eSecurity Institute

Uniform Electronic Transactions Act

The Uniform Electronic Transactions Act is a law that was established in 1999 by the National Conference of Commissioners on Uniform State Laws (NCCUSL). The Uniform Electronic Transactions Act provides guidelines on the use of electronic records, contracts and signatures in personal, business and governmental transactions. As the world has

The Privacy Act of 1974

The Privacy Act of 1974 was developed in order to established a standardized set of principles and guidelines regarding the collection and disclosure of private data on individuals within the United States. The Privacy Act of 1974 introduced guidelines that inform individuals records that store their information and their rights

The Computer Security Act

The The Computer Security Act was created in 1987 by U.S. Congress in order to enhance security policies surrounding the use of sensitive data on computer systems. The Computer Security Act lead to the formation of several guidelines under the National Institute of Standards and Technology (NIST) regarding the

Health Insurance Portability and Accountability Act (HIPAA)

Health Insurance Portability and Accountability Act (HIPAA) is a law within the United States that protects individuals’ privacy rights in relation to their sensitive health data. This law is enforced by regulating how organizations within the healthcare industry store and transmit patient data and information. The primary HIPAA regulation that

Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act (CFAA) is a federal law in the United States that criminalizes computer-related fraud and abuse. It was enacted in 1986 and has been amended several times since then. The CFAA makes it illegal to intentionally access a computer or computer network without authorization or

Volatility: Digital Forensics

The Volatility Framework is an open source digital forensics software created by the Volatility Foundation. Volatility is a tool that is used for memory forensics which is an aspect of digital forensics that involves extracting and analyzing digital artifacts on information systems. Volatility is available for Windows, MacOS and Linux

What is a MAC Address?

The Media Access Control address or MAC address is unique address similar to an IP address that is associated with a particular piece of hardware. The MAC address helps users identify the type of hardware and the manufacturer of the device. MAC addresses help to differentiate between multiple devices on

What is Quality of Service (QoS)

Quality of Service (QoS) is a method of prioritizing network traffic to allow for better functionality of essential services. This could be done by filtering traffic based on port numbers, applications and MAC addresses. Traditionally these options needed to be configured manually which may prove to be difficult for inexperienced

Types of Encryption

Symmetric Encryption Symmetric encryption uses one key that is shared between all parties in order to access the encrypted data. Symmetric encryption is faster but less secure and is considered an older method of encryption. It is less secure because you are trusting all parties to use one key in

Hard Drive Types

Hard Drive Disk (HDD) HDD is a tradition storage device that uses a complex series of moving parts and is generally slower than a Solid State Drive (SSD). In the early years of computers Hard Disk Drives were the standard for storage devices however Solid State Drives are now becoming

Apple File System (APFS)

APFS is a file system that was released by Apple in 2016 and offers some new features when compared to HFS and HFS+. APFS takes advantage of Solid State Drives (SSD) which is a newer form of storage that provides faster speed. Therefore APFS allows for better storage utilization, better

Elcomsoft Forensics

Elcomsoft is a developer of digital foreniscs software for law enforcement, business and personal use. Elcomsoft provides a variety of digital forensics tools such as the Elcomsoft Mobile Forensic Bundle for Law Enforcement which costs $3,500. This tool allows for physical, logical and over the air acquisition of forensic

Cellebrite UFED

Cellebrite UFED is a world renowned mobile forensics platform used by governments, law enforcement and enterprise clients. Cellebrite allows the user to quickly extract data from smartphones, drones, SIM cards, SD cards, GPS devices, and more. Cellebrite UFED is a complete digital forensics toolkit equipped with proprietary software, physical hardware,

4Discovery: Digital Forensics Solutions

4Discovery is an organization which has designed a variety free digital forensics tools available online. Some of the tools created by 4Discovery are the MetaExtractor, USB Historian, ShellBagger and LinkParser. MetaExtractor is a software that allows investigators to quicky extact metadata from multimedia files. This is similar to the ExifTool

NetworkMiner

Network Miner is a Network Forensics Analysis Tool that is used to analyze packet captures and other valuable network data in an investigation. Network Miner functions as a passive network sniffer or packet capturing tool in order to detect operating systems, sessions, hostnames, open ports and more. Other features include

Autopsy: Digital Forensics

Autopsy is an open source digital forensics platform used by law enforcement, military, business and academic professionals. Autopsy is a feature rich platform that allows multiple add-ons for each specific industry. Autopsy comes equipped with the capability to allow the examiner to easily investigate computer hardware and mobile devices. Features

NirSoft Utilities

NirSoft is a website that offers free open source digital forensics and cybersecurity software. NirSoft utilities include a variety of free tools that can be helpful in a digital forensics investigation. The tools developed by NirSoft include capabilities that include password recovery, network protocol analyzers, command line utilities and web

Angry IP Scanner

The Angry IP Scanner is a free tool that operates on Windows, MacOS and Linux. The tool allows the user to easily scan IP addresses and ports along with other scanning features for network administration. The tool can conduct scans on local networks or over the internet. Users can scan

What is a Computer Forensics Investigator

A computer forensics investigator, also known as a computer forensics analyst is an individual who uses various advanced tools to extract, acquire, recover and analyze digital data and information found on technologies such as computers, mobile devices, smart technology and other stores of digital data. There are four main types

The Digital Forensics Process

Step 1: Identification The identification process is where the forensic investigator examines the available and potential sources for digital information. This could be hardware devices such as laptops, cellphones and tablets or it could be network data or information stored at the cloud. During the identification process the investigator highlights

Thumbcache Viewer

Thumbcache Viewer is a free tool that allows the user to extract thumbnail images associated with multimedia files on a computer. In many instances multimedia files that are deleted leave a trace of their contents through a thumbnail image. These thumbnail images can be recreated and easily extracted through the

Xplico: Network Forensic Analysis Tool

Xplico is an open source network forensics tool that differs from a network protocol analyzer. Xplico extracts the contents of various file types such as HTTP, IMAP, POP and SMTP. Xplico comes with a variety of powerful features such as data reassembly, realtime elaboration and Port Independent Protocol Identification (PIPI)

FTK Imager

FTK Imager is a digital forensics tool developed by Exterro. FTK Imager is a tool used for creating forensic images when examining multiple types of drives, devices and external memory sources. Creating a forensic image of a drive is an essential process in digital forensics. This allows investigators to examine

WireShark

WireShark is a free and open source network protocol analyzer. WireShark is used worldwide by a variety of security professionals in government, law enforcement, business and academia. WireShark is considered by many as the standard for network forensics tools on the market. WireShark has a rich set of features and

SIFT Workstation

The SIFT Workstation is a collection of digital forensic tools developed by SANS Institute. The SIFT Workstation not only provides access to digital forensic tools but also several tools used for incident response which may also be required in forensic roles. The SIFT Workstation is capable of reading and examining