[Novalug] NOVALUG Saturday: Computer Forensics

[Theodore Ruegsegger]

The Northern Virginia Linux Users Group (NOVALUG,
http://www.novalug.com/) is back at CSC Saturday, October 6, 10am to
Noon in the Auditorium at WTP, 15000 Conference Center Drive,
Chantilly VA.

Be sure to have a look at NOVALUG's new website at
http://www.novalug.com/

This month:
_________________________
Computer Forensics with Linux and (mostly) OSS.

A quick introduction to the capture, analysis, and production as
evidence of data recovered from computer hard drives, using Linux,
open-source software, and a commercial product (ASR Data's "SMART").

Stevens Miller is an attorney with over 30 years' experience as a
computer programmer, who has been qualified in state and federal
courts as a computer forensics expert witness. He will explain how to
use off-the-shelf tools to provide forensics services aimed at
entering evidence and testimony on the record in a judicial
proceeding.

Techniques demonstrated will include: imaging, verification,
"undeleting," keyword searches, and data filtration. In addition, some
legal issues addressed will include: authentication of evidence,
relevant differences between a civil and criminal proceeding, how to
qualify as an expert, and how to cope with ignorant lawyers.

Note: All methods explained will rely exclusively on Linux
applications, but the data to be captured and analyzed will (as it
mostly is in actual practice) be from Windows filesystems.
_________________________
There will be time for other discussions, so bring questions.

Orientation: if you're on Conference Center Drive looking at the front
door, you're looking West.

You will enter by the rear Commons doors at the Northwest/lower corner
of the building, so park in any of the nearby lots. Teresa Narvaez, or
another CSC employee, will let you in, and you'll be a few steps from
the auditorium.

Important Note: Be careful when leaving and don't trip on the step
down just outside the door. Please remind each other, since we all
tend to be caught up in conversation after a meeting and could easily
overlook the step.

Anyone and everyone is welcome to attend NOVALUG's meetings.  If you
need directions, please let me know (truegsegger at csc.com)