MacDailyNews - Where Mac news comes first

 MacDailyNews Poll

5 Day Most Commented

Opinion Archive

Current Headlines

Latest Joy of Tech

  • Latest Joy of Tech!

MacNN

AppleInsider

Macworld UK

TUAW

MacRumors

Yahoo! Finance AAPL

iTunes Top 10 Albums

Mac OS X Downloads

Wed, Jan 07, 2009 - 04:15 PM EST  —  AAPL: 90.991 (-2.029, -2.18%)  |  NASDAQ: 1599.06 (-53.32, -3.23%)

Purdue offers Macintosh forensics workshop June 3-5
Tuesday, June 03, 2008 - 09:48 AM EST

Purdue University for the first time will offer an introductory training course for law-enforcement officers on how to examine Macintosh computers for digital forensic evidence.
The Cyber Forensics Lab, located in the Department of Computer and Information Technology, will conduct "Introduction to Macintosh Forensics" from 8 a.m. to 5 p.m. June 3-5 in Knoy Hall, Room 228.

Officers from around the state and region will learn how to forensically examine a Macintosh computer and related devices ( iPod, iPhone, Apple TV ) for digital evidence, including pictures, e-mail, Web history, chat logs, contacts and documents.

Marc Rogers, a professor of computer and information technology and director of Purdue's cyber forensics program, said Purdue made the decision to offer the Macintosh-only training because of a special request by the Indiana State Police, U.S. Attorney's Office and the Internet Crimes Against Children Task Force officers.

"We have offered many digital forensics courses in the past, but this is the first course on Macs we have ever hosted," he said in the press release. "We have and are publishing various articles in journals on Mac forensics, and as these computers and devices become more popular, we have found ourselves actively investigating these types of systems every two to three months."

Rogers said this workshop complements the training the Cyber Forensics Lab has offered in the past on forensics for Windows-based computers and cell phones.

He said Purdue plans to offer an advanced class on Macintosh computer forensics in the fall.

Purdue's Cyber Forensics Lab trains about 100 law-enforcement offers a year and is a teaching center for students and a resource for national and international law enforcement officers and other investigators. The work there includes research on how to retrieve information from cell phones and other digital devices in a criminal investigation, the development of software that helps first responders deal with crimes involving digital pictures, and analysis of technology such as malware and botnets as they relate to complex international cybercrime.

Source: Purdue University

  • Social Web
  • E-mail






Always -- Free ground shipping with orders over $50 at the Apple Store.

Reader Feedback: ( = registered)

Jun 03, 08 - 08:53 am Comment from: Nutcracker

"Purdue's Cyber Forensics Lab trains about 100 law-enforcement offers a year..."

They'll prolly have about 1000 show up for this one...

They better be ready with extra coffee & doughnuts.

Jun 03, 08 - 09:04 am Comment from: Metryq

"and analysis of technology such as malware and botnets as they relate to complex international cybercrime."

Malware? Botnets? On a Mac?!

Jun 03, 08 - 09:16 am Comment from: Tommy Boy

Smart programmers control their botnets from their Macs to keep their competitors software off of their machines.

Jun 03, 08 - 09:17 am Comment from: Olternaut

I'm glad Macs are finally getting the attention they deserve. Perhaps they are getting too much attention? The wrong kind? =/

Jun 03, 08 - 09:30 am Comment from: Bob

What programs are out there to clean your machine so these nice police officers don't have to work so hard when they confiscate your Mac? (i.e. programs that clean up your machine and all the little breadcrumbs left laying around -- which I've noticed are almost whole pieces of bread in some pretty obscure places)

Jun 03, 08 - 09:38 am Comment from: Predrag

You can always boot from your Tiger/Leopard DVD that came with your Mac and do the paranoid format (the one that goes 32 times over every sector). Obviously, this is something you can do only if you have about 18 hours' notice of police arrival; the secure format takes a long, long time. If you have less than that time, there is an option to go 7 times over all data, which should complete in about 4 hours.

Even with the über-secure format (32 x), many forensic labs claim that there still may be traces of your old data under the formatted stuff.

Jun 03, 08 - 09:45 am Comment from: Predrag

If you want to make sure your deleted files are really deleted, use "secure empty trash" instead of ordinary 'empty trash'. You can access it from the Finder menu. If you have a lot of files you have already deleted, and trash emptied the usual way, and are afraid that traces of those files are strewn across your hard disk, there is the option of erasing empty space on the disk, which will obliterate all traces of previously deleted stuff hiding under the blanket of empty hard disk space. Go to Disk Utility; choose your hard disk; go to 'Erase' tab; click 'Erase Free Space...'; choose which type of erase do you want (Choices are 'Zero out space', '7-pass secure delete' and '35-pass secure delete').

This is as secure as you can get for free (without any third-party software)

Jun 03, 08 - 09:50 am Comment from: Macromancer

@ bob

Take the hard drive out and throw it in a wood chipper.

Jun 03, 08 - 09:58 am Comment from: CYxodus

File this under "More evidence that Macs are gaining in popularity".

Jun 03, 08 - 10:01 am Comment from: anaknipedro

Is there any way to recover data after a 7 pass or a 35 pass zero-out? Just curious. Nothing criminal happening here.

Jun 03, 08 - 10:28 am Comment from: Jim

@ anaknipedro

Probably not my friend, once you have written over something 35 times, there is practically zero chance of recovering anything.

Jun 03, 08 - 10:29 am Comment from: ElderNorm

Its not what they will find that worries me, its what they will put there to make sure they have a case.

Happened to me once. Police had the wrong house but I saw them putting some "evidence" back in their pocket. You know, in case they could not find any there on their own. Ouch.

Jun 03, 08 - 10:31 am Comment from: HMCIV

Apple Forensics? So if you murder someone with the thin side of your Macbook Air they can trace it? Uh-oh! I gotta call my lawyer.

Jun 03, 08 - 10:59 am Comment from: Ampar

The Dell forensics workshop has a special course on extracting DNA from pubic hairs found on laptops.

Jun 03, 08 - 11:57 am Comment from: Macromancer

"Is there any way to recover data after a 7 pass or a 35 pass zero-out? Just curious. Nothing criminal happening here."

Ask the NSA. Don't be surprised if they fail to respond.

Jun 03, 08 - 01:12 pm Comment from: blast

I passed out once and could not remember anything

Jun 03, 08 - 01:13 pm Comment from: Bluefin

iCSI, therefore i am.

Jun 03, 08 - 01:41 pm Comment from: Ampar

"Ask the NSA. Don't be surprised if they fail to respond."

But try to avoid getting stuck in the leg by an umbrella on your way to the subway.

Jun 03, 08 - 02:09 pm Comment from: Bluefin

Nice: Never turn your back on a good ricin umbrella dart!

So... been wondering...

AMPAR does that refer to the AMPA receptors?
Or Ann Ampar?
or the Optical device?

Jun 03, 08 - 03:30 pm Comment from: Macsweep

@ Bob

There are few if any "nice" law enforcement officers. Unless, of course, you mean to use the original meaning of that word.

Jun 03, 08 - 04:03 pm Comment from: Ampar

To Bluefin: It's a step up from Voltar. Old story.

Jun 04, 08 - 06:55 am Comment from: @Bob

Always store sensitive files in encrypted disk images and use strong passwords that you can remember. Then, if you have enough notice, you can through the encrypted images in the trash and secure erase them for even more security.

Reader feedback page 1 of 1 pages:

Always -- Free ground shipping with orders over $50 at the Apple Store.

Add Your Feedback:

Register or Login

Name:

Email: (optional)

Emoticons | Allowed HTML Tags

Remember my info   Notify me of follow-up comments?

Please enter the "MDN Magic Word" you see in the image below: