Issues in Computer Forensics

More documents

Recommendations

Info

$Applied Math 247 Linear Algebra I & II$

functions in a DLL are attached to processes themselves and are mapped into the process’s address space, allowing them to be called from the process. DLLs are used for keyboard hooks because any application can then call the keystroke logging function in the DLL and enables recording of all keystrokes from all applications 29 . Finding the Spy Keystroke logging programs can be installed either in person who has physical access to the target computer, or remotely, either by a “Trojan horse” application or by a hacker who has gained root access to a system. Once loaded, the keystroke logging software is virtually undetectable by the user. Key loggers normally use little memory and do not affect a computer’s performance, making it more difficult to detect. However, there are anti-snooping products available that claim to be able to find such key loggers by probing the resident memory and recognize the programs that exhibit devious behavior. Products, like one called KeyPatrol 30 , use behavior-detecting and pattern- matching algorithms. Once a particular application has “hooked” the keyboard, the application can be easily found by detecting a procedure call to the keystroke logging function. Products also can search through resident memory and match applications against numerous known key logging programs; much like anti-virus software searches a computer for programs matching known viruses. A Physical Alternative Another way that keystrokes can be monitored is by a physical device that is connected directly to the keyboard. The most well-known of such devices is the 21
KeyGhost 31 key logger which is a small device that is placed on the end of the keyboard cable and is plugged into the back of the computer. This device has many advantages over its software counterparts. It is easy to install, works with any operating system, and cannot be detected by anti-snooping software. Installing the device requires no expertise whatsoever of computers and can be done regardless of whether the computer is on or off. This device is OS independent and cannot be detected by software because it does not require any software or drivers; it simply reads the keystrokes as it is inputted into the keyboard, records the information on a flash memory embedded in the device and allows each key to pass through to the computer unchanged. The software then can record keystrokes even before the OS is loaded and stores BIOS passwords as well. The device requires no external power and causes no slow down due to use of system resources. The data that is recorded is kept in 128-bit encryption to prevent unauthorized extraction of data. To access its stored information, a specific series of keys must be pressed on the keyboard that are highly unlikely to be pressed accidentally (much like a password). Once the correct combination is detected, the device will output a menu by sending a series of keystrokes to the computer and can be viewed with any text editor. From there, the information can be downloaded, erased, and the device’s options can be changed. They drawback of this device is that it has a finite amount of memory and can only store so many characters; depending on how much a person is willing to spend on the device, the KeyGhost device can store anywhere between 128,000 keystrokes and 2,000,000+ keystrokes. Once all the memory is filled before it is downloaded, the device will begin overwriting the oldest recorded data. 22
Page 1 and 2: Issues in Computer Forensics Sonia
Page 3 and 4: important part of the investigation
Page 5 and 6: Although each forensic investigator
Page 7 and 8: larger). These range from a hex edi
Page 9 and 10: But it is possible to recover delet
Page 11 and 12: paths to the referred files. 12 Rem
Page 13 and 14: Therefore, file slack, the space be
Page 15 and 16: created, modified, accessed, and/or
Page 17 and 18: It is recommended that first one co
Page 19 and 20: exploit scripts to key logging prog
Page 21: It is because of these and other co
Page 25 and 26: computer 32 . Many people have acce
Page 27 and 28: that person must have access to the
Page 29 and 30: The problem of determining identity
Page 31 and 32: USA PATRIOT Act Shortly after the t
Page 33 and 34: understand the technologies involve
Page 35 and 36: 31 Michael A Caloyannides. Computer

Issues in Computer Forensics

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?