IT Forensics Christoph Sorge

The dean for student affairs (in computer science) has asked the lecturers to communicate the following information (which applies to all lectures):

The deadline for registering for exams in lectures is now a strict deadline. Late registrations after the deadline will only be processed by the study coordination in case of duly justified exceptions, such as illness.

As already mentioned last week, there will be no lecture today. 

Next week, the Tutorial will probably be swapped with the lecture, i.e. Tutorial on thursday and lecture on friday within the usual time slots.

In the Tutorial tommorrow, there will be practical exercises again. We will need Volatility (https://www.volatilityfoundation.org/26) and the Test Image called "xp-laptop-2005-06-25.img" from this archive: https://www.cfreds.nist.gov/mem/memory-images.rar
 

We will need two Test Images from https://www.cfreds.nist.gov/dfr-test-images.html for the exercises in the tutorial today, namely the first one "DFR-01" in NTFS and "DFR-11" in NTFS format. Here are the corresponding download links:
DFR-01: https://www.cfreds.nist.gov/dfr-images/dfr-01-ntfs.dd.bz2

DFR-11: https://www.cfreds.nist.gov/dfr-images/dfr-11-mft-ntfs.dd.bz2

It has been decided that there will be no additional tutorial slot, therefore we relocate the tutorial to the lecture hall (0.05, CISPA) just like last week.

Concerning the tutorial tomorrow, there will be no practical exercise yet, this is postponed to next week.

Best,

Nils