computer-forensic-investigation-state-requirements

Computer Forensic Investigation State Requirements

By definition, computer forensics is the procedure wherein an expert sees through the files stored or recorded in a computer's system. These data may have been deleted, hidden, or saved. The search for the computer-related information uncovers the engagement in any crime or deception.

Computer forensics is nonetheless being widely used in the areas of intelligence, military, businesses, and law enforcement agencies. There is obviously a protocol that is followed in the course of the computer forensic investigation since the collected, analyzed, and examined data are presented before the courts of law in the effort of uncovering the malicious acts incurred by certain parties.

Moreover, as it is related to a legal action, it is but necessary that the computer forensic investigation state requirements are observed.

Computer forensics is an application which is not only confined to the recovery of any lost data. Such field is more so used in giving explanations and providing insights to any committed crime. Computer forensic investigation is often employed to collect the pertinent data in finding out the truth about a criminal or suspect to a crime.

With today's wide use of the Internet and the computer, it is very possible that clues may be traced from the electronic media sources. More so, the company employers are nowadays seeking for employees who are equipped with the rightful knowledge on the techniques and tools about computer forensic investigations.

It is necessary that the person is qualified to handle the task. Needless to say, a formal education on the said field is required. Among the instructions which the computer forensics training institutes tackle about are the enhancement of one's computer skills, important legal issues, and the needed computer forensic tools and techniques to be applied in different cases.

There are various computer forensic investigation state requirements and they vary from one state to another. However, we must touch on with the most common requisites which apply to all of them. The following discussion will provide you with the insights on the computer forensic state requirements for your perusal.

First of all, it is a must that the individual is a computer forensic professional. For one to attain this, a particular training course must be undertaken. Certificate programs in computer forensics are offered in a lot of institutions. The academic requirements differ too and it matters that one passes all of them.

Next, one must contain in him an all-embracing knowledge about the computer systems and how its applications and programs work. With these, one must also have the skill or the ability to restore any lost information from all types of electronic media but without the occurrence of any changes in them.

A forensic investigator must be knowledgeable of the computer software and hardware and must be capable of understanding the various operating systems in use these days.

An investigator should know the techniques to be used in uncovering the data from any type of file structure. There are different tools which need to be used in various cases.

Most importantly, a computer forensic investigator must be able to generate a refined report so that all of the input data are comprehensible enough even for those who don't understand the technicalities of the investigation.

These are just among the computer forensic investigation state requirements that must be strictly observed for a more precise result in the findings and conclusions in a particular case.

0

The Best Data Recovery Choice For You

The best defense against a loss of data is a really solid and faithful backup routine of important files to reliable media. It's also a good idea for the media to be removable and portable if possible so that even if something happens to your whole computer for any reason, the data is protected by being in a totally different physical area.

OK, so that is the best solution to data loss. But what if you have not been backing up your drive like you should and now you find yourself confronted with the daunting task of getting all the important files back that were on your computer before the emergency happened? (By the way, you can take some comfort in knowing that quite a few people find themselves in this situation. You are not alone.) What are your choices at this point?

Well, basically there are two ways of recovering data from a damaged disk, either by using a data recovery service or a data recovery software package. Either can do the job, but there are some factors that should go into your decision about which one to use. First, are you pretty computer savvy? If you are then maybe data recovery software will work for you. If not, do not try this method at all. The other is how much time do you have to spend on retrieving this data? If you have lots of time to put into it, then consider doing the job yourself with a reputable software package. If you don't have much time to devote to this endeavor, don't waste both time and money with the software option.

If you have decided upon using a data recovery service, you should know that the odds are that you will get a good portion, if not all of your data back. The generally accepted success rate in the industry is around 80%. Much of the success will depend on the skill and determination of the data recovery specialist who will be working on your drive. They all have sophisticated software tools to work with, but data recovery is not as simple as just plugging in a piece of software, walking away and coming back when it has found all the files. It often requires a specialist who is a bit of a detective, andnot easily discouraged, to get back a good portion of data, especially on drives with physical damage.

Don't be surprised to get two quotes for data recovery from some companies either. One for logical data retrieval that is much easier to handle and will be a much lower figure, and one for physical damage which is far more challenging and therefore rightly costs more. You will also find that cost quotes will often vary considerably. It is usually best to choose somewhere in the middle of the pack toward the higher end. The reason for this is that some companies engage in a bait and switch tactic that indicates that they will cost less initially, but when they actually receive the drive they wil claim that upon review the cost will be much higher. It's best to avoid messing with these companies at all.

So if you have lost data and have no backups to fall back on, data recovery can still be done. Just use the guidelines presented in this article for choosing the data recovery method that will work best for you.

0

MCSE 70 290 Certification Primer

Microsoft Certifications are one of the most widely acclaimed, pursued, and achieved technical certifications in the IT industry. The demand for Microsoft Certified Professionals in the job market is increasing every year.

Microsoft offers a number of certification levels depending on specific areas of proficiency and nature of job. Some of the certifications pertaining to networking are

Microsoft Certified Professional (MCP)

Microsoft Certified System Administrator (MCSA)

Microsoft Certified System Engineer (MCSE)

Each certification level has certain exams associated with it. You can decide the appropriate certification exam based on your experience, skills, and interests.

Benefits of Microsoft Certifications

Microsoft Certifications provide a standard method for testing employee skills. The certifications provide employers a valid benchmark for evaluating the employee's abilities. This will provide you the recognition and reward as per your expertise.

Microsoft Certifications offer prospective employers a baseline to judge your knowledge, skill, and expertise in the field. Certifications can provide added advantage if you are at the same level of experience as another person without certifications.

Certifications are a valuable tool if you have no or very little experience. The certifications that you hold can prove and reassure your employers and consultants about your knowledge in the field. This will help you secure good job as well as negotiate a good salary.

Pre-Requisite Experience (Recommended) for Microsoft Certifications

To pursue this certification you should have at least 1 year of experience in:

Implementing and administering a network operating system in environments with 50 to 26,000 supported users, in approximately 3 to 150 physical locations.

Implementing network services and applications such as file and print services, database services, messaging services, proxy server or firewall services, dial-in server services, and Web hosting.

Implementing and administering a desktop operating system.

Designing a network infrastructure with 3 or more domain controllers.

Significance of Microsoft Certifications for Microsoft Windows Server 2003

Microsoft has developed independent certification requirements for Microsoft Windows Server 2003. An aspirant can certify directly for MCSE/MCSA in Windows 2003 if they are new to certification process. If the aspirant is already a certified MCSE /MCSA in Windows 2000, then they can follow the upgrade path for MCSEs in Windows 2000 to secure Windows 2003 Certifications. If the aspirant certifies in MCSE for Windows NT4.0, they can earn MCSE in Windows 2003 by following the upgrade path for MCSEs in Windows NT4.0.

The exams are slightly more challenging than their Windows 2000 counterparts, but they will actually test your hands-on knowledge since that is the most important part of ensuring that a certification is credible.

Exam 70-290: Managing and Maintaining a Microsoft Windows Server 2003 Environment

Exam 70-290 is the first in the series of the core exams for MCSE certifications.

When you pass the Managing and Maintaining a Microsoft Windows Server 2003 Environment (MCSE 70-290) exam, you achieve Microsoft Certified Professional (MCP) status. You also earn credit toward the following certifications:

Core credit towards Microsoft Certified Systems Administrator (MCSA) on Microsoft Windows Server 2003 certification

Core credit towards Microsoft Certified Systems Engineer (MCSE) on Microsoft Windows Server 2003 certification

MCSE 70-290 exam objectives are

Objective 1: Managing and Maintaining Physical and Logical Devices

In this objective you will need to demonstrate expertise in managing and maintaining physical and logical devices. As an administrator, you should understand Basic and Dynamic disks, RAID configuration and troubleshooting, driver signing, and the use of tools, such as Device Manager and Hardware Troubleshooting Wizard. Familiarize yourself with Device Manager and the warning and disabled icons found when problems are present on installed devices.

Objective 2: Managing Users, Computers, and Groups

This objective includes many topics, so you should be prepared to face many questions that fall into this category. Have a healthy introduction to profile management, user and group accounts, permissions, and troubleshooting. Practice a lot on GPOs and perform a variety of administrative tasks, including configuration of desktop settings, control of security settings, assignment of scripts, redirection of folders, and software distribution. Also, get a clear understanding on inheritance and filtering.

Objective 3: Managing and Maintaining Access to Resources

Knowing how to configure, monitor, audit and troubleshoot NTFS permissions based issues are one of those most important areas that you need to know this concept thoroughly and also be sure to brush up on your share permissions and share/NTFS permissions interaction. Do not forget to brush up on how folder and file permissions can change or stay the same when copying or moving within a drive or between drives.

Objective 4: Managing and Maintaining a Server Environment

In this objective you'll find questions from topics, such as Event Viewer, System Monitor, software updates (including the functionality of Microsoft's Software Update Service or SUS), Remote Assistance, disk quotas, print queues, performance objects and IIS 6.0. Spend time understanding IIS topics around Web sites, Virtual and physical directories, files and host and cname records in DNS. New to Windows Server 2003 is SUS. Understand clearly how SUS is used for deploying and managing client and server critical updates.

Objective 5: Managing and Implementing Disaster Recovery

In this objective you'll find questions on ASR, VSS, backing up files and system state data, configuring security for backup operators, verifying backup jobs, managing media, restoring and scheduling backups and recovering from server hardware failures. You should take some extra time to get familiar with the various types of backups that Windows Server 2003 supports, as well as the various configuration options that are available to you. Practice making backups of different types and then practice restoring them.

MCSE 70-290 Exam Model

Most of the questions in the MCSE 70-290 exam are multiple choice type. The questions require the "best" answer from several close responses. Other questions may present an implementation scenario, requirements, and a proposed solution and then ask if the solution meets all of the requirements or combinations of the primary and secondary requirements. Microsoft has introduced some testing innovations for the certification exams. These question types present a more realistic visual representation of the tasks a MCSE would do in future. These are

Hot Area Questions

This type of question requires indicating the correct answer by selecting one or more elements within a graphic.

Active Screen Questions - This type of question asks you to configure a dialog box by changing one or more elements.

Drag and Drop Questions - This type of question asks you to drag source objects to appropriate targets within a work area.

Build List and Reorder Questions - This type of question asks you to indicate the correct answer by building an answer list. In a Build List and Reorder question, you need to build a list by dragging the appropriate source objects to the answer list and then placing them in the correct order based on criteria defined in the question.

Create a Tree Questions - This type of question asks you to create a tree structure. You indicate the correct answer by dragging source nodes to the correct locations in the answer tree. Nodes consist of text and a small icon.

Windows Simulation Questions - This type of question asks you to indicate the correct answer by performing specific tasks such as configuring and installing network adapters or drivers, configuring and controlling access to files, and managing hardware devices. Many of the tasks that systems administrators and systems engineers perform can be presented more accurately in simulations than in most traditional exam question types.

You can get hands-on experience on new set of questions that are available in Whizlabs MCSE 70-290 Exam Simulator. This will help you plan your study regime to ensure success.

Passing Score

Microsoft has normalized scoring for all MCP exams, so the same passing score applies to all exams. 700 is now the minimum passing score for all MCP exams. However, the maximum score (which used to top out at 1000) varies per exam, depending on the complexity of the skills measured.

Time Limit

The exam duration is 175 minutes with 45 questions. You will have plenty of time to answer the exam questions, so there is no need to rush. If you have spare time available, you can double check the questions and ensure that you have read them correctly and actually answered the question as intended.

Exam Result

Instead of reporting results based on major categories for exam objectives as it used to, Microsoft is now providing numerical scores and bar graphs for "skills clusters". Visually, the bars in the exam report show you how well you fare in each skills cluster. If bars that represent cluster scores are close to one end of the graph, they indicate stronger skills; bars near the other end indicate weaker skills. Please store your exam results in both paper and electronic format for later reference.

Sample Questions

Question 1

You are a systems administrator for TicTacToe Toy Manufacturers. All servers in the company run on Microsoft Windows Server 2003. The company's Active Directory infrastructure consists of a single domain hosted on two domain controllers named Tic1 and Tic2.

Tic2 experienced a hard disk failure, and hence has been taken offline. Tic2 remained offline for some days while all Active Directory updates were made to Tic1. You proceed to restore the data from backup while ensuring that the latest Active Directory changes are replicated to Tic2.

How should you restore the lost data from backup?

Choices:

Perform authoritative restore on Tic1.

Perform normal restore on Tic2.

Perform primary restore on Tic2.

Perform authoritative restore onTic2.

Correct Choice: B

Explanation:

Choice B is the correct answer.

During a normal restore operation; Backup operates in non-authoritative restore mode. That is, any data that you restore, including Active Directory objects, will have their original update sequence number. The Active Directory replication system uses this number to detect and propagate Active Directory changes among the servers in your organization. Because of this, any data that is restored non-authoritatively will appear to the Active Directory replication system as though it is old, which means the data will never be replicated to your other servers. Instead, if newer data is available from your other domain controllers, the Active Directory replication will update the restored data. Hence, choices A, C, and D are incorrect.

Question 2

You are a systems administrator for Blueberry Packaging Industries. All servers in the company run on Microsoft Windows Server 2003.

You create a folder named Custom Package on the company's file server to contain the company's files. You share this folder as Custom Package. The folder is configured with default NTFS permissions and default share permissions. The file server is located in a secure room.

Within the shared folder, Managers should be able to add and change files and subfolders. Employees in the Sales and Packers department should be able to change and delete files and subfolders. All other employees should only be able to view the files.

All Sales employees are members of the Sales domain local security group. All Managers are members of the Managers domain local security group. The Packers are members of the Packers global security group.

How should you modify share level permissions on the Custom Package folder so that the appropriate users have the minimum required privileges? (Choose all that apply)

Choices:

Grant Change share permissions to Managers.

Deny Full Control share permissions to Managers.

Grant Change share permissions to Sales.

Grant Full Control share permissions to Sales.

Grant Change share permissions to Packers.

Grant Full Control share permissions to Packers.

Deny Full Control share permissions to Everyone.

Remove Everyone from the share permissions list.

Correct Choices: A, C, and E

Explanation:

Choices A, C, and E are the correct answers.

Change permissions allow the users to create, delete, and change any files and folders in the shared folder, provided the users have appropriate NTFS permissions on the files and folders. The default NTFS permission in Windows Server 2003 is Read for Everyone and the default share level permissions grant Read access to Everyone. You should not remove Everyone from the share permission list. By default, share level permissions grant Read access to Everyone.

How to Prepare for Microsoft Certification?

Following are the steps to prepare for Microsoft certification.

MCSE exams are not easy, as advertised on many websites. The MCSE Certifications are tough, so plan to put in a lot of time and effort getting ready for your certification exams. Get all information you can about the certification exams and then start working towards your goal.

Get hands on experience. The first step in the preparation for any Microsoft Certification is hands on experience with the related product. For MCSE, the aspirant needs to have at least a year of working experience and for MCSA, the minimum recommended time of experience is 6 months. If you are not working anywhere, it will help, if you can volunteer your IT skill services to gain valuable experience.

You can set up a small network at home to practice. Setting up the home network will give a great opportunity to learn. You can practice the lab exercises in the home network as and when you study. This will give you a better understanding of the theories than just studying the exam guides.

Get trained in the related product. If possible, try to get training in the related product in a Microsoft Authorized Training Center. You can use training resources to supplement your skills and experience. You can also use the Microsoft Official Curriculum for the related exam as well as Microsoft Press books that are available for the exam.

For Exam 70-290, the main areas that you need to concentrate are

Automated System Recovery (ASR)

Diskpart utility

Diskraid utility

Emergency Management Services (EMS)

File Replication Service (FRS)

Group Policy Management Console (GPMC)

Open File Backup

Password Backup and Restore Wizard

Remote Assistance

Remote Desktop

Shadow copying of shared folders

Software Update Services (SUS)

Virtual disk service

Permissions -Share and NTFS

Users, Computers, and Groups

Use the preparation guide of the exam that you want to take and read it thoroughly. You should know all the exam objectives of MCSE 70-290 covered in the exam preparation guide.

Use practice test software packages. Whizlabs MCSE 70-290 Exam Simulator is an example.

Do NOT use Braindumps. Braindumps might help you get the certification, but you will lack important practical knowledge about the product. Hence, your prospects of landing a good IT job will be less. Some brain dumps deliberately mislead you. So BEWARE!

You can participate in any online discussion forum, where you can participate in an ongoing dialogue and even ask doubts if you have any. You are sure to get the right guidance.

You've learned the details about the MCSE 70-290 Exam, its pattern, objectives etc. Download the MCSE Exam Preparation Guide to learn how Whizlabs can help you achieve the MCSE credential.

Resources

Exam simulators

Whizlabs MCSE 70-290 Exam Simulator

Besides identifying your weak areas and giving you a feel of the exam environment, Whizlabs Exam Simulator nurtures your potential to acquire domain expertise so that you not only succeed in your certification exam but succeed in your career too.

Articles on Windows 2003

Microsoft's Windows 2003 Server Home Page

What's New in Active Directory

Windows Server 2003 Demos

Windows Server 2003, Standard Edition

Microsoft Online Resources

TechNet : Designed for IT professionals, this resource includes Howto's, best practices, downloads, technical chats, and much more.

MSDN : The Microsoft Developer Network (MSDN) is a reference for developers, featuring code samples, technical articles, newsgroups, chats, and more.

Training & Certification Newsgroups : A newsgroup exists for every Microsoft certification. By participating in the ongoing dialogue, you take advantage of a unique opportunity to exchange ideas with and ask questions of others, including more than 750 Microsoft Most Valuable Professionals (MVPs) worldwide.

0