We argue that this approach prepares students better for forensicįield work, as they gain confidence to use a variety of tools, not just a single product they are familiar with. We found that without exception more than one suitable toolĬan be found to cover each topic in the curriculum adequately. Take-home project in this subject on open source software tools. We based all laboratory work and the main As a case study we present an advanced subject, Computer Forensics Workshop, which we designedįor the Bachelor’s degree in computer science at the University of Western Sydney. Images and relevant data structures, and in the process gain necessary background to become the future creators of new and They can also examine the code, understand the relationship between the binary Of the tools as future forensic investigators.

With the access to all source programs the students become more than just the consumers In-depth understanding and appreciation of the computer forensic process as opposed to familiarity with one software product, We argue that open source tools are more suitable than commercial tools, as they provide the opportunity for students to gain In this chapter we discuss the application of the open source software tools in computer forensics education at tertiary level. This information would be lost if conventional methods were applied, even when supplemented by the capture and analysis of physical memory.

We present a scenario that shows that live system investigation is indispensable in obtaining complete information about the system being examined. The hash value for the encrypted data calculated before and after the extraction is identical, so this approach can be considered to be forensically sound. The method of extraction is built around a software utility, Robocopy, which does not modify any metadata of the file system during extraction. In this article we demonstrate the methodology of extracting EFS-decrypted files from a live system. EFS files can be manipulated transparently by the owner and the system administrator as long as they reside in an NTFS file system. The Windows operating system provides the option to encrypt files using an encryption driver bundled with the New Technology File System (NTFS) file system, the so-called encrypting file system (EFS). Encrypted files captured by acquiring a bit-by-bit image in the process of conventional forensic investigation are practically impossible to decrypt without knowing the key and the method of encryption.

Efs decryption tool