Joint Northampton/Bedford BCS Meeting
15th February 2006, 7.30pm - Solutions for Incident Response and Computer Forensics
Russell May BSc(Hons) CITP CEng MBCS EnCE
Manager of Special and Partner Projects (Europe, Middle East, Africa, India, Russia),
Guidance Software Inc. (www.guidancesoftware.com) Principal Solutions for Incident Response and Computer Forensics.
Russell is the holder of a first-class honours degree in Computer Science.
He is also a Chartered Information Technology Professional and a Chartered Information Systems Engineer,
chartered by way the Engineering Council of Great Britain. He is an elected member of The BCS.
Russell worked as a police officer in the West Midlands Police, until he retired in April 2002 as Detective Sergeant, officer in charge of the High
Tech Crime Unit which he set up in January 1999. He has been involved in investigating computer crime and computer forensics for 15 years and
has investigated many crimes involving computers from simple theft to murder and international terrorism.
The talk is accompanied by a 10-15 min PowerPoint presentation of the basic rules of data recovery which must be followed for
any recovered data to be admissible in a court of law. The demonstration will show some of the techniques used by forensic analysts to discover
and recover deleted or hidden data from storage media.
Network Computer Forensics.
The talk is accompanied by a 10-15 min PowerPoint presentation explaining methods employed to forensically examine 'Live' machines.
These methods can be employed to forensically examine 'Mission Critical'
machines without the need to take them off line. The examination of 'Live'
systems means it is also possible to forensically examine running processes and the content of RAM, which was impossible using traditional forensic methods.
Directions to Hastingsbury Enterprise Centre:
The Enterprise Centre is located on the site of Hastingsbury School (Business and Enterprise College) in Hill Rise, Kempston (MK42 7EB)
and there are direction signs on the campus to the centre (the barrier should be raised and parking is available just outside the Centre;
if the barrier is down then park in the school car park and walk past the barrier).
The room will be open from 7pm, meeting start 7.30 for 7.45pm and we will have to leave by 9.30pm.
Find out more at www.forensicfocus.com