IT Forensics

Dear students,

unfortunately, I need to cancel the exercise session this week (May 8) due to sickness. I am sorry for the inconvenience.

If you have questions on the first practical sheet or the lectures, please visit the forum first, read related posts and if not asked yet, consider posting your question there (if you are not giving away solutions). You can also send me mails if necessary.

In general, everything I have seen so far in your online tests and proof-of-work submissions looks very good.

Next week we will cover the last three lectures and go over the solutions for the hacking case and the first practical sheet.

Thanks for your understanding. Have a great week!

Best regards,
Roman

Dear students,

here are three news items I would like to announce:

First Practical Sheet

The first practical sheet has just been released. You have time until May 14, 23:59 (German time) to submit the online test and your proof of work file. We can only accept solutions if you submit both.

The scenario will be about rhinographic material - a safe replacement for child porn crimes, an important aspect of forensic work. I would recommend to use Autopsy for this practical sheet, but there are also other tools that you can use. You will also need to do some research in the internet and probably use some other tools in addition. While the GUI version of Autopsy is recommended, the web-UI version will likely suffice too. Please do not post partial solutions or questions containing solutions in the forum.

Clarification (May 3rd): 

The questions for the assignment are available in the online test that you find on your personal status page. You can open this test and edit your answers arbitrarily often without any other time limit than May 14. Additionally, I will upload a PDF print in CMS, but that is just for your convenience. Do not hesitate to open the test now to see what the questions look like.

 

Exercise Session Room

As mentioned last time, we will not have the CISPA lecture hall next week (May 8). Instead, we will have the lecture hall 003 in E1.3. Thanks to the one student pointing out to me that it is free. :) All dates and rooms in the timetable were updated. Make sure to load a new *.ics file if you added it to your own calendar.

 

Tentative Exam Dates

The final exam will likely take place on August 8, between 10 and 12. I am still missing the university's final confirmation, but I do not expect that to change. We will also offer a re-exam that will likely take place on September 24 in the afternoon. I will inform you once everything is fixed and the registration on CMS/LSF is open.

 

Have a great weekend and see you on Thursday!

Best regards,
Roman

Dear all,

as someone asked this morning how Kidflix was shut down and how cryptocurrencies contributed to this, I wanted to briefly elaborate on the case here. In fact, the case is another good example of the importance of digital forensics and how such cases are handled. The platform used the Tor network and cryptocurrencies to remain supposedly anonymous. Investigators became aware of the platform through the so-called “Darknet Monitor”, which does exactly what the name suggests. Often the next step in such investigations is to infiltrate the platform to gather insider knowledge. In addition, similar to the Silk Road case, cryptocurrency transactions were analyzed to identify the perpetrators. A key institution involved in this case is the ZCB (Zentralstelle Cybercrime Bayern), a team of prosecutors and forensic experts who work exclusively on cybercrime cases. Together with institutions such as Europol, they were able to successfully combat this platform, which emphasizes the importance of international cooperation in such cases. Research has also contributed to this success as the Darknet Monitor, for example, was co-developed by Dutch researchers, as were cryptocurrency de-anonymization tools.

Best,

Janine

 

Dear students,

a very warm welcome to the IT Forensics lecture! We are amazed that more than 250 people are interested in our course.

The first lecture will take place this Friday from 10:15 to 11:45. As Dr. Schneider will not be in Saarbrücken during the semester, this and all following lectures will be given on Zoom.

You can also attend the lectures from lecture hall 001 in E1.3. This option is especially meant to all students that have adjacent lectures on campus and to those of you that do not have a good learning environment at home. Just come and join the Zoom session from there. As I will not be there every week (this Friday I will), please bring your own laptop. 

The tutorials will start next week, the exercises in May. I will give you information on both on Friday.

Looking forward to see you on Friday! Have a great semester start!

Best regards,

Roman