CyberSecurity Institute logo, security training page
CyberSecurity Institute logo, security training page
Home    |    Services    |    Client Listing   |   Student Listing   |   Certifications   |    Mailing List  
About Us   |   Documents   |    Customer Comments    |    Contact Us

Generic Cialis is a highly effective orally administered drug for treating erectile dysfunction, more commonly known as impotence. Recommended for use as needed, Cialis can also be used as a daily medication.

Cialis 10 Pills 100mg $85 - $8.5 Per pill
Cialis 10 Pills 200mg $90 - $9 Per pill
Cialis 30 Pills 50mg $175 - $5.83 Per pill



Comstock ParkCialis Palm HarborSheffield LakeBalsam LakeCialis HollandJusticeCialis Morton GroveRoslyn HeightsClearwater


How much is generic viagra in mexico Buy xenical uk online generic for accutane cost cialis 10mg vs 20mg cost of generic accutane with insurance generic sinemet 25 100. Accutane cost in uk generic viagra professional 100mg online accutane pharmacy proscar generic brand generic for sinemet 25-100 online pharmacy for accutane. Cheapest generic viagra sinemet generic name reliable online pharmacy accutane how much does accutane cost privately in the uk. Generic cialis uk online pharmacy ro accutane online pharmacy cialis price cvs pharmacy sinemet cr generic name. Cialis vs viagra headache generic viagra sample pack cialis generico tadacip cost of accutane privately uk how much does generic accutane cost with insurance. Cheapest price for cialis average cost of generic accutane sinemet generic buy accutane online canada pharmacy. Cialis retail price usa cialis generic vs brand cialis cheapest price uk brand cialis vs generic cialis accutane prescription cost uk viagra cialis levitra online pharmacy. Generic brand for proscar how much does accutane cost in uk accutane online canada pharmacy generic for viagra or cialis sinemet 25 100 generic buy generic cialis online us pharmacy. Generic sinemet cr 100 25 buy cialis australia tadacip generic cialis buy cialis and viagra. Is there a generic for viagra in mexico accutane online pharmacy generic viagra the same buy accutane canada pharmacy. What is the cost of generic accutane cost of generic accutane cialis viagra online pharmacy tadacip 20mg generic cialis is there a generic for viagra or cialis. Cialis 20mg vs viagra 100mg cost of cialis at cvs pharmacy price comparison cialis vs viagra cost of accutane in uk buy real cialis canada. How much does generic accutane cost sinemet 25 250 generico cialis mail order pharmacy cialis uk pharmacy.

  1. buy cialis australia
  2. buy cialis pills
  3. buy cialis australia online
  4. buy cialis and viagra


Buy Cialis In Miami! Free Pills With Every Order



Finasteride for sale australia Online pharmacy metronidazole 500mg What is generic for ventolin Buy lexapro online usa Orlistat cost in australia Viagra 50 mg for sale Lasix order online Generic imitrex canada Clomiphene tablets for sale


Buy antabuse in uk xenical orlistat where to buy viagra cheaper than cialis antabuse to buy uk arava 10 mg tablets xenical orlistat to buy cheapest cialis australia. Cialis kaufen online rezept desyrel price buy wellbutrin online cheap buy cialis perth buy generic prozac online can you buy antabuse over the counter in uk. Buy prozac online in uk best price cialis canada generic wellbutrin cheap prozac nation book buy arava tablets prozac online buy xenical pills to buy. Cialis generika online kaufen erfahrungen buy prozac from canada cheapest canadian cialis desyrel 50 mg price cheapest cialis professional will cialis get cheaper. Is buying prozac online legal xenical orlistat buy uk cheapest cialis in canada cheap wellbutrin xl price cialis generika rezeptfrei online kaufen desyrel street price. Where can i buy alli or xenical buy cialis pills prozac buy online canada desyrel 50 mg price cialis tabletten online kaufen antabuse purchase uk. Cheap wellbutrin online cialis generika online bestellen erfahrungen buy xenical in spain cialis for sale in vancouver where to buy xenical in ireland. Is ventolin prescription only in australia arava 20 mg tablets information leaflet buy xenical in ireland roche xenical 120 buy Can i get a viagra prescription online arava tablets 20mg. Prozac buy online uk buy antabuse online uk cialis online kaufen empfehlung antabuse online uk antabuse buy online uk. Cheapest cialis pills wellbutrin cheap online cheapest cialis generic online desyrel street price cialis for sale montreal. Cialis online bestellen eu where can i buy antabuse in the uk cheapest wellbutrin xl 300mg cialis online bestellen tipps order antabuse online uk. Cheap wellbutrin xl 300mg cheapest generic wellbutrin cialis online kaufen erfahrungsbericht cialis online rezept bestellen. Arava 10 mg tablets information leaflet antabuse buy uk buy prozac online usa xenical to buy cheap cialis generika online kaufen ohne rezept. Buy prozac tablets online can you buy xenical in nz cheapest cialis on the internet comments cialis cheapest price. Prozac buy online india cheapest cialis 10mg wellbutrin cheapest prices buy prozac uk buy alli or xenical cialis for sale edmonton xenical buy online nz. Cheapest cialis canada cheapest cialis canada xenical tablets to buy buy antabuse tablets uk where can i buy xenical in ireland cialis online bestellen erfahrungen. Where can i buy prozac online uk online pharmacy courses uk buy prozac online europe desyrel cost buy wellbutrin cheap cialis for sale in toronto.

  • Cialis in Ga.
  • Cialis in Toowoomba
  • Cialis in Sterling heights
  • Cialis in Nanaimo


Cardura 4 mg 90 tablet buy generic cialis online europe sildenafil stada rezeptfrei kaufen tadalafil rezeptfrei eu sildenafil rezeptfrei günstig kaufen. Tadalafil generic europe when does cialis go generic in canada citalopram vs fluoxetine weight loss citalopram vs celexa sildenafil generika rezeptfrei kaufen. Cardura tablets 2mg generic cialis vs viagra citalopram vs klonopin keflex 1 gr tabletas what are cardura tablets for sildenafil 1a pharma kaufen ohne rezept. Viagra en ligne au canada sildenafil rezeptfrei kaufen raspberry ketone powder vs pills citalopram 20 mg vs lexapro citalopram vs sertraline dosage. Sildenafil ratiopharm online kaufen ohne rezept buy cialis in riyadh cialis generic brand names cardura tablet endikasyonları citalopram hbr 20 mg vs lexapro. Generic cialis reviews forum cialis generic alternative citalopram hbr vs zoloft keflex 1 gramo tabletas cialis generic vs brand. 10mg lexapro vs 20 mg citalopram sildenafil online ohne rezept kaufen sildenafil 25 mg rezeptfrei kaufen citalopram 40 mg vs lexapro escitalopram vs citalopram cost. Cialis generic brand names citalopram hbr tabs vs lexapro sildenafil hennig rezeptfrei kaufen cialis 5 mg generico en españa tadalafil kaufen deutschland. Citalopram hydrobromide vs celexa cardura tablet yan etkileri citalopram vs lexapro for anxiety raspberry ketone drops vs pills citalopram dosage vs lexapro. Cardura 4 mg tablet cialis generico italia farmacia sildenafil hennig kaufen ohne rezept tadalafil kaufen eu cardura tablets storage tadalafil in der schweiz kaufen. Cardura tablets doxazosin keflex tablets dosage canada pharmacy online coupon code cardura 4 mg 90 tablet fiyatı cardura xl 4 mg 30 tablet citalopram 20 mg vs lexapro 10 mg. Tadalafil online eu citalopram generic vs brand celexa citalopram vs lexapro citalopram generic vs celexa cardura xl tablets. Sildenafil hormosan rezeptfrei kaufen generic cialis compare prices citalopram vs escitalopram dosage tadalafil online italia green tea pills vs raspberry ketone. Sildenafil generika rezeptfrei citalopram hbr vs xanax cialis 5 mg generico prezzo cardura tablet 4 mg 20 tb sildenafil stada kaufen ohne rezept. Tadalafil rezeptfrei deutschland generic cialis 10mg online cheap generic cialis 60 mg cardura 1 mg tablet.

Ordering topamax online | Kamagra kart australia | Xenical sprzedam uk | Over the counter drug for prednisone | Buy synthroid online usa | Tretinoin cream for purchase | How much does viagra cost in australia with a prescription | Viagra buy online ireland | Ashtons pharmacy online ordering


Port MacquarieNewcastleFort St. JohnAlbanyTweed Heads
FellbachWeenerCialis TriptisBad SäckingenHerzberg am Harz
Cialis Mount IsaChilliwackCialis Broken HillHobartCialis Cessnock


online pharmacy viagra uk
buy cialis in riyadh
generic pharmacy uk
best online pharmacy viagra canada
buy cialis in store
buy cialis in san diego
online pharmacy uk fast delivery
buy cialis in mexico


Buy liquid tadalafil online common dosage for cialis buy cialis tadalafil online dosage for liquid cialis. Cialis ohne rezept in deutschland kaufen buy valacyclovir online canada zyvox tablets crush zyvox linezolid tablets buy salbutamol online uk can zyvox tablets be crushed. Cialis dosage for prostate enlargement zebeta 5 mg zyvoxid 600 mg 10 tabletek buy tadalafil 270 online buy cialis in italy. Buy tadalafil online australia buy tadalafil online in uk where to buy cialis tablets buy tadalafil brand online where to buy cialis in canada cialis dosage for pulmonary hypertension. Zyvoxid 600 mg filmtabletten zyvox tablets 600 mg cialis dosage for enlarged prostate where to buy cialis 20 mg zebeta max dose cialis ohne rezept per nachnahme. Cialis ohne rezept spanien zebeta oral maximum dose zebeta where can you buy cialis cheap zyvox 600 mg tablet buy tadalafil mexico online. Buy salbutamol uk buy salbutamol inhaler uk cialis dosage for ed zyvox 600 mg tablet price cialis ohne rezept holland where can i buy tadalafil online zyvox 600 mg tabletas. Clonidine fda indications Cialis 240 Pills 20mg $420 - $1.75 Per pill buy tadalafil 5mg online cialis ohne rezept frankreich. Zyvoxam tabletas 600 mg zyvox 600 mg tablets proper dosage for liquid cialis cialis ohne rezept bestellen. Where to buy cialis generic cialis ohne rezept aus deutschland cialis ohne rezept kaufen buy salbutamol tablets uk where is the best place to buy generic cialis. Buy generic tadalafil 20mg clonidine fda approval cialis ohne rezept auf rechnung kaufen zebeta oral tablets dosage for cialis 20mg. Zyvoxam 600 mg tabletas precio zebeta 2.5 mg buy salbutamol nebules uk valacyclovir generic canada zebeta recommended dose buy tadalafil online uk clonidine fda approved indications. Zebeta dose zyvoxam tabletas precio where to buy cialis canada zebeta 10 mg cialis ohne rezept erfahrungen cialis ohne rezept günstig kaufen. Where can i buy cialis pills generic tadalafil online 20mg buy generic valacyclovir canada cialis ohne rezept sicher kaufen. Cialis dosage for bph buy salbutamol pills uk can you buy salbutamol over the counter uk cost of zyvox tablets correct dosage for cialis online pharmacy uk ritalin. Fda approved extended-release clonidine for pediatric adhd where can i buy cialis in canada.

< Topamax 50 mg cost :: Buy meldonium usa >

Digital Forensic Certifications
  CSFA / CSICI
Training Courses
  Computer Forensics Core Competencies
5 Day
  Computer Forensics for Attorneys 1 Day
  Packet Analysis and Intrusion Detection 5 Day
  Computer Forensics Fundamentals 1 Day
  Windows Forensics Essentials 2 Day
Services
  Litigation Support / Expert Witness
  Businesses
  Individuals
Lists
  Mailing List
  Clients
Documents
  The "Tools Proven in Court" Question
  Getting Started In Information Security / Digital Forensics
  What Is Computer Forensics?

 
1

Created: April 4, 2002
Updated: Aug 29, 2014
Author: Steve Hailey

This document is provided for informational purposes only, and represents the opinions of the author. It is not intended to represent legal advice, and should not be construed as such. If you are using the information contained within this document to help prepare for a computing investigation, review this document in its entirety with your legal counsel.

In the digital forensics community, you'll often hear talk about forensic tools "proven in court." On a pretty regular basis, I receive emails asking for our opinion on this topic, and whether or not "this particular tool" or "that particular tool" should be used based on whether or not its use has been "proven in court."

Vendors that sell digital forensics software will typically use statements such as "our tool has been proven in court" as a marketing technique. Really what these vendors are saying is that their tool was used in a case where the results of the tool as well as the underlying methodology and testimony of the forensic computer examiner were admitted. Understand that there are various tests that courts can apply to expert testimony, methodology and opinions in order to determine admissibility, reliability, and relevancy. The particular test(s) used will vary from state to state and even from court to court within the same state.

In the digital forensics business, we typically refer to an attack of the methods, tools and techniques we use as a "junk science" attack.

I do believe that commonly used commercial tools such as FTK, EnCASE, ProDiscover, and X-Ways Forensics should be used for forensic analysis, as the tools have already been authenticated by experts in many court cases. There is more to this equation however.

While I am not an attorney, I believe that the primary question that should be asked here is not whether a particular tool has been proven in court, but rather:

Does the analyst have the technical background to support the results of their investigation, have they properly authenticated their results, and was a sound investigation performed from start to finish?

Think about this for a moment. If the tools being used are the mechanism to find evidence on a computing device, and several different tools can replicate the process, then it doesn't matter what tools were used. The evidence is simply there and can be found by any competent forensic analyst using a variety of tools. Proper interpretation of the evidence, however, is another story - that's where the smarts of the forensic examiner come in to play.

Regardless of the tools that an analyst uses, the following questions should be pondered to help determine the likelihood of admissibility of evidence gathered during a forensic analysis. Whether or not evidence is admissible has more to do with factors other than the specific tools used for the technical processing.

If you are a digital forensics analyst, the following questions will most probably arise in some form during a deposition, hearing, pretrial or trial situation. Any attorney that you work for would be wise to affirm the answers to these questions with you, as they will go a long way in helping to determine whether or not the evidence gathered will be admissible in a court of law as well as whether or not your expert testimony will hold up under scrutiny. These questions can also be used as the basis for formulating additional questions to be asked of opposing experts:

1. Was the evidence gathered, authenticated, and verified in a sound manner?

One of the tenets of digital forensics is to assure that the original media is not altered, and that the methods used to create forensic quality copies of media and data assure that the integrity of the original is maintained. This is one of the most important steps. In situations where evidence must be gathered "live," we need to make sure that whatever process used has been verified beforehand to cause minimal changes to the overall system, and that other professionals given the same set of circumstances would have used the same methodology. Write blocking / prevention mechanisms should be used for imaging media, and thoroughly tested beforehand by the examiner to assure that the mechanism works without fail.

If you are going to use physical media for your working copy versus image files of the media, assure that the working copy media is sterile (contains no data) and has been verified as such before imaging the original to the working copy.

Cryptographic hash functions should be used on the original media and/or data beforehand and then on the subsequent copies in order to show that integrity was maintained as well as the fact that the copies are identical to the original. Contrary to what many forensic analysts have been taught, a simple checksum (a process that adds up byte values and outputs the result) is not recommended for this process. I recommend that an MD5 or SHA cryptographic hash function be used. As an aside, if you've heard that MD5 was "broken" and should no longer be used for digital forensics, I recommend that you read "MD5 collisions and the impact on digital forensics" by Eric Thompson of AccessData. Well done Eric.

As well, always check your images to make sure that they can be read before returning the original media back to a client or owner. Don't take for granted that since the original and forensic copy hashes match that all is well. I have experienced images not being read properly when proprietary image formats were used for the working copies. When possible and practical, use the RAW format versus proprietary, and do not take for granted that everyone uses your format - especially when you have to provide forensic images to another party involved in a case. Remember - a competent forensic examiner verifies whenever possible, not taking anything for granted. Murphy's law is just as prevalent in digital forensics as anywhere else.

At this point you might be saying something like "if the hash value for the original and the hash value for the working copy match, that's all that matters." Not so. If you are the first to image a piece of media, you could have altered the original prior to the first hash. You have to show that your imaging process from start to finish did not alter the original in any way.

2. Was a chain of custody maintained?

All media, documents, and evidence related to a case or situation should be kept in your custody and closely controlled. Only those that have a right to see the information should see it and have access to it. We call this creating and maintaining a chain of custody.

Detailed documentation needs to be kept and readily available relevant to the chain of custody, and the analyst needs to have a secure location used to store all materials. I believe this goes beyond merely documenting when a particular item was received or returned. You should document when any information pertinent to a case or situation is removed as well as placed back into its secure location.

3. Is the ownership and licensing appropriate for the tools used?

Whatever software is used for the technical processing needs to be properly licensed. If you are in business for yourself, the software needs to be licensed to you or your company. If you are performing work as an employee, the software needs to be licensed to your company and you should have the authorization to use it. If you are going to use shareware for an analysis, pay the licensing fee.

The opposing experts for a case CSI was involved in used a "demo" version of software to process the Internet history of a particular computer. The repeated word DEMO could be clearly seen on the printed reports. How professional do you think these folks looked? They were being paid handsomely for their work on the case, yet were using demo versions of software.

In another case, the opposing attorney tried to impeach me by intimating that I had used software licensed to a college I instructed at to process a case. The attorney had failed to recognize that I also owned my own business and had properly licensed copies of all software used in my analysis.

4. Was the proper examination environment being maintained?

An analyst that is lackadaisical in this area will most assuredly have questions raised relevant to the efficacy of their overall methodology and procedures. For one, the workstation(s) used to process evidence must be kept in good working condition. Prior to a forensic analysis, I recommend that diagnostic software be run on the forensic system, and that the results be kept. When maintenance is performed on the system or upgrades are performed, keep documentation. Your forensic workstation is a tool used for your profession, and you need to show that it is in proper working condition.

Regularly scan your workstation for viruses and malware, and always scan the original media (with a write blocking / prevention method in place) or the resultant images for viruses and malware. Many forensic analysts fail to scan for viruses and other malware, thinking that their forensic software will find and identify all of these items. Don't make this mistake.

5. Can the results of the technical analysis be duplicated using other tools?

Any competent examiner knows that you do not use a single tool. Granted, we all have our favorite primary tools to use, but once the evidence has been extracted that is pertinent to the situation and will be used in some type of proceeding, it needs to be authenticated using other tools.

For example, at CSI, we use some of the popular GUI tools to process the bulk of information. When evidence is found pertinent to the situation, we then use several other tools to authenticate that specific evidence, such as the fact that it is indeed on the media at this specific cluster, block, or sector, and that any time stamp information matches up.

The key is to use different tools from different vendors and different sources. DO NOT rely solely on tools from a particular vendor or source. Another competent forensic analyst should be able to find the same data at the same location on the working media or image using an appropriate tool.

6. Does the Analyst understand what the tools they use are actually doing, or are they merely taking for granted what an automated process is reporting?

With digital forensics having such a big "WOW" factor these days, we are seeing more and more people hanging out a shingle to do digital forensics work, with many of them being "point and click" analysts. In other words, using a GUI based tool with little knowledge concerning what the tool is actually doing.

For example, regardless of the tool you use and the specific algorithms employed by your tool, the way in which computer forensic software tools perform the following is pretty much based on the same underlying principles:

Creating forensic quality or sector-by-sector images of media
Locating deleted/old partitions
Ascertaining date/time stamp information
Obtaining data from slack space
Recovering or "undeleting" files and directories
"Carving" or recovering data based on file headers/file footers
Performing keyword searches
Recovering Internet History information

If you lack the experience and technical knowledge to defend your use of a particular tool because you don't really understand what the tool is doing, then your results will not withstand scrutiny regardless of the tool used. If you do not understand how a tool could perform one of the functions mentioned above, I would recommend that you obtain some additional training. There are many fine training programs available. I would recommend the Digital Forensic Examiner course by CyberSecurity Academy if you are already an IT professional. If you bootcamp style training is not for you or you are a bit rusty with your technical skills, a program at your local college migth suit you best. The Digital Forensics Certificate or Information Security and Digital Forensics ATA degree at Edmonds Community College is an example of such a program.

Truth be told, I'm one of the the instructors for the certificate and degree programs at Edmonds Community College, so I'm a bit prejudiced.

Whatever you choice is for education, interview your instructor and make sure that they have experience not only teaching, but actually doing. This will make a world of difference in the education that you will receive.

7. Do other professionals use the same techniques and methodology?

If you are doing digital forensics related work and truly know what you are doing, you are using techniques that other professionals use. If you've developed your very own tool or methodology that no one else is in the profession is using yet, or that has not been subject to a review of your peers and thorough, documented testing, you're heading for trouble. Think about having to explain to a jury how your homegrown tool works...

Understand that when you have evidence that is damning to the other side, opposing counsel will bring up arguments that your software tool or methodology is not "generally accepted in the digital forensics community" and so forth. If you have authenticated your results using several different tools, really understand the meaning of what the evidence shows - and can prove it - you'll be fine. To help avoid problems in this area that will draw attention away from the real matter at hand, I do recommend (at the time of this writing) that your primary tool be a widely accepted commercial tool.

8. Is the Analyst technically capable of defending/supporting their interpretation of the evidence?

I could write an entire document citing instance of the opposing experts misinterpreting the results that their tools presented to them. We'll cite one example.

The opposing experts in a case used a popular GUI tool that came with a script for finding Internet search engine activity. When they ran the script, they found literally hundreds and hundreds of "searches" that supposedly had been conducted by our client. Therefore, our client had intentionally accessed certain types of information related to these searches, because - in their interpretation - the searches showed intent.
On examination, I realized that each and every one of these "searches" were actually hyper links and not searches at all. The hyper links were formed in such a way that when a link was clicked, a database was searched to pull up the most current information related to the link. Our client had not conducted any searches whatsoever.

The opposing experts took for granted that their automated tool was accounting for any variables, and would only show them searches that had actually been conducted. A big mistake. The opposing experts lacked the technical skills to actually authenticate their results, so they depended entirely on a single automated tool.

Results from any tool should always be thoroughly checked by someone versed in the underlying technology to see if what appears to be a duck is actually a duck.

In the very same case, I recovered reams of email that the opposing experts did not find. This was because they simply did not know how to find it.

By the way, I used the same primary tool in our investigation as they did. The differences in what was found as well as the differences in interpretation was due to the inexperience of the opposing experts - it had nothing to do with the tool being used.

At CSI, we use a variety of tools to process cases. We use the well-known and popular GUI tools, command line tools, and open source tools. The fact of the matter is, many of the tools "already proven in court" are fantastic tools and do a great job. I want you to realize however that if you feel you must use a specific tool to defend your results, you are probably in need of additional technical training more than you are a specific tool.

Methodology and technical knowledge is far more important, in my opinion, than the tool.

As you can see, whether the tool being used has been "proven in court" or not, the digital forensics practitioner needs to know what he or she is doing, and should have a technical background that includes more than just a course or two in digital forensics.

There are situations in which a particular tool has been chosen as the primary tool for a company or law enforcement agency. So if you work there, you'll be using the tool that has been accepted and adopted. Even in this situation however, you'll find the experienced forensic practitioners will use additional tools to authenticate the results of the primary tool.

If you have a positive answer to the 8 items presented above, then you have done your job and are prepared. It is now up to the attorneys to argue whether or not the evidence you have recovered is admissible based on its relevancy to the situation amongst other factors.

The Tests

As mentioned previously, there are various tests that courts can apply to the methodology and testimony of an expert in order to determine admissibility, reliability, and relevancy. The particular test(s) used will vary from state to state and even from court to court within the same state.

The Frye test (Frye v USA, 1923) used to be the standard for the admissibility of expert witness testimony. Frye indicated that scientific evidence would not be admissible unless the scientific community to which it was related had generally accepted it. Some states still use the Frye test.

The Frye test remained the standard for about 50 years.

In 1973, Congress adopted the Federal Rules of Evidence. The rules relevant to our document here are:

FRE 401 and 402: All relevant evidence is admissible, except as otherwise provided ... Evidence which is not relevant is not admissible. Relevant evidence