IT Forensics

Dear all,

 

Thank you very much for your interest and for the many inquiries I’ve received recently. I truly appreciate the engagement — however, the volume has become too high for me to respond individually.

To clarify:

• I am unfortunately not able to supervise theses, offer Hiwi (student assistant) positions, or take on project work (including guided projects, seminars, or similar), for students who are not enrolled at the University of Augsburg.

• I also cannot speak on behalf of the chair of Christoph Sorge, handle inquiries intended for the chair, or refer you to other potential supervisors.

• Please understand that I am also unable to forward such requests to other staff members or colleagues from CISPA.

• Going forward, I will no longer be able to respond to messages regarding these matters.

Thank you for your understanding.

 

Best,

Janine

Dear students,

the results for the first exercise sheet are published. You find a feedback file on your personal status page. I also uploaded a short solution file to the Materials section that indicates what I expected where. Additionally, I will cover all questions in today's exercise session.

As some have already started doing so: Please refrain from sending me mails with individual complaints on gradings.

You can talk to me before and after every exercise session. Additionally, we will have a "clearing session" in front of the exam where I am happy to fix grading problems of all sheets in case you need the points for the exam admission. If you got admitted by then already, please just keep in mind that you were doing a great job and silly Roman was just unable to recognize it. ;)

Thanks for your understanding!

Best regards,
Roman

 

Dear students,

as you probably know, the first assignment is due Wednesday evening (23:59). The forum contains some posts with comments on almost every question, so if you have any question, visit the forum first please.

As of now, 100 people that have taken the online test have not submitted a proof of work file yet. This is a gentle reminder: I can only consider your solution if you submit both the online test and the proof of work file until tomorrow evening! There are no fixed comprehensiveness or formatting requirements, but please make sure that I can review how and that you did your work.

The next sheet will be released right after this week's exercise session on Thursday. You will then have time until next Wednesday (May 21st) to submit your answers and proof-of-work files.

Please note that this week's exercise session on Thursday will take place in E1.3, lecture hall 003 and not in the CISPA building. As usual, you can also join online or watch the recording afterwards.

And, by the way, the exam dates were confirmed. The exam will take place on August 8, the re-exam on September 24.

Take care and enjoy the sun!

Best regards,
Roman

Dear students,

here are three news items I would like to announce:

First Practical Sheet

The first practical sheet has just been released. You have time until May 14, 23:59 (German time) to submit the online test and your proof of work file. We can only accept solutions if you submit both.

The scenario will be about rhinographic material - a safe replacement for child porn crimes, an important aspect of forensic work. I would recommend to use Autopsy for this practical sheet, but there are also other tools that you can use. You will also need to do some research in the internet and probably use some other tools in addition. While the GUI version of Autopsy is recommended, the web-UI version will likely suffice too. Please do not post partial solutions or questions containing solutions in the forum.

Clarification (May 3rd): 

The questions for the assignment are available in the online test that you find on your personal status page. You can open this test and edit your answers arbitrarily often without any other time limit than May 14. Additionally, I will upload a PDF print in CMS, but that is just for your convenience. Do not hesitate to open the test now to see what the questions look like.

 

Exercise Session Room

As mentioned last time, we will not have the CISPA lecture hall next week (May 8). Instead, we will have the lecture hall 003 in E1.3. Thanks to the one student pointing out to me that it is free. :) All dates and rooms in the timetable were updated. Make sure to load a new *.ics file if you added it to your own calendar.

 

Tentative Exam Dates

The final exam will likely take place on August 8, between 10 and 12. I am still missing the university's final confirmation, but I do not expect that to change. We will also offer a re-exam that will likely take place on September 24 in the afternoon. I will inform you once everything is fixed and the registration on CMS/LSF is open.

 

Have a great weekend and see you on Thursday!

Best regards,
Roman

Dear all,

as someone asked this morning how Kidflix was shut down and how cryptocurrencies contributed to this, I wanted to briefly elaborate on the case here. In fact, the case is another good example of the importance of digital forensics and how such cases are handled. The platform used the Tor network and cryptocurrencies to remain supposedly anonymous. Investigators became aware of the platform through the so-called “Darknet Monitor”, which does exactly what the name suggests. Often the next step in such investigations is to infiltrate the platform to gather insider knowledge. In addition, similar to the Silk Road case, cryptocurrency transactions were analyzed to identify the perpetrators. A key institution involved in this case is the ZCB (Zentralstelle Cybercrime Bayern), a team of prosecutors and forensic experts who work exclusively on cybercrime cases. Together with institutions such as Europol, they were able to successfully combat this platform, which emphasizes the importance of international cooperation in such cases. Research has also contributed to this success as the Darknet Monitor, for example, was co-developed by Dutch researchers, as were cryptocurrency de-anonymization tools.

Best,

Janine

 

Dear students,

a very warm welcome to the IT Forensics lecture! We are amazed that more than 250 people are interested in our course.

The first lecture will take place this Friday from 10:15 to 11:45. As Dr. Schneider will not be in Saarbrücken during the semester, this and all following lectures will be given on Zoom.

You can also attend the lectures from lecture hall 001 in E1.3. This option is especially meant to all students that have adjacent lectures on campus and to those of you that do not have a good learning environment at home. Just come and join the Zoom session from there. As I will not be there every week (this Friday I will), please bring your own laptop. 

The tutorials will start next week, the exercises in May. I will give you information on both on Friday.

Looking forward to see you on Friday! Have a great semester start!

Best regards,

Roman