The document outlines the agenda for a digital forensics session. It will cover basic Windows forensics, media analysis concepts including audio, video and digital image forensics. Demonstrations will include Windows registry analysis using Frat, Windows password reset using Hiren's BootCD, volatile memory analysis using FTK, and a case study on Malaysia Airlines Flight 370. The session will also discuss data categories in digital forensics including data at rest, in user memory, and in transit.

1. DIGITAL
FORENSICS
SESSION 2

2. AGENDA
 Basic windows forensics
 Media Analysis Concepts
 Audio forensics
 Video Forensic
 Digital image Forensic
 Demo:
 Windows registry analysis using Frat
 Windows Password reset using Hiren's.BootCD.15.2
 Volatile memory analysis using FTK
 Case study 2: Malaysia Airlines Flight 370
13-07-2017
Suresh Kumar K

3. DATA CATEGORY
- Data In Rest
Computer Forensics
- Data in user
Memory Forensics
- Data in Transit
Network Forensics
13-07-2017
Suresh Kumar K

4. BASIC WINDOWS
FORENSICS
13-07-2017
Suresh Kumar K

5. AUDIO FORENSICS
Audio analysis
 Audio analysis refers to the extraction of information and meaning
from audio signals for analysis, identification & comparison.
Voice identification
• Listing to the given audio
• Electronic measurements ( sound spectrum measurement)
• Waveform analysis
• Result is not always conformed analysis should quantify the
results.
• i.e. you believe 70% the voice is matching
13-07-2017
Suresh Kumar K

6. VIDEO FORENSIC
Forensic video analysis is the scientific examination,
comparison and/or evaluation of video in legal matters.
Accident Reconstruction Video
Forensic Video Enhancement
Forensic Video Authentication
Chain of custody is important hear
13-07-2017
Suresh Kumar K

7. DIGITAL IMAGE
FORENSIC
1. Clone detection
2. Error level analysis
3. Meta data
4. Geo tagging
5. Thumbnail analysis
13-07-2017
Suresh Kumar K

8. DEMO
Windows registry analysis using Frat
13-07-2017
Suresh Kumar K

9. DEMO
Windows Password reset using Hiren's.BootCD.15.2
Or
Image analysis using forensically (https://29a.ch)
13-07-2017
Suresh Kumar K

10. DEMO
Volatile memory analysis using FTK
13-07-2017
Suresh Kumar K

11. DEMO
Evidence gathering using Sysinternals Suite & Helix
13-07-2017
Suresh Kumar K

12. MALAYSIA AIRLINES MH 370
13-07-2017
Suresh Kumar K
https://academo.org/demos/spectrum-analyzer/

13. ANY QUESTION ?
13-07-2017
Suresh Kumar K

14. THANK YOU
13-07-2017
Suresh Kumar K