8/27/08: Notes

Overview

We discussed the class expectations, policies and information which can be found on the class website. We also did a very brief overview of the things to come in this class.

We defined Computer Forensics and talked about computer basics:

1) What is a computer?
2) How does it work?
3) Different types of computer data
4) Other devices such as PDAs or cell-phones

We also discussed the difference between Dead and Live Forensics; and we discussed hardware as evidence itself. Dead Forensics deals with data that is ``at rest'' or not currently in use. Examples that we covered are hard drives, CDs/DVDs, USB flash drives and floppies. Live Forensics deals with a system that is in current use. Live data is volatile and can be overwritten or lost. Examples of volatile data include RAM contents, open files, programs (often called processes), network connections as well as other items that we will cover later.

We also discussed some basic ideas of computer networking.

During our discussion of data obliteration I had mentioned the case of the hard drive that survived a shuttle crash. Here is a link about the hard drive that survived the failed Columbia mission

All of these topics will be discussed in depth as the class continues.

Your homework is to join the Listserve and read Chapters 1-2 before the next class next week.