Darren R. Hayes

A framework for computer forensics investigations involving Microsoft Vista

The technical environment continues to change and impact the work of digital investigations. This research provides a framework within which computer forensics investigators can take advantage of new or different types of evidence from Microsoftpsilas Vista operating system (ldquoVistardquo). Moreover, this paper will also indicate the many challenges that investigators will encounter when faced with the Vista platform. The focus herein will be on changes associated with new security, encryption and file restoration features. These features vary according to the version of Vista and these differences will also be discussed. This research will also detail the integrity of data recovery procedures through detailed experiments used to identify how data could be manipulated by a perpetrator in Vista as compared to previous versions of Microsoftpsilas operating systems. Ultimately, this paper will indicate that enhancements in security and encryption associated with Encrypted File System (EFS) as well as BitLocker Drive Encryption are very problematic for investigators. Vista has serious implications for computer forensics investigations. Nevertheless, this research will guide the digital investigator through the labyrinth of new challenges, to effect a more thorough investigation of digital evidence.

Team project patterns for college students

Team Project Patterns for College Students is a pattern language intended for use by faculty instructing college students. The language is not designed for the college or university environment where courses are taught online but rather can be applied universally to third level education. There are two goals with implementing these patterns: (i) Team Building and (ii) Enhance Shared Learning. In writing these patterns, we were using examples of semester-long projects.

Implications of Microsoft Vista operating system for computer forensics investigations

With the growing importance of computer-related evidence today, it is important for law enforcement, prosecutors and computer forensics investigators to understand changes in their technical environment that are impacting the discovery and nature of evidence. Microsofts Vista (“Vista”) is one change that has brought new challenges for digital investigations, particularly relating to new mechanisms of encryption and general security. This paper will identify those challenges and prescribe possible solutions. More specifically this research proposes practical ways in which the digital investigator can retrieve critical file metadata, explore file systems and record log files. The focus of this paper will be on the changes to Microsofts New Technology File System (NTFS). In general, Vista has placed a greater emphasis on file sharing across the Internet so XML file formats are more pervasive. Security, and more specifically encryption, is more prevalent in Vista and so this paper will focus on changes to Windows Mail. Although there is no empirical evidence, it appears as though prosecutors heavily rely on electronic mail evidence. With the continuous expansion in size of flash memory, it was imperative to note changes to the digital footprint left by USB thumbdrives as well as the impact of Microsofts new volatile memory expansion tool - readyboost. Log files are also a crucial source of evidence in computer forensics investigations and these are discussed in great detail as changes in Vista have changed the nature of this evidence. This research paper will discuss the relevance of changes to evidence in Vista by highlighting the use of certain evidentiary files in court cases. Finally, the implications of changes brought about by Vista will be made apparent through experiments conducted with bit-stream imaging tools utilized by law enforcement and other computer forensics examiners. Vista has notable implications for computer forensics investigations. However, this research will prepare the digital investigator for the transition to the Vista operating system and the transformation of digital evidence associated with this new platform.

The impact of Microsoft's Windows 7 on computer forensics examinations

Windows 7 is a new operating system and, like any new technical environment, it has notable implications for computer forensics examiners. The impact of this new operating system will not be as dramatic as the move from Windows XP to Windows Vista. However, changes to this operating system mirror many changes in consumer usage of technology and present both opportunities and challenges for investigators.

Translational effects of robot-mediated therapy in subacute stroke patients: an experimental evaluation of upper limb motor recovery

Robot-mediated therapies enhance the recovery of post-stroke patients with motor deficits. Repetitive and repeatable exercises are essential for rehabilitation following brain damage or other disorders that impact the central nervous system, as plasticity permits to reorganize its neural structure, fostering motor relearning. Despite the fact that so many studies claim the validity of robot-mediated therapy in post-stroke patient rehabilitation, it is still difficult to assess to what extent its adoption improves the efficacy of traditional therapy in daily life, and also because most of the studies involved planar robots. In this paper, we report the effects of a 20-session-rehabilitation project involving the Armeo Power robot, an assistive exoskeleton to perform 3D upper limb movements, in addition to conventional rehabilitation therapy, on 10 subacute stroke survivors. Patients were evaluated through clinical scales and a kinematic assessment of the upper limbs, both pre- and post-treatment. A set of indices based on the patients’ 3D kinematic data, gathered from an optoelectronic system, was calculated. Statistical analysis showed a remarkable difference in most parameters between pre- and post-treatment. Significant correlations between the kinematic parameters and clinical scales were found. Our findings suggest that 3D robot-mediated rehabilitation, in addition to conventional therapy, could represent an effective means for the recovery of upper limb disability. Kinematic assessment may represent a valid tool for objectively evaluating the efficacy of the rehabilitation treatment.

A Framework for More Effective Dark Web Marketplace Investigations

The success of the Silk Road has prompted the growth of many Dark Web marketplaces. This exponential growth has provided criminal enterprises with new outlets to sell illicit items. Thus, the Dark Web has generated great interest from academics and governments who have sought to unveil the identities of participants in these highly lucrative, yet illegal, marketplaces. Traditional Web scraping methodologies and investigative techniques have proven to be inept at unmasking these marketplace participants. This research provides an analytical framework for automating Dark Web scraping and analysis with free tools found on the World Wide Web. Using a case study marketplace, we successfully tested a Web crawler, developed using AppleScript, to retrieve the account information for thousands of vendors and their respective marketplace listings. This paper clearly details why AppleScript was the most viable and efficient method for scraping Dark Web marketplaces. The results from our case study validate the efficacy of our proposed analytical framework, which has relevance for academics studying this growing phenomenon and for investigators examining criminal activity on the Dark Web.

The impact of project retrospectives on process improvement initiatives: A case study

The impact of project retrospectives on process improvement initiatives has been questioned for many years. It is an important question because project retrospectives can be demanding in terms of time and organizational resources. Therefore, measuring whether retrospectives are an efficient methodology for instigating continuous process improvements is extremely important. Many have been committed to the notion that retrospectives are essential to continuous process improvement in organizations but unfortunately could not prove their efficacy in a scientific manner. This paper details how one company has used project retrospectives to change its organizational practices and improve processes related to software development. The case companys business process improvement department conducted project retrospectives, with software development teams and other project-related staff, for more than five years. These development teams subsequently created action plans, which were independently monitored. Action plans were comprised of precise and measurable action items, which were assigned to sub-teams and sponsored by management. Management support and sponsorship for process improvement was critical to continuity of the retrospective process as well as to provide for the availability of resources to implement improvements. Moreover, management was imperative in ensuring accountability for the completion of process improvement initiatives. The companys business process improvement department conducted the project retrospectives, helped teams to craft action plans and aided in the assignment of actions items. This department comprehensively documented the implementation of many of these action items and their impact on process improvement initiatives and ultimately provided much of the conclusive evidence for this research. This research paper uses case study analysis, supported by unstructured interviews, to identify how one company developed process improvement initiatives and ultimately tracked their assignment and successful implementation. This is possibly the first case study analysis to scientifically prove that project retrospectives do have a measurable impact on process improvement initiatives. The study also illustrates the importance of the retrospective facilitator in facilitating organizational process improvement.