CS 585-002 Cybercrime: Legal Issues and Investigative Procedures

Fall 2009

Instructors: Prof. Kenneth L. Calvert, calvert@netlab.uky.edu, 257-3961, and Dr. Thomas Johnson, tomjohnson@attglobal.net, 523-9236.

The official syllabus has complete information about grading and other policies.

Announcements

Watch this space for announcements, advice, and assignments.

27 Aug	We will have class on Tuesday, 9 September, in spite of the CS department picnic at Woodland Park.
21 Oct	The rules of the game. Here are the final rules for the "hide and seek" assignment: The hidden material must be plain ASCII (ISO 8859-1) text, encoded one byte per character. The text must be taken from the Bible (any English version is OK). The text must be at least 500 bytes long, and may be broken into no more than two contiguous pieces. No encryption. This precludes any uniform transformation of the bytes (e.g., flipping every other bit of each byte). No steganography. This rules out any form of transformation of the encoding. So, for example, using one of the arcane integer representations from the Basic Encoding Rules of ASN.1 is out, as is reversing the order of bits in each byte. The material must not show up as a separate file in the file system, unless it is hidden inside another file that displays normally (e.g., a Word document). The idea is to hide the information somewhere in the cracks and crevices of the partition or the file system. Adding "chaff" to the file system (e.g., by creating and deleting lots of files) is OK.
28 Oct	Requirements for the "seek" part of the hide-and-seek assignment (due Tuesday, 3 November): Turn in a neatly formatted, grammatically correct writeup that describes (i) the process you followed in examining the drive; and (ii) the results of that process, i.e., what you found and where it was hidden. Remember the importance of having a process, following it, and documenting it.

Homework Assignments

Homework 0 is due Tuesday, 1 September 2009. We will discuss the scenarios in class.

Additional Materials

Books on Reserve at Engineering Library

Forensic Computer Crime Investigation, edited by Thomas Johnson, CRC Press, 2002. An excellent collection of articles on topics related to the subject of this course.
Hacker's Challenge 3 by Pollino, Pennington, Bradly and Dwivedi, McGraw-Hill/Osborne, 2006. (Two copies on reserve.) This is a collection of scenarios, each of which is presented through a little story accompanied by some evidence in the form of logs, error messages, and other hints. At the end of each are some questions about what actually happened and how it was accomplished. In other words, you get to play investigator!

Other books and resources

Guide to Computer Forensics and Investigations, third edition, by Nelson, Phillips, Enfinger, and Stuart, Course Technology, 2007.
Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations, US Department of Justice, 2002.
Digital Evidence in the Courtroom: A Guide for Preparing Digital Evidence for Courtroom Presentation, US Department of Justice,
"Seeing is not believing" -- IEEE Spectrum Article on Doctoring Digital Photos. (See also the slideshow "A Tour of Photo Tampering" on the same page.)

Slides from Lectures

Ken Calvert

Last modified: Tue Nov 3 21:57:03 EST 2009