% This file was created with JabRef 2.10b2. % Encoding: ISO8859_1 @TechReport{DylanLeigh2012ATestBedforDataHidinginFinancialTransactions, Title = {A Test Bed for Data Hiding in Financial Transactions}, Author = {Dylan Leigh, Ron van Schyndel}, Institution = {RMIT University}, Year = {2012}, Month = {February}, Abstract = {The aim of this project is to develop a framework to allow experiments with data hiding in financial transactions, and for detecting the use of information hiding in financial transactions. An analysis is made of electronic funds transfer systems in use within Australia, particularly those used for direct credit transactions. A model of financial transaction networks based on Australian systems is developed and a simulator framework which implements the model described is developed for conducting further research. Several example data hiding techniques and scenarios are presented.}, Url = {http://www.dylanleigh.net/portfolio/s3017239-summer-summary.pdf} } @TechReport{DylanLeigh2010Counteringtheuseofnon-repudiationmethodstocompromiseprivacy, Title = {Countering the use of non-repudiation methods to compromise privacy}, Author = {Dylan Leigh, Ron van Schyndel}, Institution = {RMIT University}, Year = {2010}, Month = {October}, Type = {Literature Review}, Abstract = {This report examines ways in which non-repudiation mechanisms can be exploited to compromise the anonymity or privacy of their users. Some of the possible consequences of privacy breaches are discussed, and an overview of Australian privacy legislation is provided. Two non-repudiation techniques which allow customers to remain anonymous and keep their communications private are explored.}, HowPublished = {http://www.dylanleigh.net/portfolio/s3017239-cif-alt-assess.pdf}, Url = {http://www.dylanleigh.net/portfolio/s3017239-cif-alt-assess.pdf} } @MastersThesis{Leigh2015ForensicTimelineAnalysisoftheZettabyteFileSystem, Title = {Forensic Timeline Analysis of the Zettabyte File System}, Author = {Dylan Leigh}, School = {College of Engineering and Science, Victoria University}, Year = {2015}, Month = {January}, Abstract = {During forensic analysis of computer systems, it is often necessary to construct a chronological account of events, including when files were created, modified, accessed and deleted. Timeline analysis is the process of collating and analysing this data, using timestamps from the filesystem and other sources such as log files and internal file metadata. The Zettabyte File System (ZFS) uses a novel and complex structure to store file data and metadata across multiple devices. Due to the unusual structure and operation of ZFS, many existing forensic tools and techniques cannot be used to analyse ZFS filesystems. In this project, it has been demonstrated that four of the internal structures of ZFS can be used as effective sources of timeline information. Methods to extract these structures and use them for timeline analysis are provided, including al- gorithms to detect falsified file timestamps and to determine when individual blocks of file data were last modified.}, Owner = {dleigh}, Timestamp = {2015.01.17}, Url = {http://research.dylanleigh.net/zfs-timeline-forensics/dleigh-final-honours-thesis-ZFS-Timeline.pdf} } @Misc{Leigh2014ZFSTimelineForensicsQuickReference, Title = {ZFS Timeline Forensics Quick Reference}, Author = {Dylan Leigh}, Month = {May}, Year = {2014}, Owner = {dleigh}, Timestamp = {2014.05.10}, Url = {http://www.research.dylanleigh.net/zfs-bsdcan-2014/zfs-timeline-quickref.pdf} } @TechReport{Leigh2010ComputerandInternetForensics:DiskImageInvestigationAssignment, Title = {Computer and Internet Forensics: Disk Image Investigation Assignment}, Author = {Dylan Leigh}, Institution = {RMIT University}, Year = {2010}, Type = {Forensic Report}, Url = {http://www.dylanleigh.net/portfolio/s3017239-cif-assignment.pdf} } @TechReport{Leigh, Title = {Implementing Absolute Addressing in a Motorola 68000 Processor}, Author = {Dylan Leigh}, Institution = {RMIT University}, Year = {2009}, Type = {Engineering Design Project}, Abstract = {This project involved the further development of a limited 68000 processor core, developed by Dylan Leigh for the subject Advanced Digital Design 1 (EEET2192) during semester 1 2008. The CPU core originally supported only immediate and register addressing, and used one read state for eachdata read. This project aims to extend the system by looping the read states, allowing for absolute and more advanced addressing modes. This document describes the CPU features and usage, including the operation of the CPU on the DE1 development board, as well as the process of implementing the new addressing mode. The development of the initial CPU design is not covered in detail.}, Url = {http://www.dylanleigh.net/portfolio/s3017239-de4b-project-missing-page17.pdf} } @TechReport{Leigh2005DesignandImplementationoftheNumlockGameandProtocol, Title = {Design and Implementation of the Numlock Game and Protocol}, Author = {Dylan Leigh}, Institution = {RMIT University}, Year = {2005}, Note = {Originally titled "CNE1 Lab 3 Report" due to subject requirements.}, Url = {http://www.dylanleigh.net/software/numlock/report.html} } @Article{Leigh2014AddingZFSEventstoaSuperTimeline, Title = {Adding ZFS Events to a Super-Timeline}, Author = {Dylan Leigh and Hao Shi}, Journal = {Digital Forensics Magazine}, Year = {2014}, Month = {August}, Number = {20}, Abstract = {The Zettabyte File System (ZFS), a relatively new and unusual filesystem, uses an object tree to store files and metadata across a pool of disks. Many existing forensics tools and techniques cannot be used to analyse ZFS filesystems due to their unusual structure and operation. Based upon our research into ZFS timeline forensics, we have developed two new parsers for the Plaso timeline analysis software to parse ZFS Debugger (ZDB) output and add ZFS events to a Plaso super-timeline.}, Timestamp = {2014.08.01}, Url = {http://research.dylanleigh.net/zfs-timeline-forensics/plaso-zdb/} } @InProceedings{Leigh2014ZFSTimelineForensics, Title = {Forensic Timestamp Analysis of ZFS}, Author = {Dylan Leigh and Hao Shi}, Booktitle = {BSDCan 2014}, Year = {2014}, Month = {May}, Organization = {BSDCan}, Abstract = {During forensic analysis of disks, it may be desirable to construct an account of events over time, including when files were created, modified, accessed and deleted. "Timeline analysis" is the process of collating this data, using file timestamps from the file system and other sources such as log files and internal file metadata. The Zettabyte File System (ZFS) uses a complex structure to store file data and metadata and the many internal structures of ZFS are another source of timeline information. This internal metadata can also be used to detect timestamps which have been tampered with by the touch command or by changing the system clock.}, Owner = {dleigh}, Timestamp = {2014.05.10}, Url = {http://www.bsdcan.org/2014/schedule/events/464.en.html} }