ImageVerifierCode 换一换
格式:PDF , 页数:20 ,大小:223.68KB ,
资源ID:531677      下载积分:5000 积分
快捷下载
登录下载
邮箱/手机:
温馨提示:
如需开发票,请勿充值!快捷下载时,用户名和密码都是您填写的邮箱或者手机号,方便查询和重复下载(系统自动生成)。
如填写123,账号就是123,密码也是123。
特别说明:
请自助下载,系统不会自动发送文件的哦; 如果您已付费,想二次下载,请登录后访问:我的下载记录
支付方式: 支付宝扫码支付 微信扫码支付   
注意:如需开发票,请勿充值!
验证码:   换一换

加入VIP,免费下载
 

温馨提示:由于个人手机设置不同,如果发现不能下载,请复制以下地址【http://www.mydoc123.com/d-531677.html】到电脑端继续下载(重复下载不扣费)。

已注册用户请登录:
账号:
密码:
验证码:   换一换
  忘记密码?
三方登录: 微信登录  

下载须知

1: 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。
2: 试题试卷类文档,如果标题没有明确说明有答案则都视为没有答案,请知晓。
3: 文件的所有权益归上传用户所有。
4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
5. 本站仅提供交流平台,并不能对任何下载内容负责。
6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。

版权提示 | 免责声明

本文(ASTM E2678-2009 Standard Guide for Education and Training in Computer Forensics《计算机取证的教育和培训的标准指导办法》.pdf)为本站会员(sumcourage256)主动上传,麦多课文库仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对上载内容本身不做任何修改或编辑。 若此文所含内容侵犯了您的版权或隐私,请立即通知麦多课文库(发送邮件至master@mydoc123.com或直接QQ联系客服),我们立即给予删除!

ASTM E2678-2009 Standard Guide for Education and Training in Computer Forensics《计算机取证的教育和培训的标准指导办法》.pdf

1、Designation: E 2678 09Standard Guide forEducation and Training in Computer Forensics1This standard is issued under the fixed designation E 2678; the number immediately following the designation indicates the year oforiginal adoption or, in the case of revision, the year of last revision. A number in

2、 parentheses indicates the year of last reapproval. Asuperscript epsilon () indicates an editorial change since the last revision or reapproval.1. Scope1.1 This guide will improve and advance computer foren-sics through the development of model curricula consistentwith other forensic science program

3、s.1.2 Section 4 describes the alternative paths by whichstudents may arrive at and move through their professionaltraining. Sections 5 through 7 cover formal educational pro-grams in order of increasing length: a two- year associatedegree, a four-year baccalaureate degree, and graduate degrees.Secti

4、on 8 provides a framework for academic certificateprograms offered by educational institutions. Section 9 outlinesmodel criteria and implementation approaches for training andcontinuing education opportunities provided by professionalorganizations, vendors, and academic institutions.1.3 Some profess

5、ional organizations recognize computerforensics, forensic audio, video, and image analysis as subdis-ciplines of computer forensics. However, the curricula andspecific educational training requirements of subdisciplinesother than computer forensics are beyond the scope of thisguide.1.4 This standard

6、 does not purport to address all of thesafety concerns, if any, associated with its use. It is theresponsibility of the user of this standard to establish appro-priate safety and health practices and determine the applica-bility of regulatory limitations prior to use.2. Terminology2.1 Definitions of

7、 Terms Specific to This Standard:2.1.1 assembler, nsoftware that translates a low-levelprogram into a form that can be executed by a computer.2.1.2 capstone project, ndesign and implementation-oriented project typically completed during the final year of adegree program that requires students to app

8、ly and integrateknowledge and skills gained from several courses.2.1.3 central processing unit (CPU), ncomputer chip thatinterprets commands and runs programs.2.1.4 compiler, nsoftware that translates a high- levelprogram into a form that can be executed by a computer.2.1.5 digital forensics, nscien

9、ce of identifying, collecting,preserving, documenting, examining, and analyzing evidencefrom computer systems, the results of which may be reliedupon in court.2.1.6 cryptography, nusing the sciences of encryption totransform data to hide its information content and decryption torestore the informati

10、on to its original form.2.1.7 data fusion, nprocess of associating, correlating,and combining data and information from single and multiplesources.2.1.8 debugger, nsoftware that is used to find faults inprograms.2.1.9 demultiplexing, vprocess of isolating individual im-ages from a video flow.2.1.10

11、digital evidence, ninformation of probative valuethat is stored or transmitted in binary form that may be reliedupon in court.2.1.11 computer forensics, nscience of identifying, col-lecting, preserving, documenting, examining, and analyzingevidence from computer systems, networks, and other elec-tro

12、nic devices, the results of which may be relied upon in court.2.1.12 distributed denial of service (DDoS), nintentionalparalyzing of a computer or a computer network by flooding itwith data sent simultaneously from many locations.2.1.13 Electronic Communications Privacy Act (ECPA),nregulates interce

13、ption of wire and electronic communica-tions (18 USC 2510 et seq.) and retrieval of stored wire andelectronic communications (18 USC 2701 et seq.)2.1.14 embedded device, nspecial-purpose computer sys-tem that is completely encapsulated by the device it controls.2.1.15 enterprise system, ncomputer sy

14、stems or networksor both integral to the operation of a company or large entity,possibly global in scope.2.1.16 ext2/ext3 (Linux-extended 2/Linux-extended 3) filesystem, nfile system typically used with Linux-based oper-ating systems.1This guide is under the jurisdiction of ASTM Committee E30 on For

15、ensicSciences and is the direct responsibility of Subcommittee E30.12 on Digital andMultimedia Evidence.Current edition approved June 15, 2009. Published August 2009.1Copyright ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959, United States.2.1.17 file allocat

16、ion table (FAT) file system, noriginal filesystem used with Microsoft and IBM-compatible operatingsystems still in common use.2.1.18 intrusion detection system (IDS), nsoftware orhardware that are used to identify attacks or anomalies oncomputers or networks or both.2.1.19 link analysis, ntype of an

17、alysis often used by lawenforcement that uses visual or other means of showingrelationships between people, places, events, and things bylinking them through timelines, telephone calls, emails, or anyother consistent scheme.2.1.20 local area network (LAN), ncomputer networkcovering a local area such

18、 as a home, office, or small group ofbuildings, such as a college.2.1.21 malware, nmalicious software designed to causeunexpected and frequently undesirable actions on a system (forexample, viruses, worms, spyware, or Trojan horses).2.1.22 mock trial, noften referred to as “moot court,”role-playing

19、court proceedings intended to prepare students forcourtroom testimony.2.1.23 new technology file system (NTFS), nadvanced filesystem with security features commonly used with the Win-dows and all subsequent sytems.2.1.24 open system interconnect (OSI), nlayered modelthat describes the way computers

20、communicate on a network.2.1.25 personal area network (PAN), nnetworkingscheme that enables computers and other electronic devices tocommunicate with each other over short distances either withor without wires.2.1.26 partitioning, vsoftware method of dividing aphysical hard drive into logical contai

21、ners that will appear asmultiple logical drives.2.1.27 peer to peer (P2P), ncommunications network thatallows multiple computers to share files.2.1.28 personal electronic device (PED), nconsumerelectronic device that is typically mobile or handheld (forexample, personal digital assistant (PDA), cell

22、 phone, oriPOD).2.1.29 photogrammetry, nscience of obtaining dimen-sional information of items depicted in photographs.2.1.30 public key infrastructure (PKI), nsystem that usesencryption to verify and authenticate network transactions.2.1.31 random access memory (RAM), ncomputers read/write memory;

23、it provides temporary memory space for thecomputer to process data.2.1.32 redundant array of inexpensive/independent disks(RAID), nsystem that uses two or more drives in combina-tion for fault tolerance or performance.2.1.33 steganography, ntechnique for embedding infor-mation into something else, s

24、uch as a text file in an image or asound file, for the sole purpose of hiding the existence of theembedded information.2.1.34 thumb drive, nsmall digital storage device thatuses flash memory and a universal serial bus (USB) connectionto interface with a computer.2.1.35 topology, nphysical layout or

25、logical operation of anetwork.2.1.36 virtual private network (VPN), ncomputer networkthat uses encryption to transmit data in a secure fashion over apublic network.2.1.37 voice over internet protocol (VoIP), ntechnique fortransmitting real-time voice communications over the internetor another transm

26、ission control protocol/internet protocol(TCP/IP) network.2.1.38 wide-area network (WAN), ncomputer networkcovering a wide geographical area.2.2 Acronyms:2.2.1 FDA, nFood and Drug Administration2.2.2 FTC, nFederal Trade Commission2.2.3 IP, ninternet protocol2.2.4 IRS, nInternal Revenue Service2.2.5

27、KSA, nknowledge, skill, and ability2.2.6 SEC, nSecurities and Exchange Commission2.2.7 TCP, ntransmission control protocol3. Significance and Use3.1 With the proliferation of computers and other electronicdevices, it is difficult to imagine a crime that could notpotentially involve digital evidence.

28、 Because of the paucity ofdegree programs in computer forensics, practitioners havehistorically relied on practical training through law enforce-ment or vendor-specific programs or both.3.2 In this guide, curricula for different levels of theeducational system are outlined. It is intended to provide

29、guidance to:3.2.1 Individuals interested in pursuing academic programsand professional opportunities in computer forensics,3.2.2 Academic institutions interested in developing com-puter forensics programs, and3.2.3 Employers seeking information about the educationalbackground of graduates of compute

30、r forensics programs andevaluating continuing education opportunities for current em-ployees.4. Qualifications for a Career in Computer Forensics4.1 Introduction:4.1.1 Computer forensics plays a fundamental role in theinvestigation and prosecution of crimes. Since any type ofcriminal activity may in

31、volve the seizure and examination ofdigital evidence, the percentage of cases that involves digitalevidence will continue to increase. The preservation, examina-tion, and analysis of digital evidence require a foundation inthe practical application of science, computer technology, andthe law. A prac

32、titioner of computer forensics shall be capableof integrating knowledge, skills, and abilities in the identifica-tion, preservation, documentation, examination, analysis, inter-pretation, reporting, and testimonial support of digital evi-dence. A combination of education and practical training canpr

33、epare an individual for a career in computer forensics, andthis section addresses the qualifications an individual will needto pursue such a career.4.1.2 As in all forensic disciplines, a combination of per-sonal, technical, and professional criteria will influence aprospective computer forensics pr

34、actitioners suitability foremployment. Effective written and oral communication skillsare essential to computer forensics practitioners because theyE2678092may have to testify to their examination results in court. Newemployees may be hired provisionally or go through a proba-tionary period that req

35、uires successful completion of additionaltraining or competency testing or both as a prerequisite forcontinued employment.4.2 Career Paths in Computer Forensics:4.2.1 Numerous competent, accurate, and admissible digitalforensic examinations are performed every year by qualifiedand experienced examin

36、ers who have no college education. Infact, much of the expertise in this field is represented byprofessionals whose practical experience, on-the-job training,and work credentials qualify them in this discipline. Fewinstitutions offer degrees in the discipline because the field isrelatively new. As a

37、cademic programs are developed and madeavailable, it will become preferable for forensic examinationsto be performed by individuals who have a degree in computerforensics (or a related field) supported by experience andtraining.4.2.2 The discussion of qualifications presents three alter-native caree

38、r paths into computer forensics which are depictedin Fig. 1:4.2.2.1 One is for law enforcement personnel who seek tomove into computer forensics after they become sworn offic-ers,4.2.2.2 Another is for persons with relevant technical andcritical thinking skills that are equivalent to a bachelorsdegr

39、ee, and4.2.2.3 A third is for persons who have earned the formaldegree.4.2.3 A description of careers in computer forensics isprovided in Appendix X1.4.2.4 Personal CharacteristicsComputer forensics, likeother forensic disciplines, requires personal honesty, integrity,and scientific objectivity. Tho

40、se seeking careers in this fieldshould be aware that background checks similar to thoserequired for law enforcement officers are likely to be acondition of employment. The following may be conducted orreviewed or both before an employment offer is made and maybe ongoing conditions of employment (thi

41、s list is not all-inclusive):(1) Past work performance(2) Drug tests(3) History of drug use(4) Driving record(5) Criminal history(6) Citizenship(7) Credit history(8) History of hacking(9) Personal associations(10) Psychological screening(11) Medical or physical examination(12) Polygraph examination4

42、.2.5 Academic QualificationsPractitioners of computerforensics historically have not been required to have a degree.However, the trend within some areas of the field is tostrengthen the academic requirements for this discipline andrequire a baccalaureate degree, preferably in a science. Theacademic

43、qualifications for computer forensics practitionersare discussed in greater detail later in this guide and mayinclude the following knowledge, skills, and abilities:4.2.5.1 Technical:(1) Computer hardware and architecture(2) Storage media(3) Operating systems(4) File systems(5) Database systems(6) N

44、etwork technologies and infrastructures(7) Programming and scripting(8) Computer security(9) Cryptography(10) Software tools(11) Validation and testing(12) Cross-discipline awareness4.2.5.2 Professional:(1) Critical thinking(2) Scientific methodology(3) Quantitative reasoning and problem solving(4)

45、Decision making(5) Laboratory practices(6) Laboratory safety(7) Attention to detail(8) Interpersonal skills(9) Public speaking(10) Oral and written communication(11) Time management(12) Task prioritization(13) Application of digital forensic procedures(14) Preservation of evidence(15) Interpretation

46、 of examination results(16) Investigative process(17) Legal process4.2.5.3 Copies of diplomas and formal academic transcriptsare generally required as proof of academic qualification.Awards, publications, internships, and student activities may beused to differentiate applicants. Claims in this rega

47、rd aresubject to verification through the background investigationprocess.4.2.6 CredentialsA digital forensic practitioner shoulddemonstrate continued professional development that is docu-mented by credentials. A credential is a formal recognition ofa professionals KSA. Indicators of professional s

48、tandinginclude academic credentials, professional credentials, trainingcredentials, and competency tests. Credentials can facilitate thequalification of a witness as an expert.4.3 Implementation: Keys to a Career in Computer Foren-sics:4.3.1 Preemployment PreparationCompetitive candidatescan demonst

49、rate the interest and aptitude or KSAs that estab-lish their readiness for a digital forensic position. These KSAsmay include areas important to all potential forensic sciencepractitioners including, but not limited to, quality assurance,ethics, professional standards of behavior, evidence control,report writing, scientific method, inductive and deductivereasoning, investigative techniques, statistics, and safety.E2678093Documentation of coursework and practical experiences in-volving these KSAs can significantly enhance the objecti

copyright@ 2008-2019 麦多课文库(www.mydoc123.com)网站版权所有
备案/许可证编号:苏ICP备17064731号-1