James Van Bokkelen Network Forensics Analysis [PDF] 2002 Cornell University Helix cheatsheet [troubleshooting] [Word doc] 2005 Introduction to Helix [Word doc] 2005 The Helix Cheatsheet [RTF doc] 2005 Using Spider from Helix [Word doc] 2005 Spider Addendum: Grabbing Files from the Spider log Corney, Malcolm Analysing E-mail Text Authorship for Forensic Purposes [PDF] March 2003 Corney, Malcolm, Olivier de Vel, Alison Anderson, & George Mohay Gender-Preferential Text Mining of E-mail Discourse [PDF] 2002 Cosgrove Computer Systems, Inc. Examination of Computer-Resident Evidence [PDF] Forensic Examination of Internet Activity [PDF] July 2001 Cotton, Daniel J. Changes in Forensics with Windows Vista [PDF Presentation] January 2008 Counsel of Europe Guiding principles for the protection of personal data with regard to smart cards 2004 Coursey, David Do's and Don'ts of Forensic Computer Investigations September 2004 Part Two: A Forensics Inquiry, Step by Step September 2004 Coward, Saundra Identify Intrusions with Microsoft Proxy Server, Web Proxy Service and WinSock Proxy Service Log Files [PDF] 2001 Cowen, David Enscript v3 Tutorials (from archive.org) Craiger, Dr. Philip Computer Forensics Procedures and Methods [PDF] 2005 Craiger's Cyberforensic Commandline Cheatsheet (C4) [PDF] 2005 Digital Discovery with Linux Bootable CDs [PDF Presentation] 2005 Recovering Digital Evidence from Linux Systems [PDF] 2005 Virtual Digital Evidence Lab: A Distributed Forensic Resource Network [PDF] May 2006 Abstract [Word doc] Craiger, J. Philip, Mark Pollitt & Jeff Swauger Law Enforcement and Digital Evidence [PDF] April 2005 Craiger, Philip, Lucille Ponte, Carrie Whitcomb, Mark Pollitt, & Ronald Eaglin Master's Degree in Digital Forensics [PDF] January 2007 Craiger, J. Philip, Jeff Swauger & Chris Marberry Digital evidence obfuscation: recovery techniques [PDF] 2005 Cree, Colin Challenges for Law Enforcement in Forensics [PDF Presentation] February 2005 Crenshaw, Adrian (Irongeek) Data Carving with PhotoRec to retrieve deleted files from formatted drives for forensics and disaster recovery [Flash Presentation] June 2007 Crim, Jesse Digital Forensics - Tools & Identification [PDF Presentation] October 2006 Cronin, Eric, Micah Sherr & Matt Blaze The Eavesdropper’s Dilemma [PDF] February 2006 Crowley, Ed Computer Crime and Forensics [PP Presentation] February 2003 Corporate forensics class design with open source tools and live CDS [PDF] April 2007 (Registration Required) CSO magazine, CERT Coordination Center & U.S. Secret Service 2004 E-Crime Watch Survey [PDF] May 2004 2005 E-Crime Watch Survey [PDF] 2005 2006 E-Crime Watch Survey [PDF] September 2006 CTOSE CTOSE Project Results [PDF] October 2003 (from archive.org) Cummings, Rich Saving Incident Response - Utilizing Computer Forensics & Trust Based Computing [PP Presentation] September 2007 Cummings, Richard & Jake Lowry Computer Forensics 101 & Incident Response [PDF] October 2003 Curran, Kevin & Karen Bailey An Evaluation of Image Based Steganography Methods [PDF] Fall 2003 Curtin, C. Matthew Electronic Evidence in Criminal Defense [PDF Presentation] March 2006 Curtis, Paul Cyber Crime: The Next Challenge An Overview of the Challenges Faced by Law Enforcement While Investigating Computer Crimes in the Year 2000 and Beyond [PDF] 2000 CyberScience Laboratory Functional Analysis of HPA.exe 2006 Cybersniffing [PDF - Flowchart] Source of graphic http://www.pittsburghlive.com/images/static/newsextra/0113cyber.pdf Cybex Computer Forensics - Problems and Solutions [PDF Presentation] Back to Top © 2006-2008 All rights reserved