Skip to content

Getting started in forensic research

Interested in getting involved in computer forensics research? Here's how to start.

  1. Read the proceedings for the past four years of the DFRWS conference.
  2. Review the proceedings from the past few years of the IEEE/SADFE (Systematic Approaches to Digital Forensics Engineering) workshops.
  3. Review the IFIP Working Group 11.9 on Digital Forensics website and look at the proceedings from the past conferences (unfortunately, you can't download the papers and the book costs more than \$100, but if you see something interesting it can usually be requested via interlibrary loan) (Some higher education libraries subscribe to SpringerLink which makes full text of these proceedings available to students and faculty as part of the school subscription)
  4. IFIP WG 11.9 publications
  5. Search for interesting forensic terms at the ACM Digital Library and CiteSeer
  6. Review the Sleuth Kit Website. In particular, review the issues of The Sleuth Kit Informer and download a copy of Sleuth Kit for your computer.

Setting up a C++ development environment

Many people working in forensics find it useful to be able to compile their tools from source code. Most of the tools compile on Linux, Mac, and within the Cygwin environment under Windows.

Because all of these tools build upon one another, it is important to compile and install them in the order specified below.

  1. Download a copy of libewf and install it on your computer. This will allow your forensic tools to read and process EnCase E01 disk images.
  2. Download a copy of Sleuthkit and install it. Sleuth Kit is the basic open source computer forensics tool that allows the extraction of files from disk images. You can use it to recover deleted files.

If you are interested in doing file recovery, you may also wish to explore:

If you want to experiment with automated computer forensics research, try these:

  • Bulk Extractor, a program from the Naval Postgraduate School that searches a disk image for email addresses and prints a histogram.
  • fiwalk, a program that processes a disk image and outputs an XML or ARFF file containing information about all of the file system metadata. fiwalk is now part of Sleuth Kit.

Exercises for the Reader

  1. Download nps-2009-canon2-gen6 from the Digital Corpora website and try to recover as many files as you can. Some of the JPEGs can only be found using file carving, and some can only be found with fragment recovery file carving.
  2. Can you determine when the photos were taken?
  3. Can you determine where the photos were taken?
  4. Can you determine the username of the person who took the photos?
  5. Can you determine the clock offset of the camera from real time?
  1. Download nps-2009-ubnist1 and find the government documents that were stored on the USB device.