Computer Forensics Investigation and Techniques

Computer Forensics Investigation and Techniques Introduction I am the student of International Advanced Diploma in Computer Studies (IADCS). In this course, I have to do Compute Forensic assignment. The assignment title is â€Å"Didsbury Mobile Entertainments LTD†. This assignment helps me understanding computer forensics investigation and techniques Before this assignment, although I am interested in computer forensic, I am hardly used computer forensics toolkit or done any investigation. Because of this assignment, I have learnt many techniques how to investigate computer and done it practically. So, by doing this assignment, I have gained in practical and much valuable knowledge in Computer Forensics.nd a heartfelt thanks to all the people in Myanma Computer Company Ltd. for their warmly welcome during the period of the IADCS course and this assignment developed. Task 1 i) Report DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 10, 2010 Introduction Computer forensics involves obtaining and analyzing digital information for figuring out what happened, when it happened, how it happened and who was involved. What is more, it is use as evidence in civil, criminal, or administrative cases. Reasons for a need for computer forensic investigation Computer forensics investigation can recover thousands of deleted mails, can know when the user log into the system and what he does, can determine the motivation and intent of the user, can search keywords in a hard drive in different languages and can gain evidence against an employee that an organization wished to terminate. For these reasons, in order to know whether Jalitha has been spending her time on her friend business or not, we need a computer forensic investigation. Steps to pursue the investigation In order to pursue the investigation, I would take the following steps: 1) Secure the computer system to ensure that the equipment and data are safe 2) Find every file on the computer system, including files that are encrypted, protected by passwords, hidden or deleted, but not yet overwritten. 3) Copy all files and work on this copy files as accessing a file can alter its original value 4) Start a detailed journal with the date and time and date/information discovered 5) Collect email, DNS, and other network service logs 6) Analyze with various computer forensics tools and software 7) Print out an overall analysis 8) Evaluating the information/data recovered to determine the case Conclusion After we know the reasons and steps for investigation, then we should move on to conduct the investigation. However, we should note that the first step of investigation is critical as if the system is not secure, then the evidence or data we found may not be admissible. ii a) Report for â€Å"The procedures to make sure the evidence holds up in court† DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 12, 2010 Introduction Evidence is any physical or electronic information (such as computer log files, data, reports, hardware, disk image, etc) that is collected during a computer forensic investigation. The purpose of gathering evidence is to help determine the source of the attack, and to introduce the evidence as testimony in a court of law. Procedures to make sure the evidence holds up in court In order to make the evidence admissible in court, we need to follow the following steps: 1) Before any evidence can be gathered, a warrant must be issued so that forensic specialist has the legal authority to seize, copy and examine the data 2) Have the responsibility to ensure that the law and the principles we used are met 3) Evidence must be obtained in a manner which ensures the authenticity and validity and that no tampering had taken place 4) Tracking the chain of custody is essential for preparing evidence as it shows the evidence was collected from the system in question, and was stored and managed without alteration. 5) Extracted/ relevant evidence is properly handled and protected from later mechanical or electromagnetic damage 6) Preventing viruses from being introduced to a computer during the analysis process 7) To ensure that original evidence must be described in complete details to present reliable evidence on the court 8) Must arrange to answer reliability questions relating to the software we have used Conclusion In gathering evidence, authenticity, reliability and chain of custody are important aspects to be considered. By following the above steps, we are proper in handling the evidence holds up in court. ii b) Evidence form Didsbury Mobile Entertainments Ltd IT Department Computer Investigation Case No.: 005 Investigation Organization: Gold Star Investigator: Win Pa Pa Aye Nature of Case: Companys policy violation case Location where evidence was obtained: On suspects office desk Description of evidence: Vendor Name Model No./ Serial No. Item #1 One CD Sony Item #2 A 4GB flash memory device Kingston 05360-374.A00LF Item #3 Evidence Recovered by: Win Pa Pa Aye Date Time: 10.12.2009 10:00 AM Evidence Placed in Locker: E2419 Date Time: 15.12.2009 11:00 AM Item # Evidence Processed by Description of Evidence Date/ Time 1 Win Pa Pa Aye Fully recovered deleted email on the drive which is sent to Radasas company, including data exchange between the businesses. 13.12.2009 3:00 PM 2 Win Pa Pa Aye Encrypted document hidden inside a bitmap file. Decrypted and saved on another media. 18.12.2009 9:00 AM 3 Win Pa Pa Aye Password-protected document covering the exchange of information with her friend. Password cracked and file saved on another media. 22.12.2009 2:00 PM Task 2 Report for â€Å"the way the data is stored, boot tasks and start up tasks for Windows and Linux systems† To effectively investigate computer evidence, we must understand how the most popular operating systems work in general and how they store files in particular. The type of file system an operating system uses determines how data is stored on the disk. The file system is the general name given to the logical structures and software routines used to control access to the storage on a hard disk system and it is usually related to an operating system. To know the way the data is stored in Windows XP and Linux, we need to get into file systems of Windows and Linux. The way the data is stored in Windows XP In Windows XP, although it supports several different file systems, NTFS is the primary file system for Windows XP. So, we will have a look in NTFS as the NTFS system offers better performance and features than a FAT16 and FAT 32 system. NTFS divides all useful places into clusters and supports almost all sizes of clusters from 512 bytes up to 64 Kbytes. And NTFS disk is symbolically divided into two parts MFT (Master File Table) area and files storage area. The MFT consumes about 12% of the disk and contains information about all files located on the disk. This includes the system file used by the operating system. MFT is divided into records of the fixed size (usually 1 Kbytes), and each record corresponds to some file. Records within the MFT are referred to as meta-data and the first 16 records are reserved for system files. For reliability, the first three records of MFT file is copied and stored exactly in the middle of the disk and the remaining can be stored anyplace of the disk. The remaining 88% of disk space is for file storage. Below is the partition structure of NTFS system. After we know the file system of Windows XP, then we will move on to the file system of Linux. The way the data is stored in Linux When it comes to Linux file system, ext2 has been the default file system as it main advantages is its speed and extremely robust. However, there is a risk of data loss when sudden crashes occur and take long time to recover. Sometimes the recovery may also end up with corrupt files. By using the advantage of ext2 and add some data loss protection and recovery speed led to the development of journaling file system ext3 and ReiserFs. Though ext2, ext3 and ReiserFs are the most popular file system, there are also some other file system used in the Linux world such as JSF and XFS. As Linux views all file systems from the perspective of a common set of objects, there are four objects superblock, inode, dentry and file. The superblock is a structure that represents a file system which includes vital information about the system. Moreover, it includes the file system name (such as ext2), the size of the file system and its state, a reference to the block device, and meta-data information. It also keeps track of all the nodes. Linux keeps multiple copies of the superblock in various locations on the disk to prevent losing such vital information. Every object that is managed within a file system (file or directory) is represented in Linux as an inode. The inode contains all the meta-data to manage objects in the file system. Another set of structures, called dentries, is used to translate between names and inodes, for which a directory cache exists to keep the most-recently used around. The dentry also maintains relationships between directories and files for traversing file systems. Finally, a VFS (Virtual file system) file represents an open file (keeps state for the open file such as the write offset, and so on). While the majority of the file system code exists in the kernel (except for user-space file systems), (2.3) shows the Linux file system from the point of view of high-level architecture and the relationships between the major file system-related components in both user space and the kernel. The boot task and start up task of Windows XP A good understanding of what happens to disk data at startup is also an important aspect as accessing to a computer system after it was used for illicit reasons can alter the disk evidence. First, we will discuss about the Windows XP startup and boot process, and then shift into the startup and boot process of Linux. Like any other PC system, Windows XP startup by running the POST test, performing an initialization of its intelligent system devices, and performing a system boot process. The boot process begins when the BIOS starts looking through the system for a master boot record (MBR). This record can reside on drive C: or at any other location in the system. When the BIOS execute the master boot record on the hard drive, the MBR examines the disks partition table to locate the active partition. The boot process then moves to the boot sector of that partition located in the first sector of the active partition. There, it finds the code to begin loading the Secondary Bootstrap Loader from the root directory of the boot drive. In NTFS partition, the bootstrap loader is named NTLDR and is responsible for loading XP operation system into memory. When the system is powered on, NTLDR reads the Boot.ini file. If boot.ini contains more than one operating system entry, a boot menu is displayed to the user, allowing the user to choose which operating system is to be loaded. Fig (2.4) shows Boot.ini contains two operating systems and allows user to choose. After the user has selected the desired mode to boot to, NTLDR runs Ntoskrnl.exe and reads Bootvid.dll, Hal.dll and the startup device drivers. After the file system driver has loaded, control is then passed from NTLDR to the kernel. At this time, Windows XP display Windows logo. Virtually, all applications we installed using the default installation decide that they should start up when windows starts. Under â€Å"Startup† tab in the system configuration utility, a list of programs that run when our system boots is listed. Fig (2.6) shows the listed program when our system boots. The boot task and start up task of Linux After we have get into the start up process of Windows XP, we will then shift into the startup process of Linux. In Linux, the flow of control during a boot is also from BIOS, to boot loader, to kernel. When you turn on the power, the BIOS perform hardware-platform specific startup tasks. Once the hardware is recognized and started correctly, the BIOS loads and executes the partition boot code from the designated boot device, which contains Linux boot loader. Linux Loader (LILO) is the Linux utility that initiates the boot process, which usually runs from the disks MBR. LILO is a boot manager that allows you to start Linux or other operating systems, including Windows. If a system has two or more operating systems, LILO gives a prompt asking which operating system the user wishes to initialize. When the user chooses the boot option, it then loads the choosing operating system into memory. The boot program, in turn, reads the kernel into memory. When the kernel is loaded, the boot program transfers control of the boot process to the kernel. The kernel then performs the majority of system setup (memory management, device initialization) before spawning separately, the idle process and scheduler and the init process which is executed in user space. The scheduler takes control of the system management. The init process executes scripts as needed that set up all non-operating system services and structures in order to allow a user environment to be created, and then presents the user with a login screen. We have described about the way the data stored, the boot task and startup task of Windows XP and Linux. After a thorough study of these areas, we can acquire or handle the evidence properly. Task 3 a) Features comparison of â€Å"EnCase, Access Datas Forensic and ProDiscover† Features of Guidance EnCase Forensic * In courts worldwide, forensically acquire data in a sound manner using software with an unparallel record * Using a single tool and investigate and analyze multiple platforms * With prebuilt EnScript ® modules such as initialized Case and Event Log analysis, it can automate complex and routine tasks, so it save time in analyzing * Find information despite efforts to hide, cloak or delete * Can easily handle large volumes of computer evidence, view all relevant files that includes deleted files, file slack and unallocated space * Directly transfer evidence files to law enforcement or legal representatives as necessary * Include review options that allow non-investigators to review evidence easily * Include report options that enable quick report preparation Features of Access Datas Forensic Toolkit * Provides integrated solution that is no need to purchase multiple tools to complete a case. * Provides integrated database that avoid application crashes, lost work and product instability. * Identify encrypted files automatically from more than 80 applications and crack those files. * Supports international language that allows us easily search and view foreign-language data in our native format * Include email analysis that can recover and analyze a wide range of email and web mail formats * Can generate different industry-standard report formats quickly and concisely * Collect key information from the registry that include user information, date of application installed, hardware, time zone and recently used information * While processing takes place, we can view and analyze data Features of ProDiscover * To keep original evidence safe, it create bit-stream copy of disk for analyzing that includes hidden HPA section * For complete disk forensic analysis, it search files or entire disk including slack space, HPA section and Windows NT/2000/XP alternate data streams * Without alter data on the disk, it can preview all files including metadata and hidden or deleted files * Support for VMware to run a captured image. * In order to ensure nothing is hidden, it examine data at the file or cluster level * To prove data integrity, it can generate and record MD5, SHA1 and SHA256 hashes automatically. * Examine FAT12, FAT16, FAT 32 and all NTFS file systems including Dynamic Disk and Software RAID for maximum flexibility. * Examine Sun Solaris UFS file system and Linux ext2 / ext3 file systems. * Integrated thumbnail graphics, internet history, event log file, and registry viewers to facilitate investigation process. * Integrated viewer to examine .pst /.ost and .dbx e-mail files. * Utilize Perl scripts to automate investigation tasks. * Extracts EXIF information from JPEG files to identify file creators. * Automated report generation in XML format saves time, improves accuracy and compatibility. * GUI interface and integrated help function assure quick start and ease of use. * Designed to NIST Disk Imaging Tool Specification 3.1.6 to insure high quality. AccessData FTK v2.0 Guidance EnCase Forensic 6.0 ProDiscover Forensic Report for Choosing Access Datas Forensic Toolkit I think Access Datas Forensic Toolkit is the most beneficial for our lab as it provides more forensic examination features than Encase and ProDiscover. In the evidence aspects, Access Data can acquire files and folders than others. So, it can be a powerful tool when we analyze files for evidence. Moreover, it uses database to support large volume of data that can avoid application crashes, lost work and product instability for our lab. As Access Data is a GUI-based utility that can run in Windows XP, 2000, Me, or 9x operating system and it demo version has most of the same features as full-licensed version, use multi-threading to optimize CPU usage, has task scheduler to optimize time and can view and analyze data while processing takes place, it meets the requirements of our lab. What is more, it supports international language so we can retrieve data no matter which languages they are using. On top of that, it is powerful in searching, recovery, email and graphic analysis. Because of these reasons and by viewing the above forensic tools comparison chart, I can conclude that Access Datas Forensic Toolkit is the most beneficial for our lab. b) Forensic Analysis Report for â€Å"Analyzing FAT32, NTFS and CDFS file system Using Access Datas FTK† Task 4 a) MD5 hash values of bmp, doc, xls files All hash values generated by the MD5 before modification is not the same with the hash value generated after modification. b) Why hash values are same or different A hash value is a numeric value of a fixed length that uniquely identifies data. Data can be compared to a hash value to determine its integrity. Data is hashed and the hash value is stored. At a later time or after the data has been received from mail, the data is hashed again and compared to the stored hash or the hash value it was sent to determine whether the data was altered. In order to compare the hash values, the original hashed data must be encrypted or kept secret from all untrusted parties. When it compared, if the compared hashed values are the same, then the data has not been altered. If the file has been modified or corrupted, the MD5 produces different hash values. In task 4 (a), first we created a doc file with data in this file, then we generated hash values of doc file with MD5. The hash value of info.doc file is da5fd802f47c9b5bbdced35b9a1202e6. After that, we made a modification to that info.doc file and regenerate the hash values. The hash value after modifying is 01f8badd9846f32a79a5055bfe98adeb. The hash value is completely different after modifying. Then we created a cv.xls file and generated the hash value. Before modifying, the hash value is ef9bbfeec4d8e455b749447377a5e84f. After that we add one record to cv.xls file and regenerated hash values. After modifying, ccfee18e1e713cdd2fcf565298928673 hash value is produced. The hash value changed in cv.xls file after data altered. Furthermore, we created fruit.bmp file to compare the hash value before and after modification. The hash value before modifying is 8d06bdfe03df83bb3942ce71daca3888 and after modifying is 667d82f0545f0d187dfa0227ea2c7ff6. So, the hash values comparison of bmp files is completely different after data has been modified. When we encrypted the text file into each image file, the text file is not visible in the image viewing utility and each image file is like its original image file. However, the comparison of the hash values of each image file before and after inserting short messages is completely different. As each image file has been altered by inserting short message, the regenerated hash value is totally different from the original hash values. On top of that, the original image file size has been changed after inserting short messages. The raster image file has slightly increased its file size after it has been modified. The raster image file size is increased from 50.5 KB to 50.7 KB. However, of the remaining three, two image files vector and metafile have decreased its file size a little sharply. The original file size of vector is 266 KB and has been decreased to 200 KB after modified. The metafile also decreased from 313 KB to 156 KB. Only the bitmap is remains stable as its file size does not increase or decrease. In a nut shell, we can conclude that the hash value would change if the file has been modified. However, depending on the file format, the file size can increase, decrease or remain stable. d) Report for â€Å"differences of bitmap, raster, vector and metafile† A bitmap image is a computer file and it is collected with dots or pixels that form an image. The pixel of bitmap is stored like a grid, tiny square. When we use the paint program, we can see the bitmap pixel is like a block and it is draw or clear block by block. A raster image is also a collection of pixels but the image stored pixels in rows to make it easy to print. And raster image is resolution dependent. It cannot scale up to an arbitrary resolution without loss of apparent quality. This is overcome by the vector image. Vector image is made up of many individual, scalable objects. These objects are defined by mathematical equations rather than pixels, so it always render at the highest quality. There are many attributes in vector like color, fill and outline. The attributes can be changed without destroying the basic object. Metafile is a combination of raster and vector graphics, and can have the characteristics of both image types. However, if you create a metafile with raster and vector and enlarge it, the area of raster format will lose some resolution while the vector formatted area remains sharp and clear. If we have lost an image file, before doing anything, we should be familiar with the data patterns of known image file types. Then the recovery process starts. The first step in recovery is to recover fragments file from slack space and free space. The fragment file can locate the header data that is partially overwritten. So, we use Drivespy to identify possible unallocated data sets that contain the full or partial image header values. To locate and recover the image header, we need to know the absolute starting cluster and ending cluster. If not, we could collect the wrong data. Using Drivespy, we can know started cluster number and file size of image that we want to recover. To know the exact ending cluster, add the total number of clusters assigned to the starting cluster position. As we have known the size of image file, we can calculate the total number of clusters. Then, we can locate the image file and retrieve image header. After we get the header value, open the file with Microsoft Photo Viewer. If the file has been opened successfully, then recovery of image file has been completed. If not, we need to use the Hex Workshop to examine the header of the file. Task 5 Report for â€Å"Investigation that prove Naomis innocence† Before we begin tracing an email, we should know which email is illegal and what constitutes an email crime. Illegal email includes selling narcotics, extortion, sexual harassment, stalking, fraud, child abductions, and child pornography. As Jazebel has received an offensive email, so we need to access the victim computer and copy and print the offensive email to recover the evidence contained in the email. Microsoft Outlook, Outlook Express or any other GUI email programs supports for copying the email from inbox to the place that we want to by dragging the message to the storage place. When copying email, the header of the email must be included as it contains unique identifying numbers, such as IP address of the server that sent the message. This helps us when tracing the email. After copy and printing the message, we should retrieve the email header to get the sender IP address. Right click on the message and choose message options to retrieve the email header. The following shows the header information that retrieved from the mail of the victim computer. At line 1(10.140.200.11) shows the IP address of the server sending the e-mail, and provides a date and time that the offending e-mails was sent. Although when we see at line 5, the victim is seemed to be Jezebel, however, line 1 identifies that the e-mail that is sent from the IP address (10.140.200.11) is the same as the victims computer IP address. So, we can conclude that Naomi does not include in sending offensive e-mail. She is innocence and the victim, Jezebel himself, is the one who send the offensive e-mails. References: Computer Forensics Textbook http://www.computerforensicsworld.com/index.php http://www.crime-research.org/library/Forensics.htm http://ixbtlabs.com/articles/ntfs/ www.wikipedia.com Computer Forensics Investigation and Techniques Computer Forensics Investigation and Techniques Introduction I am the student of International Advanced Diploma in Computer Studies (IADCS). In this course, I have to do Compute Forensic assignment. The assignment title is â€Å"Didsbury Mobile Entertainments LTD†. This assignment helps me understanding computer forensics investigation and techniques Before this assignment, although I am interested in computer forensic, I am hardly used computer forensics toolkit or done any investigation. Because of this assignment, I have learnt many techniques how to investigate computer and done it practically. So, by doing this assignment, I have gained in practical and much valuable knowledge in Computer Forensics.nd a heartfelt thanks to all the people in Myanma Computer Company Ltd. for their warmly welcome during the period of the IADCS course and this assignment developed. Task 1 i) Report DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 10, 2010 Introduction Computer forensics involves obtaining and analyzing digital information for figuring out what happened, when it happened, how it happened and who was involved. What is more, it is use as evidence in civil, criminal, or administrative cases. Reasons for a need for computer forensic investigation Computer forensics investigation can recover thousands of deleted mails, can know when the user log into the system and what he does, can determine the motivation and intent of the user, can search keywords in a hard drive in different languages and can gain evidence against an employee that an organization wished to terminate. For these reasons, in order to know whether Jalitha has been spending her time on her friend business or not, we need a computer forensic investigation. Steps to pursue the investigation In order to pursue the investigation, I would take the following steps: 1) Secure the computer system to ensure that the equipment and data are safe 2) Find every file on the computer system, including files that are encrypted, protected by passwords, hidden or deleted, but not yet overwritten. 3) Copy all files and work on this copy files as accessing a file can alter its original value 4) Start a detailed journal with the date and time and date/information discovered 5) Collect email, DNS, and other network service logs 6) Analyze with various computer forensics tools and software 7) Print out an overall analysis 8) Evaluating the information/data recovered to determine the case Conclusion After we know the reasons and steps for investigation, then we should move on to conduct the investigation. However, we should note that the first step of investigation is critical as if the system is not secure, then the evidence or data we found may not be admissible. ii a) Report for â€Å"The procedures to make sure the evidence holds up in court† DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 12, 2010 Introduction Evidence is any physical or electronic information (such as computer log files, data, reports, hardware, disk image, etc) that is collected during a computer forensic investigation. The purpose of gathering evidence is to help determine the source of the attack, and to introduce the evidence as testimony in a court of law. Procedures to make sure the evidence holds up in court In order to make the evidence admissible in court, we need to follow the following steps: 1) Before any evidence can be gathered, a warrant must be issued so that forensic specialist has the legal authority to seize, copy and examine the data 2) Have the responsibility to ensure that the law and the principles we used are met 3) Evidence must be obtained in a manner which ensures the authenticity and validity and that no tampering had taken place 4) Tracking the chain of custody is essential for preparing evidence as it shows the evidence was collected from the system in question, and was stored and managed without alteration. 5) Extracted/ relevant evidence is properly handled and protected from later mechanical or electromagnetic damage 6) Preventing viruses from being introduced to a computer during the analysis process 7) To ensure that original evidence must be described in complete details to present reliable evidence on the court 8) Must arrange to answer reliability questions relating to the software we have used Conclusion In gathering evidence, authenticity, reliability and chain of custody are important aspects to be considered. By following the above steps, we are proper in handling the evidence holds up in court. ii b) Evidence form Didsbury Mobile Entertainments Ltd IT Department Computer Investigation Case No.: 005 Investigation Organization: Gold Star Investigator: Win Pa Pa Aye Nature of Case: Companys policy violation case Location where evidence was obtained: On suspects office desk Description of evidence: Vendor Name Model No./ Serial No. Item #1 One CD Sony Item #2 A 4GB flash memory device Kingston 05360-374.A00LF Item #3 Evidence Recovered by: Win Pa Pa Aye Date Time: 10.12.2009 10:00 AM Evidence Placed in Locker: E2419 Date Time: 15.12.2009 11:00 AM Item # Evidence Processed by Description of Evidence Date/ Time 1 Win Pa Pa Aye Fully recovered deleted email on the drive which is sent to Radasas company, including data exchange between the businesses. 13.12.2009 3:00 PM 2 Win Pa Pa Aye Encrypted document hidden inside a bitmap file. Decrypted and saved on another media. 18.12.2009 9:00 AM 3 Win Pa Pa Aye Password-protected document covering the exchange of information with her friend. Password cracked and file saved on another media. 22.12.2009 2:00 PM Task 2 Report for â€Å"the way the data is stored, boot tasks and start up tasks for Windows and Linux systems† To effectively investigate computer evidence, we must understand how the most popular operating systems work in general and how they store files in particular. The type of file system an operating system uses determines how data is stored on the disk. The file system is the general name given to the logical structures and software routines used to control access to the storage on a hard disk system and it is usually related to an operating system. To know the way the data is stored in Windows XP and Linux, we need to get into file systems of Windows and Linux. The way the data is stored in Windows XP In Windows XP, although it supports several different file systems, NTFS is the primary file system for Windows XP. So, we will have a look in NTFS as the NTFS system offers better performance and features than a FAT16 and FAT 32 system. NTFS divides all useful places into clusters and supports almost all sizes of clusters from 512 bytes up to 64 Kbytes. And NTFS disk is symbolically divided into two parts MFT (Master File Table) area and files storage area. The MFT consumes about 12% of the disk and contains information about all files located on the disk. This includes the system file used by the operating system. MFT is divided into records of the fixed size (usually 1 Kbytes), and each record corresponds to some file. Records within the MFT are referred to as meta-data and the first 16 records are reserved for system files. For reliability, the first three records of MFT file is copied and stored exactly in the middle of the disk and the remaining can be stored anyplace of the disk. The remaining 88% of disk space is for file storage. Below is the partition structure of NTFS system. After we know the file system of Windows XP, then we will move on to the file system of Linux. The way the data is stored in Linux When it comes to Linux file system, ext2 has been the default file system as it main advantages is its speed and extremely robust. However, there is a risk of data loss when sudden crashes occur and take long time to recover. Sometimes the recovery may also end up with corrupt files. By using the advantage of ext2 and add some data loss protection and recovery speed led to the development of journaling file system ext3 and ReiserFs. Though ext2, ext3 and ReiserFs are the most popular file system, there are also some other file system used in the Linux world such as JSF and XFS. As Linux views all file systems from the perspective of a common set of objects, there are four objects superblock, inode, dentry and file. The superblock is a structure that represents a file system which includes vital information about the system. Moreover, it includes the file system name (such as ext2), the size of the file system and its state, a reference to the block device, and meta-data information. It also keeps track of all the nodes. Linux keeps multiple copies of the superblock in various locations on the disk to prevent losing such vital information. Every object that is managed within a file system (file or directory) is represented in Linux as an inode. The inode contains all the meta-data to manage objects in the file system. Another set of structures, called dentries, is used to translate between names and inodes, for which a directory cache exists to keep the most-recently used around. The dentry also maintains relationships between directories and files for traversing file systems. Finally, a VFS (Virtual file system) file represents an open file (keeps state for the open file such as the write offset, and so on). While the majority of the file system code exists in the kernel (except for user-space file systems), (2.3) shows the Linux file system from the point of view of high-level architecture and the relationships between the major file system-related components in both user space and the kernel. The boot task and start up task of Windows XP A good understanding of what happens to disk data at startup is also an important aspect as accessing to a computer system after it was used for illicit reasons can alter the disk evidence. First, we will discuss about the Windows XP startup and boot process, and then shift into the startup and boot process of Linux. Like any other PC system, Windows XP startup by running the POST test, performing an initialization of its intelligent system devices, and performing a system boot process. The boot process begins when the BIOS starts looking through the system for a master boot record (MBR). This record can reside on drive C: or at any other location in the system. When the BIOS execute the master boot record on the hard drive, the MBR examines the disks partition table to locate the active partition. The boot process then moves to the boot sector of that partition located in the first sector of the active partition. There, it finds the code to begin loading the Secondary Bootstrap Loader from the root directory of the boot drive. In NTFS partition, the bootstrap loader is named NTLDR and is responsible for loading XP operation system into memory. When the system is powered on, NTLDR reads the Boot.ini file. If boot.ini contains more than one operating system entry, a boot menu is displayed to the user, allowing the user to choose which operating system is to be loaded. Fig (2.4) shows Boot.ini contains two operating systems and allows user to choose. After the user has selected the desired mode to boot to, NTLDR runs Ntoskrnl.exe and reads Bootvid.dll, Hal.dll and the startup device drivers. After the file system driver has loaded, control is then passed from NTLDR to the kernel. At this time, Windows XP display Windows logo. Virtually, all applications we installed using the default installation decide that they should start up when windows starts. Under â€Å"Startup† tab in the system configuration utility, a list of programs that run when our system boots is listed. Fig (2.6) shows the listed program when our system boots. The boot task and start up task of Linux After we have get into the start up process of Windows XP, we will then shift into the startup process of Linux. In Linux, the flow of control during a boot is also from BIOS, to boot loader, to kernel. When you turn on the power, the BIOS perform hardware-platform specific startup tasks. Once the hardware is recognized and started correctly, the BIOS loads and executes the partition boot code from the designated boot device, which contains Linux boot loader. Linux Loader (LILO) is the Linux utility that initiates the boot process, which usually runs from the disks MBR. LILO is a boot manager that allows you to start Linux or other operating systems, including Windows. If a system has two or more operating systems, LILO gives a prompt asking which operating system the user wishes to initialize. When the user chooses the boot option, it then loads the choosing operating system into memory. The boot program, in turn, reads the kernel into memory. When the kernel is loaded, the boot program transfers control of the boot process to the kernel. The kernel then performs the majority of system setup (memory management, device initialization) before spawning separately, the idle process and scheduler and the init process which is executed in user space. The scheduler takes control of the system management. The init process executes scripts as needed that set up all non-operating system services and structures in order to allow a user environment to be created, and then presents the user with a login screen. We have described about the way the data stored, the boot task and startup task of Windows XP and Linux. After a thorough study of these areas, we can acquire or handle the evidence properly. Task 3 a) Features comparison of â€Å"EnCase, Access Datas Forensic and ProDiscover† Features of Guidance EnCase Forensic * In courts worldwide, forensically acquire data in a sound manner using software with an unparallel record * Using a single tool and investigate and analyze multiple platforms * With prebuilt EnScript ® modules such as initialized Case and Event Log analysis, it can automate complex and routine tasks, so it save time in analyzing * Find information despite efforts to hide, cloak or delete * Can easily handle large volumes of computer evidence, view all relevant files that includes deleted files, file slack and unallocated space * Directly transfer evidence files to law enforcement or legal representatives as necessary * Include review options that allow non-investigators to review evidence easily * Include report options that enable quick report preparation Features of Access Datas Forensic Toolkit * Provides integrated solution that is no need to purchase multiple tools to complete a case. * Provides integrated database that avoid application crashes, lost work and product instability. * Identify encrypted files automatically from more than 80 applications and crack those files. * Supports international language that allows us easily search and view foreign-language data in our native format * Include email analysis that can recover and analyze a wide range of email and web mail formats * Can generate different industry-standard report formats quickly and concisely * Collect key information from the registry that include user information, date of application installed, hardware, time zone and recently used information * While processing takes place, we can view and analyze data Features of ProDiscover * To keep original evidence safe, it create bit-stream copy of disk for analyzing that includes hidden HPA section * For complete disk forensic analysis, it search files or entire disk including slack space, HPA section and Windows NT/2000/XP alternate data streams * Without alter data on the disk, it can preview all files including metadata and hidden or deleted files * Support for VMware to run a captured image. * In order to ensure nothing is hidden, it examine data at the file or cluster level * To prove data integrity, it can generate and record MD5, SHA1 and SHA256 hashes automatically. * Examine FAT12, FAT16, FAT 32 and all NTFS file systems including Dynamic Disk and Software RAID for maximum flexibility. * Examine Sun Solaris UFS file system and Linux ext2 / ext3 file systems. * Integrated thumbnail graphics, internet history, event log file, and registry viewers to facilitate investigation process. * Integrated viewer to examine .pst /.ost and .dbx e-mail files. * Utilize Perl scripts to automate investigation tasks. * Extracts EXIF information from JPEG files to identify file creators. * Automated report generation in XML format saves time, improves accuracy and compatibility. * GUI interface and integrated help function assure quick start and ease of use. * Designed to NIST Disk Imaging Tool Specification 3.1.6 to insure high quality. AccessData FTK v2.0 Guidance EnCase Forensic 6.0 ProDiscover Forensic Report for Choosing Access Datas Forensic Toolkit I think Access Datas Forensic Toolkit is the most beneficial for our lab as it provides more forensic examination features than Encase and ProDiscover. In the evidence aspects, Access Data can acquire files and folders than others. So, it can be a powerful tool when we analyze files for evidence. Moreover, it uses database to support large volume of data that can avoid application crashes, lost work and product instability for our lab. As Access Data is a GUI-based utility that can run in Windows XP, 2000, Me, or 9x operating system and it demo version has most of the same features as full-licensed version, use multi-threading to optimize CPU usage, has task scheduler to optimize time and can view and analyze data while processing takes place, it meets the requirements of our lab. What is more, it supports international language so we can retrieve data no matter which languages they are using. On top of that, it is powerful in searching, recovery, email and graphic analysis. Because of these reasons and by viewing the above forensic tools comparison chart, I can conclude that Access Datas Forensic Toolkit is the most beneficial for our lab. b) Forensic Analysis Report for â€Å"Analyzing FAT32, NTFS and CDFS file system Using Access Datas FTK† Task 4 a) MD5 hash values of bmp, doc, xls files All hash values generated by the MD5 before modification is not the same with the hash value generated after modification. b) Why hash values are same or different A hash value is a numeric value of a fixed length that uniquely identifies data. Data can be compared to a hash value to determine its integrity. Data is hashed and the hash value is stored. At a later time or after the data has been received from mail, the data is hashed again and compared to the stored hash or the hash value it was sent to determine whether the data was altered. In order to compare the hash values, the original hashed data must be encrypted or kept secret from all untrusted parties. When it compared, if the compared hashed values are the same, then the data has not been altered. If the file has been modified or corrupted, the MD5 produces different hash values. In task 4 (a), first we created a doc file with data in this file, then we generated hash values of doc file with MD5. The hash value of info.doc file is da5fd802f47c9b5bbdced35b9a1202e6. After that, we made a modification to that info.doc file and regenerate the hash values. The hash value after modifying is 01f8badd9846f32a79a5055bfe98adeb. The hash value is completely different after modifying. Then we created a cv.xls file and generated the hash value. Before modifying, the hash value is ef9bbfeec4d8e455b749447377a5e84f. After that we add one record to cv.xls file and regenerated hash values. After modifying, ccfee18e1e713cdd2fcf565298928673 hash value is produced. The hash value changed in cv.xls file after data altered. Furthermore, we created fruit.bmp file to compare the hash value before and after modification. The hash value before modifying is 8d06bdfe03df83bb3942ce71daca3888 and after modifying is 667d82f0545f0d187dfa0227ea2c7ff6. So, the hash values comparison of bmp files is completely different after data has been modified. When we encrypted the text file into each image file, the text file is not visible in the image viewing utility and each image file is like its original image file. However, the comparison of the hash values of each image file before and after inserting short messages is completely different. As each image file has been altered by inserting short message, the regenerated hash value is totally different from the original hash values. On top of that, the original image file size has been changed after inserting short messages. The raster image file has slightly increased its file size after it has been modified. The raster image file size is increased from 50.5 KB to 50.7 KB. However, of the remaining three, two image files vector and metafile have decreased its file size a little sharply. The original file size of vector is 266 KB and has been decreased to 200 KB after modified. The metafile also decreased from 313 KB to 156 KB. Only the bitmap is remains stable as its file size does not increase or decrease. In a nut shell, we can conclude that the hash value would change if the file has been modified. However, depending on the file format, the file size can increase, decrease or remain stable. d) Report for â€Å"differences of bitmap, raster, vector and metafile† A bitmap image is a computer file and it is collected with dots or pixels that form an image. The pixel of bitmap is stored like a grid, tiny square. When we use the paint program, we can see the bitmap pixel is like a block and it is draw or clear block by block. A raster image is also a collection of pixels but the image stored pixels in rows to make it easy to print. And raster image is resolution dependent. It cannot scale up to an arbitrary resolution without loss of apparent quality. This is overcome by the vector image. Vector image is made up of many individual, scalable objects. These objects are defined by mathematical equations rather than pixels, so it always render at the highest quality. There are many attributes in vector like color, fill and outline. The attributes can be changed without destroying the basic object. Metafile is a combination of raster and vector graphics, and can have the characteristics of both image types. However, if you create a metafile with raster and vector and enlarge it, the area of raster format will lose some resolution while the vector formatted area remains sharp and clear. If we have lost an image file, before doing anything, we should be familiar with the data patterns of known image file types. Then the recovery process starts. The first step in recovery is to recover fragments file from slack space and free space. The fragment file can locate the header data that is partially overwritten. So, we use Drivespy to identify possible unallocated data sets that contain the full or partial image header values. To locate and recover the image header, we need to know the absolute starting cluster and ending cluster. If not, we could collect the wrong data. Using Drivespy, we can know started cluster number and file size of image that we want to recover. To know the exact ending cluster, add the total number of clusters assigned to the starting cluster position. As we have known the size of image file, we can calculate the total number of clusters. Then, we can locate the image file and retrieve image header. After we get the header value, open the file with Microsoft Photo Viewer. If the file has been opened successfully, then recovery of image file has been completed. If not, we need to use the Hex Workshop to examine the header of the file. Task 5 Report for â€Å"Investigation that prove Naomis innocence† Before we begin tracing an email, we should know which email is illegal and what constitutes an email crime. Illegal email includes selling narcotics, extortion, sexual harassment, stalking, fraud, child abductions, and child pornography. As Jazebel has received an offensive email, so we need to access the victim computer and copy and print the offensive email to recover the evidence contained in the email. Microsoft Outlook, Outlook Express or any other GUI email programs supports for copying the email from inbox to the place that we want to by dragging the message to the storage place. When copying email, the header of the email must be included as it contains unique identifying numbers, such as IP address of the server that sent the message. This helps us when tracing the email. After copy and printing the message, we should retrieve the email header to get the sender IP address. Right click on the message and choose message options to retrieve the email header. The following shows the header information that retrieved from the mail of the victim computer. At line 1(10.140.200.11) shows the IP address of the server sending the e-mail, and provides a date and time that the offending e-mails was sent. Although when we see at line 5, the victim is seemed to be Jezebel, however, line 1 identifies that the e-mail that is sent from the IP address (10.140.200.11) is the same as the victims computer IP address. So, we can conclude that Naomi does not include in sending offensive e-mail. She is innocence and the victim, Jezebel himself, is the one who send the offensive e-mails. References: Computer Forensics Textbook http://www.computerforensicsworld.com/index.php http://www.crime-research.org/library/Forensics.htm http://ixbtlabs.com/articles/ntfs/ www.wikipedia.com

Divergent by Veronica Roth Response To Text Essay Essay

The novel â€Å"Divergent† written by author Veronica Roth is a thrilling story about the love and sacrifice of two teenagers (Tris and Four) living in dystopian America. This novel follows the hardship of citizens living in a community where everyone must be separated into groups called factions. The members of each faction must live their lives according to the value of their faction, whether it be Bravery for Dauntless, selflessness for Abnegation, knowledge for Erudite, honesty for Amity or peace for Candor. When each faction member turns 16 they must choose a faction they wish to live the rest of their lives in, whether they choose to remain in the faction of their birth or join a completely different faction is up to them. I found this novel to be very rich in important ideas or themes that can be closely linked to today’s world. Themes, such as love and sacrifice or separation of the social classes. In this book I find it interesting how author Veronica Roth has managed to include today’s ways of social separations into this novel and emphasizes it to a point that shows all the â€Å"flaws† that there are in the way in which today’s society judges and separates everyone into different rankings on the social ladder. The book shows that even though each faction is supposed to be equal to one another there is always one faction that believes they are better than the rest because they believe their way is the â€Å"right† way of life. The Erudite faction believes that knowledge is power and because they have more knowledge than everyone else that they are superior. The feeling  of superiority becomes more than just a feeling for the character Jeanine Mathews, head of the Erudite faction. She believes that because of their knowledge that they must rule the factions and remove those who she feels are â€Å"not worthy† for her new way of life. This aspect of the book greatly reminds me of Hitler and how he was aiming to achieve one master race. Hitler believed that the Jews were inferior and were considered less than human therefore he did not want them to be a part of his â€Å"master race.† Jeanine Mathews thought that the Abnegation faction was not worthy enough to be a part of her plan for a new community and way of life therefore she launched an attack on the Abnegation. Throughout history you see many leaders, groups, races and religions trying to take the metaphorical throne of superiority and try to live above the rest of society. I believe that all of this is caused by one thing, separation. In today’s society no one is equal and we are all being discriminated against by each other. It is through our judgemental ways that we continue to stay separated. Even now if you look at the wars in countries such as Iraq, it is the separation of different religious beliefs that is causing many deaths. It became clear to me that, author Veronica Roth has similar views on seperation. I felt like this after reading her quote where she talks about the effects the separation of the factions had on some of the characters, â€Å"Because it forced people to become narrower, twisted versions of themselves, and they ripped each other apart.† This quote really does sums up what I believe the separation of the factions did to the character Jeanine Mathews . I think that this novel really depicts the theme of separation and the problems it causes in a strong way that really sends a message of equality to the reader. This theme is not only prominent in this novel; the theme of separation plays a large part in other novels such as â€Å"The Hunger Games† trilogy written by Susanne Collins. In â€Å"The Hunger Games†, much like in â€Å"Divergent†, everyone is separated into 12 different districts with one district (The Capitol) ruling over the others. I believe that the idea of equality and how badly we need it is summarised by this quote from Joss Whedon, an American actor and director. â€Å"Equality is not a concept. It’s not something we should be striving for. It’s a necessity. Equality is like gravity. We need it to stand on this earth as men and women.† This quote points out that the human race will not be able to progress through life if  we keep separating ourselves, discriminating others and putting ourselves in different groups. I feel that â€Å"Divergent† has really shown this in a way that really connects to the readers. I have found that, author Veronica Roth, has really developed her characters throughout the plot of her book. She also shows the effects that one character can have on another and how other characters can influence the character development of another. It was the character Four that has really given me a sense of this development. At the beginning of this novel Four was portrayed as having a hard â€Å"exterior† and not having much emotion. It is not until the character Tris becomes a part of Four’s life, does he start to develop into a more affectionate character. As Tris and Four’s relationship grows into something more than student and instructor, you can see Four becoming softer and really starting to show his emotional side. Four has been living in the Dauntless faction since he left his birth faction (Abnegation) two years ago. In the Dauntless faction the transfers from Abnegation are bullied just because they came from the faction that is least well off. Because Tris has also come from Abnegation that Four feels sympathy for her in the sense that he has had to go through the same â€Å"bullying.† Four feels that he can relate to her because of this and I think that it is this that really kicks off their relationship and is why Tris and Four become such a strong pairing. By Four finally being able to relate to someone, he feels that he can open up to Tris and â€Å"lower his walls.† This really shows how the character Tris has had an impact on Four and how Tris has developed Four into a â€Å"two dimensional† character by bringing out his softer sides. This change in Four is not only noted by the readers but even by some of the characters in the book. This is told when the character â€Å"Christina† says to Four â€Å"The person you became with her is worth being.† This q uote really shows that it was Tris that has changed Four and that this change is a positive one. The idea that a person can influence a change in another is not just something that happens in books but in reality too. It doesn’t always have to be a person that you know that can influence a change in someone’s life. It is quite often that, celebrities or other public figures that can influence a change. For example, when I was going through a tough time in my life, it wasn’t family members or friends  that helped me through it but the supportive words of celebrities I look up too. Again it was all about connecting with someone who you can relate to. In my case it was my favourite musician. This musician had been through similar things and I felt as if they understood, even though we had not met, let alone even spoken to each other. This also shows what a big influence media has on people of today’s society. The media’s opinion and views on how people should live their life are everywhere; in magazines, television shows and on social media and are hard to be ignored. So it is not only people that can influence a change in someone’s life but other things su ch as media. To conclude, â€Å"Divergent† is an exciting novel that is rich in themes and will keep the reader on the edge of his or her seat. The theme of separation showed many links to today’s society and even to events in history, as well as pointing out many problems that occur with separation in our society. Veronica Roth has not only given a huge amount of depth to her themes in this novel, but has been able to develop her characters throughout the story, morphing them from what you would call a â€Å"one dimensional† character into a â€Å"two dimensional† character. A character, with more than one side to them. This novel has really made me think that how, as an individual, can I not take part in this separation. Whether it is separation of social classes, religious groups or even the separation of people through lifestyle, I believe that everyone should be viewed as equal and not be discriminated against. This novel has also shown me (through the character development of Four and how the character Tris influenced this development ) that people or other things that we find we can relate to or care about, can play a large role and influence some of the personal choices we make as well as influence how we grow as people. Veronica Roth has written this novel in a way that really gets the reader thinking about the themes and/or main ideas as well show important links in these themes and ideas that can relate to the outside world.

Should Euthanasia Be Justified - 2343 Words

Can Euthanasia be Justified? Euthanasia comes from two Greek words, ‘eu’, meaning good or well and ‘thanatos’ meaning death, so euthanasia means ‘good death’. A good death could be described as a peaceful, easy death in today’s terms. Most often, euthanasia is carried out actively or passively. Active euthanasia is when a person directly and deliberately causes the patient’s death and passive euthanasia is when a person does not directly take the life of the patient but instead allows the patient to die. Euthanasia has been debated and discussed vehemently for years and although it is an illegal practise in the United Kingdom, people continually challenge the law but fail. I will discuss various different viewpoints on Euthanasia, different types of Euthanasia and some very personal stories to see whether euthanasia can ever be justified. There are three types of euthanasia: involuntary, voluntary and non-voluntary. Involuntary euthanasia is when a person wants to live but is killed anyway. Voluntary euthanasia is when a patient asks to have their life ended. And non-voluntary euthanasia is when an individual is unable to make a decision about their condition and some appropriate person makes that decision for them. Within the three types of euthanasia there are four methods of euthanasia: active or direct euthanasia, passive euthanasia, indirect euthanasia and assisted suicide. Active or direct euthanasia is when a person directly and deliberately causes theShow MoreRelatedActive Euthanasia Is Never Morally Justified1545 Words   |  7 Pages Analysis on The Argument That Active Euthanasia is Never Morally Justified Death has always been a controversial topic throughout the world. There are many theories as to where we go and what the meaning of life truly is. How one dies is important in today’s society, especially when it comes to the idea of suicide. Active euthanasia, also referred to as assisted suicide, is the intentional act of causing the death of a patient experiencing great suffering. It is illegal in some places, like FranceRead MoreEuthanasi It s Worst1034 Words   |  5 Pages Euthanasia At It’s Worst Euthanasia should not be an option for patients to end their lives because euthanasia is not morally justified, and corrupts, while contradicting the point of medicine. Euthanasia also should not be used because euthanasia itself puts to much focus on suicidal drugs and not enough on finding better treatment plans for patients. In January 1991, a Gallup Poll was taken of the broad acceptance of assisted suicide in which 58% of people agreed that a person has the â€Å"moralRead MoreDying with Dignity960 Words   |  4 Pagesthe person. People who have this illness resort to an alternative called euthanasia. Euthanasia is when someone a physician or a family members assist the terminal ill to die by injecting such person with a drug or plugging out the chord that keeps the person alive. While supporters of this technique claim that euthanasia is humane and helpful, other people argue that euthanasia is morally wrong, and inhumane. Euthanasia should be legalize in the United States because it gives an alternative for peopleRead MoreEuthanasi Active And Passive Euthanasia1562 Words   |  7 PagesEuthanasia, also known as voluntary or assisted suicide, is used for terminally ill patients to end their lives instead of undergoing painful treatments and torment of waiting for death. There are, however, two different ways in which A can bring about B’s death. In this essay I will present the distinction between active and passive euthanasia as explained by James Rachels in his article called â€Å"Active and Passive Euthanasia†. I will also debate whether euthanasia is justified or not by presentingRead MoreEuthanasia Is Morally Permissible?850 Words   |  4 PagesEuthanasia, as defined by many philosophers, should only be morally permissible in certain circumstances where it benefits the one who dies. It is a widely held belief that an act of euthanasia aims at benefiting the one who dies. Using Kantian ethics as a model, one can determine that: It is morally permissible to engage in voluntary acts of euthanasia; it is morally permissible to engage in acts of nonvoluntary euthanasia, and; it is never morally permissible to engage in acts of involuntary euthanasiaRead MoreEuthanasia: Perspective from Theory of Personality Virtue768 Words   |  3 Pagesrashness and cowardice. Aristotle stated that every person should work to develop his or her own character by developing a habit out of virtue. This will automatically lead to good actions, as a good person will always make good decisions. He believed that future generations could then be taught goodness from their seniors as virtue should be taught by example, not through a set of rules. Considering the moral issue of euthanasia, euthanasia is the act of painlessly putting to death persons sufferingRead MoreEuthanasi Active And Passive Euthanasia1634 Words   |  7 PagesPassive Euthanasia where he argues against the distinction between killing in letting die. He says that the distinction is made on morally irrelevant grounds. He says that the distinction between passive and active euthanasia should not be based on whether or not wanted more morally permissible then the other. To prove his point Rachel uses three dif-ferent examples, which included different circumstance where euthanasia is involved. He looks at each example and argues why active euthanasia wouldRead MoreThe Controversy Of Euthanasia And Euthanasia1385 Words   |  6 Pageshave when it comes to patient care. Euthanasia is a very controversial topic that has been debated on throughout the years. Whether it may be active euthanasia, passive euthanasia, voluntary euthanasia, involuntary euthanasia, i ndirect or physician assisted the morals and reasoning behind each are controversial.Though some people may believe euthanasia may be justified in a critical situation and critical punishment, euthanasia should be prohibited because euthanasia weakens societies respects for theRead MoreThe Case Of Evan Motts Assisting His Wife s Euthanasia Essay1644 Words   |  7 PagesI am going to discuss in this essay the case of Evan Motts assisting his wife s euthanasia. I will cover the ethical issues regarding this topic including whether or not Evan should be punished. I will look at the theories of Kantian Ethics and Utilitarianism to justify whether or not Evan s actions were morally right. An Auckland man is facing a charge that carries a maximum penalty of 14 years after assisting his terminally ill wife to commit suicide. Evan Mott researched suicide methods andRead MorePurpose of a Living Will and the Morality of Euthanasia829 Words   |  4 Pagesmedical treatments. Euthanasia, also called assisted suicide, or physician-assisted suicide, offers one of many options for terminal-ill patients or those with intractable pain. Many infer euthanasia as the action that brings about the end of a patient’s life because it has been decided they would be better off dead. Since euthanasia involves killing another person, voluntarily or not, a virtuous person considers euthanasia acceptable. There are two main categories of euthanasia, voluntary (conducted

The Mission Of Community Colleges - 1130 Words

Introduction The purpose of this research paper is to explore the altered missions of community colleges and related impacts on the historical mission of community colleges. The mission of community colleges were intended to serve all individuals with an equal opportunity for higher education access. In this research paper, there will be four guided questions: 1. What was the original mission of community colleges? 2. How has the community colleges mission changed over time? 3. How did the organizational culture impact the community colleges? 4. What are societal factors impacted when community colleges decided to change their mission? Since there are four guided questions to help address the main research question. There will also be some subtopics to help us better understand the reasoning toward the altered mission of community colleges. First, I will discuss about the first community college founded in American history of higher education and its mission, the influences on community college mission during the Depression era, and the intention of community college mission after the World War II era. Second, I will report what I have found about the impact on community college to alter their institution from a 2 years institution to a 4 years institution. Third, I will discuss what the organizational culture was like today compared to the twentieth century. Lastly, I will examine some of the societal factors that impact the altered mission of community colleges.Show MoreRelatedEssay On Eliminating Non-Degree Credit Courses950 Words   |  4 Pagesfuture funding will be explored along with ways to utilize funds t o effectively serve the students, as intended, and the community. Federal budget cuts are the biggest concern for future planning and continuing to fund non-degree courses would not be the best use of your limited resources. Not only is it common for students to take â€Å"extracurricular† courses, but community college students nationwide are known to continuously fail their regular subject courses as well due to certain circumstances.Read MoreComparing Germany s Education System859 Words   |  4 Pagesresearch, Germany does not claim to have a â€Å"community college system† as do the U.S. (S. Caison personal communication, June 25, 2015). Nevertheless, the counterpart would be that of a German Facshule (e.g. technical) type college that focuses on Applied Science Degrees. It is different from the Germany’s traditional universities, because of its practical application that is parallel to the U.S. Applied Associate Science Degree Program in the community college’s system (S. Caison personal communicationRead MoreHagerstown Community College Essay Sample993 Words   |  4 PagesHagerstown Community College (HCC) is a public, not for profit, two-year college located in Wa shington County Maryland. HCC is one of the first colleges in Maryland that started by offering mostly evening classes. Today, the campus offers over 100 programs of study on its 319-acre campus consisting of associate degrees, certifications, and non-credit continuing education courses. HCC reaches out to four states for recruitment purposes: Maryland (specifically Washington County), Pennsylvania (mostlyRead MoreThe Concept Of Culture Is Utilized To Describe Behaviors,1690 Words   |  7 Pagesexplains the effectiveness of universities and colleges. Higher Education and academics overall are a mixture of cultures that ultimately explain the ways decisions are made. A culture in a higher education institution consists of the organizational and disciplinary functions that explain the specifics aspects. There are over 4,000 4-year and 2-year institutions in the United States, and after going over several missions statements, Swarthmore College was the university that I chose t o learn moreRead MoreBenefits Of Innovative Business Models And Strategic Plans Must Support The Mission Of The Institution? Essay927 Words   |  4 Pagesoverseas locations. What are the advantages/ disadvantages of such endeavors, particularly in relation to the mission of the institution?† The international program is rooted in the U.S. institution s stated mission and purposes and reflects special social, religious, and ethical elements of that mission (New England Association of Schools and Colleges 2003). The surge with colleges and universities in the U.S. operating overseas campuses continues to increase. For decades, the growing demandsRead MoreThe New State Tax Revenues866 Words   |  4 Pages1.29 in new state tax revenues (Grow 2013). The ODL and northern Virginia (NOVA) community college want to become a base model for all institutions offering DL programs in the Commonwealth to emulate while surpassing other outside educational DL competitors. The partners are committed to producing quality educational opportunities to all Virginians, but believe it is a viable investment to concentrate on the northern region. This northern region will allow the partners to target a population thatRead MoreComparing The Philosophies Of The Institutions1338 Words   |  6 PagesPresent a Graphic Comparing the Philosophies of the Institutions Institution/Type Mission Vision Goals Northern Illinois University/ Public â€Å"According to Northern Illinois University 2016 The Division of Student Affairs Enrollment Management supports student academic and personal success through strategic recruitment and retention initiatives. The Division makes efforts to ensure student welfare and provide opportunities for engagement, leadership, and services that promote persistence throughRead MoreAnalysis And Evaluation Of ENLACE NM And ELRIO Websites854 Words   |  4 Pagesdiscourse community: educational programs. Both communities offer free services to students supporting them with their educational endeavors. A website is used as an essential communication tool to invite a specific population to become part of their program and reach their ultimate mission. Although ENLACE NM and SSS TRIO websites promote the importance of higher education, they differ in goals, language, the audience they serve, and the overall organization and layout of their page. The mission statementRead MoreReflection Paper On Poverty994 Words   |  4 PagesThis summer I went on a mission trip with my church to Los Angeles, California. Our group spent one of our service days working at Union Rescue Mission in Skid Row where they work to help the people escape the poverty of living on the streets. Skid row is 54 blocks in downtown Los Angeles that has been around since the late 1800s and contains one of the largest stable homeless populations between 5,000 and 8,000. Union Rescue mission not only offer meals and shelter, but also has many programsRead MoreLetter Sample Essay757 Words   |  4 Pages I am enthusiastic to apply for the Theology and Religious Studies Chair at the College of St. Scholastica. I am Dean of the Master of Arts in Religion (MAR) program at Community of Christ Seminary, Graceland University in Lamoni, Iowa. As Dean, I am an experienced teacher and collaborative administrator. I teach online graduate courses in theology and Christian ethics, as well as face-to-face undergraduate courses in religion on our residential campus. I am academic advisor for our MAR students