How Important is Setting in Gulliver’s Travels? Essay

Gulliver’s Travels was written in 1726 by Johnathan Swift. Swift was a very outspoken member of the Church of England. His previous book, The Tale of a Tub satirized the feuds between Catholics and Protestants, and ruined his chances of being a bishop with its unpopularity. Swift uses setting in Gulliver’s Travels to reveal his own criticisms of humanity and his views on society. He presents several different societies, which each represent an exaggerated aspect of 18th century Europe. The eponymous ‘hero’ is Lemuel Gulliver, whose name indicates his nature: He starts off extremely gullible. As Gulliver travels through Lilliput, Brobdingnag, Laputa, Glubbdubdrib, Luggnugg, and the Land of the Houyhnhnms, he becomes disillusioned with his own humanity and ends up disgusted by other humans and spending his life talking to his horses. In Lilliput, Swift draws parallels with England, the nobility and parliament in particular. The emperor is small-minded and probably represents George I. George I was German and never learnt to speak English. He was reputed to be vain, like the emperor, who needs long introductions and fancy title to boost his ego. In Lilliput, Swift also introduces the idea that the stature of a human is proportional to the generosity, kindness, and wisdom of a human, contrary to Gulliver’s expectations. At the start of his second voyage, he even says, â€Å"Human creatures are observed to be more savage and cruel in proportion to their bulk†. This is after he has been tied up, shot at, and trapped by the tiny Lilliputians, which enforces the idea that Gulliver’s observations are not always accurate. This incorrect observation highlights the almost perfect society of the Brobdingnagians, who are much bigger than Gulliver. Swift mainly uses Lilliput to draw attention to the absurdity of religious wars, such as the conflict between the Catholics in Ireland and the English Protestants. The main way he does this is by giving an exaggerated example of a stupid religious war: Lilliput’s war with Blefescu. The war started because the then Emperor of Lilliput passed a law saying that everyone had to break their eggs at the small end. People who broke this law were discriminated against, and books by them were destroyed and not published. This is very similar to the situation in Ireland which Swift strongly objected to, despite the fact that he was a Protestant himself. Furthermore, the mutually sacred book of the Little-endians and Big-endians says, â€Å"All true believers shall break their egg at the convenient end†. This is blatantly Swift saying that war between Catholics and Protestants is foolish because they are only arguing about their interpretation of the same book. His point is convin cing because he uses an obviously ridiculous example to demonstrate his idea. As well as drawing attention to the absurdity of the conflict in Ireland, Swift also reflects on vanity in humans. The Lilliputians, though incredibly small, are so vain that they think they can imprison Gulliver. Another example is when Gulliver saves the Empress and her possessions but instead of thanking him, she is so proud that she cannot cope with the way he put out the fire, even though it was the only way to save her apartment. She pressures the government to get rid of Gulliver because of the harm he has caused her reputation. The Empress is thought to represent Queen Anne, who was displeased by Swift’s earlier book The Tale of a Tub because she thought that, while it might dissuade interest in Catholicism, it would do the same for Protestantism. Her disapproval meant that Swift would never become a bishop. In contrast to Lilliput, Brobdingnag is almost utopian; all resources are pooled and divided equally, and the King and Queen are wise and just. During Gulliver’s stay in Brobdingnag, he attends the king several times to tell him about England and Europe. Gulliver recounts â€Å"He was perfectly astonished with the historical account I gave him of our affairs during the last century, protesting it was only a heap of conspiracies, rebellions, murders, massacres, revolutions, banishments, [and] the very worst effects that avarice, faction, hypocrisy, perfidiousness, cruelty, rage, madness, hatred, envy, lust, malice, or ambition could produce†. These are incredibly strong words from such a kind king, which shows that he is very upset by the actions of a race that is so similar to his own. Swift makes Gulliver seem stupid in Lilliput, by making him endure his captivity, be afraid of the Lilliputians, and other things related to his size in relation to his captors, and because Swift has given us the impression that Gulliver is a fool, we start to believe his opinions less and less, and start to interpret his narrative in different ways. This in turn helps us believe that the Brobdingnagian King is at least partly right in saying that â€Å"the bulk of your natives [are] the most pernicious race of little odious vermin that Nature ever suffered to crawl upon the surface of the Earth†. Gulliver then says that the king must be excused because he is so far from the rest of the world that his standards could not fit in our country. Even though Swift portrays Brobdingnag as a sort of Utopia, and it is by far the most civilised place Gulliver visits, it is not perfect. The dictionary defines ‘Utopia’ as â€Å"an ideal and perfect place or state where everyone lives in harmony and everything is for the best†. There is still crime in Brobdingnag, because Gulliver himself watches the execution of a murderer, and there are still bad people, as in every society, like the dwarf, who drops Gulliver in a bowl of cream. Perhaps Swift is saying that even the best human societies cannot be truly perfect, because of the nature of humanity; some people are born bad. This is at odds with the thinking of the time, when people optimistically thought that human nature was basically good. Swift is suggesting that this is untrue. Gulliver’s next voyage is to Laputa. Swift uses Laputa to show his opinion of the (then) current obsession with scientific knowledge and learning. The Laputians are so deep in thought all the time that they have to employ ‘flappers’ to bring them back into a conversation by flapping them on the ears and mouth. They are unable to carry out a conversation, or do anything physical, without a flapper. Because of this, their wives and daughters escape to the mainland underneath Laputa whenever they can, and some do not come back. Swift uses the Laputians to show the stupidity of science just for science’s sake; when scientists start to ignore the rest of the world because they are so concerned in astronomical and mathematical matter, they are not helping anyone. The word ‘Laputa’ sounds like the Spanish word for ‘prostitute’, ‘la puta’, and Swift would have known this, so he may be suggesting that the Laputians have prostituted themselves to science. Laputa is also a floating island, kept up by a magnetic stone, so the Laputians literally have their heads in the clouds. After realising that Gulliver is not as clever as he is supposed to be (he is a doctor), the reader has begun to read into Gulliver’s descriptions and should see the ridiculousness and the comparison to scientists. Also on this voyage, Gulliver visits a place called The Academy, which represents the Royal Society of London, a scientific institute set up by Isaac Newton. The experiments described Gulliver that take place in The Academy actually happened in the Royal Society, despite how ridiculous they are. They include extracting sunbeams out of cucumbers, using spiders to produce silk, and ploughing the ground with pigs who are trying to find acorns that have been planted there. Each of the professors doing these experiments is odd in appearance, to draw attention to the strangeness of their experiment. All of the places Gulliver travels to on this voyage are obsessed with knowledge, except Luggnugg, where those born with immortality are feared and looked down on. These people have realised the problems with immortality. At first, Gulliver imagines how he would spend an infinite lifetime, but he imagines himself eternally young, but this is a different thing to immortality. After seeing the aged Struldbruggs, he says, â€Å"My keen Appetite for Perpetuity of Life was much abated. I grew heartily ashamed of the pleasing Visions I had formed, and thought no Tyrant could invent a Death into which I would not run with Pleasure from such a Life.† Gulliver’s final voyage, and the most controversial one, is to the Land of the Houyhnhnms, which sounds a bit like the word ‘human’ when said by a horse. In this Land, Gulliver firsts sees the Yahoos, which he sees as some kind of animal and not as humans at all. He describes their appearance as he would an animal, and compares them to other animals, noting, as the Brobdingnagian scientists did, that they weren’t very well equipped for survival. Because of their wild appearance, he does not recognise them as human, and is shocked when he discovers that they are. In the Land of the Houyhnhnms, horses are the ruling species, and keep Yahoos as pets. The Yahoos emphasise everything Swift has implied about humanity; they show avarice, lust, and greed, the leader is always the slyest and disgusting one. The grey mare, Gulliver’s companion on this voyage, says that when more than enough food is given to a group of Yahoos, each one will try to get it all to itself. The Land of the Houyhnhnms is by far the most ideal society Gulliver encounters, albeit not for the humans. However, it is almost completely devoid of emotion, and is the only place Gulliver visits where the ‘people’ do not have names. As well as this, if a family has two same-gender foals, they will trade one with a family that has two foals of the opposite gender, to keep the balance. This would be impossible in a human society, as nobody would trade his or her own child. The closest a human society gets to this is in Lilliput, one of the most ridiculous countries Gulliver visits, where the children only see their parents for a few days a year, and live communally the rest of the time. Swift may be suggesting, by making this happen in Lilliput, that it is a bad idea, and that parents should keep their own children, even at the cost of society. the Land of the Houyhnhnms shows that a ‘perfect society’ is possible, but as Swift chooses to compose it of horses, with humans as a hindrance to it, he is probably suggesting that because of the nature of humans, we cannot possibly have an entirely perfect society, we can only try, as in Brobdingnag. In conclusion, Swift uses each setting to emphasis one or more of humanity’s flaws. In Lilliput, he demonstrates pride in the Lilliputians, in Brobdingnag he shows us the stupidity of the vanity of the women by pointing out all their blemishes from close up (â€Å"Their Skins appeared so coarse and uneven, so variously coloured, when I saw them near, with a Mole here and there as broad as a Trencher, and Hairs hanging from it thicker than Pack-threads, to say nothing further concerning the rest of their Persons.†) In his third voyage, the thirst for knowledge and immortal life is ridiculed, and in the Land of the Houyhnhnms, everything Swift has said so far is confirmed, in the disgusting Yahoos.

“Cousin Kate” and “The Seduction” Essay

Both poems are written by female poets, who express their love by exploring physical and emotional aspects. Both poets imply that men are motivated by the physical side of love while women treasure the emotional side. The female characters in each poem to begin with are naà ¯ve, innocent and vulnerable. However each being mistreated left them both experienced before their time. The Seduction is set in the mid 1970’s when a teenage girl is at a party and is lured by a sleazy boy. Cousin Kate is about a young maiden who is taken advantage of by a lord ho then leaves her for her cousin Kate. Both are left with an experience and a child. The poems were written in very different periods and reflect love and marriage in different social manors through time. ‘Cousin Kate’ was written in the Victorian reign around the 1870s. Love and marriage in the 1870s was very different to present time, as the Victorian citizen’s approach and mind-set was to expect women to provide children especially sons to become an heir, ‘Your father would give lands for one, To wear his coronet.’ This shows that the father would be willing to pay a lot of money (land) to have a grandson. Birth out of marriage was considered wrong; ‘The neighbors call you good and pure, Call me an outcast thing’. Society saw Kate as a good person and a good marriage that they accepted into the community. Whilst they considered the cottage maiden as an outcast for having a child out of wedlock. They were also perceived to have a duty to marry and obey their husband; in the bible it says St.Paul in Ephesians 5:22: ‘Wives, be subordinate to their husbands as to the Lord. For the husband is head of his wife just as Christ is head of the church, he himself the savior of the body. As the church is subordinate to Christ, so wives should be subordinate to their husbands in everything.†Ã¢â‚¬â„¢ Similarly in the Seduction although much more recent, societies view of birth outside marriage especially among teenage pregnancy is still frowned upon. ‘And better, now to turn away, move away, fade away, Than to have the neighbors whisper that ‘you always looked the type.’ The Seduction reflects a more modern attitude to love, where people frequently meet at social gatherings.’ She met him at the party and danced with him all night’. This shows that relationships can be started without knowing each other, when you are drinking. The poem also shows that men and women are now perceived as equal, in that both men and women are at the party and both are drinking alcohol. Messages of love have been interlinked with the environment to help you portray their attitudes towards one another. The setting in the Seduction has been created by using imagery and personification which helps the reader to envisage the scene. ‘Far from the blind windows of the tower blocks.’ This could imply that no one is there to see what could happen or that no one cares. An industrial dock yard is not a nice place to be and most probably not many people go there. ‘Towards the frightening scum on the water’, because this setting is so unromantic it implies that the sleazy boy is only after one thing. ‘She chattered on, and stared at the water, The Mersey, green as a septic wound.’ Here the author has used a simile to help explain nervousness of the girl. These words are effective because it emphasizes her innocents, although it seems to be dark and ery. The opening of ‘Cousin Kate’ tells us that she is just a simple country girl working to live. ‘I was a cottage maiden Hardened by sun and air, Contented with my cottage mates,’. Having this opening shows the emphasis of her innocents and it gives us a small idea of who she is. The author Christina Rossetti has pieced together a small picture of what her life was like but tells you enough for you to finish the scene in you mind. This all changes when later on it contrasts with the mention of her cousin Kate and the new lords. Both poets have used the environment help them create an image and an atmosphere which when added to the dramatic monologue is very effective. Also it transfers the feelings and emotions from the character to the reader. The poets have both used a range of techniques to help present the atmosphere and attitude to love. The atmosphere at the beginning of ‘The Seduction’ is quieting down after leaving a party with a random person who has got her drunk. It slowly turns into a dark and depressing mood but the girl is excited, naà ¯ve and unaware. The poet has used words like ‘she giggled’ and ‘he muttered’. This is successful as it shows the contrast between the innocent girl and the sinister boy. At the end of the poem the atmosphere has changed to a despaired attitude this shows how the poets view has changed. The emphasis of the change is described using poetic techniques like Connotation, Imagery, Oxymoron’s and alliteration. ‘And a bag filled with shimmering, sweet paint thinner.’ This implies that the boy was going off to get high when he is meant to be at school, I have chosen this quote also as an example of imagery and alliteration. Similarly the beginning of ‘Cousin Kate’ is peaceful, illustrated though words such as ‘contended’, ‘care’ and ‘flaxen’. However later on in the poem the narrators’ feelings are mixed; ‘Even so I sit and howl in the dust’ shows that she does feel sorrow and the reader can empathise with her. Also the poet has used dust to create a sad atmosphere. Whereas she perceives her cousin as wealthy and happy; ‘You sit in gold and sing’. This gives contrast from poor and rich, sorrow and joy. The narrator is also angry with the lord, ‘I would have spit in his face’. This illustrates her anger towards him, which creates tension and increases the reader’s knowledge of the narrator. Another way the poets express their attitudes to love and marriage is through the relationships between men and women. ‘Cousin Kate’ suggests the role of the men in the Victorian society were much more superior to women as they are the ‘hunters and gatherers’. By this I mean that the men are the leaders and are loved by women and the women should do as they are told. Conversely the male in the poem is not seen as likeable character, ‘He lured me to his palace home’. The word ‘lured’ projects an image of an ungentlemanly character which has falsely persuaded the victim. This is effective as he treats her as she is an object; ‘He changed me like a glove’. Equally ‘The Seduction’ the male character is perceived as someone who is not a pleasant person and a bad influence, ‘He spat into the river’. This is valuable as it illustrates how shocking and uncouth the boy is. Eileen McAuley has used verbs to convey the actions of the characters in ‘The Seduction’; for example the girl’s movements are submissive toward the strong minded boy. Although the same as ‘Cousin Kate’ the women in that period of time are meant to be submissive to their ‘master’. Consequently both poems are exploring the role of women in relationships and despite the fact that there is over a hundred years between the poems they both seem to be implying that society still criticise young mothers. Although the men are described as sleazy and sinister, this could be a miss conception as these may be the views from a women perspective. These descriptions of the male characters are portrayed as a stereotypical chauvinist male and could be offensive from a mans point of view. Finally the two poets have used the structure to help represent the theme of love. Both poems are written in stanzas and each tells another part of the story. ‘Cousin Kate’ is set out in a very traditional manner which help you to grasp the thoughts and emotions of the narrator. It repeats certain words in the first person like ‘I’, ‘he’ and ‘you’ this is done to show the difference between the characters but mostly cousin Kate and the narrator because ‘Kate’ has stolen the narrators ‘man’ (father); also because of the style it has created the piece of writing to be a dramatic monologue. Similarly ‘The Seduction’ also uses a lot of repetition of words in the third person like ‘she’ and ‘he’ this helps to show that it is a narrative. The poem is almost split into two sections; the fir half concentrates on the build up to when she discovers that she is pregnant and the second half only talks about if only it had not happened; also the first half is showing her innocents forming into an experience. This is successful because she is a young girl who still day dreams and wishes to be out with her friends; ‘Day trips to Blackpool, jumping all the rides?’ McAuley has also used a rhetorical question as if to say should she be out with her friends or does she get what she is deserved; but then it carries on to question what does the girl deserve? I believe that there is a subliminal message beyond the words and technical styles of writing, in both poems which can be related to the present time. The most obvious one is not to be naive and fall for boys tricks. However boy tricks are not always bad and good things may come of it. I consider the most successful technique is not a poetic technique, but more the structure the poets have written them in because it creates the mood, the speed and most of all in my eyes the tension and suspense.

Olympics Term Paper Example | Topics and Well Written Essays - 2500 words

Olympics - Term Paper Example In the event, the games will take two cluster organization methods. There would be a coastal cluster for ice events in Sochi, and a mountain cluster located in the Krasnaya Polyana Mountains (Nauright and Charles 76). There are expectations this kind of arrangement would make the games one of the most compact Olympic Committee has ever organized. The Sochi Olympic Park construction is along the Black Sea coast in the Imeretinskaya Valley. This is where all ice venues would take place. These include the Bolshoi Ice Palace, the Sochi Olympic Skating center, the Maly Ice Palace, the Olympic Oval, the Olympic Curling Center, the Central Stadium, and the main Olympic Village. In the mountain cluster in Krasnaya Polyana, this would be the home of all skiing and sliding sports activities (Hofstetter 78). The preparation for these games has triggered construction of new and modern telecommunications, electric power, new Olympic Park along the coast of Black sea, and transportation systems. W omen gymnastics would feature and as expected, the China Women gymnastic team would rock the event (Franks 88). They have previously put some distance on the other contenders in past Olympic Gymnasium competitions. Team goal or task – Level of difficulty In order to recreate the amazing moments that prompted the women gymnastics team of China to be branded exceptional, there ought to be more of what this women team have been doing. This actually calls for perfectionist awareness of the skills needed to be a top contestant in the 2014 Sochi Olympics. The women teams needs medal, and for that golden medal to come by, they know that not only thorough preparations and rehearsals will come calling in the subsequent days but also their bodies need to reach that high level of flexibility (Coma?neci 64). Since the attaining number four in Olympics competitions for China women gymnastics in 2012, there has been that pressure and pursuit of the entire team to reach that level of perfec tion. The team can win everything by not only producing a stunning performance but also attaining the level of flawless performance. The team’s head coach Lu Shanzhen, would want a repeat of the 1996 margin of almost near perfect performance over the most competitive opponents even if it were not the Russians (Crawley, Sara, Lara and Constance 102). This came to a success because the entire country, board and the bench team were exceptional. The coaching staff and the gymnasts need to wake into reality that their greatest task and level of difficult is the repeat of the standards once termed by the Bela Karolyi, a legendary gymnastic coach in US as performance so rare for 16 years old minors (Nauright, John, and Charles 110). The China team comprises of a beautiful bouquet of individual talent, which showed greater unity, mental toughness, and togetherness to compete 2012 Olympics (Hofstetter 79). The same zeal and commitment is the ultimate goal if the team has to affirm ful ly its heights in the sport of gymnasts. In order to put 1996 and 2012 performances in line of repeat, the head coach is ensuring that the team remains a solid entity despite individual talents and skills. There are no cracks of jealousy and rivalries among the gymnasts if success is their goal in 2014 Sochi Olympics. The team goes through individual qualifying by challenging each other in order to reach the individual all around. This is the pre-trial performances that have helped in fine-tuning the bests of these gymnasts and even makes

Report Coursework Example | Topics and Well Written Essays - 1000 words - 3

Report - Coursework Example The period is deemed to be the duration taken for one complete oscillation. The frequency can be deemed to be the number of oscillations that the pendulum can make per unit time the inverse of which is the period i.e. f = 1/T. The amplitude is the longest distance that is traversed by the pendulum in reference to its equilibrium position. The displacement causes the exertion of force that tends to restore the pendulum to its equilibrium position (Nethercott & Walton 2013). The sum vector of the gravitational force of the mass of the pendulum (mg) and the tension force (T) shown in Figure 1. They constitute the restoring force whose magnitude depends on the displacement from the equilibrium position. Therefore, the restoring force F can be calculated as The negative sign is an indication that the restoring force is in the opposite direction of the displacement. For small amplitudes, ÃŽ ¸ is small and therefore ÃŽ ¸ can be used in place of sinÃŽ ¸. Therefore, the resulting equation is The aim of this experiment is to estimate the acceleration due to gravity using a pendulum. For purposes of this experiment, the independent variable is the length of the pendulum whereas the period is the dependent variable (Bolton and Bolton 2012). The table top stand with clamp was placed on a flat working surface. The string was then passed through the pendulum bob and knotted as appropriate to hold the bob in position. The string with the pendulum attached to one end was passed through the split cork, and the length of string adjusted to 0.85m before being clamped onto the retort stand. A Vernier calipers was used to measure the diameter. The length of the string was adjusted to about .8 m. Therefore, the length of the pendulum is l = ls + r .where r is the radius of the bob. The pendulum was then displaced approximately 5Â º from its equilibrium position and left to swing back and forth. The time taken for 6 complete oscillations was recorded

English composition Essay Example | Topics and Well Written Essays - 500 words

English composition - Essay Example For instance, one may say, â€Å"It is my joy to serve you because I love you†. This would mean, it is one’s pleasure to serve a person he loves, that there would be no complaints or difficulties in doing the job. joy is a feeling that lifts the heart of a person so that whatever hardships may come, they would seem nothing compared to the pleasure one finds in accomplishing a task. It almost makes someone strong in everything he does because the feeling that it brings seem to lift the burdens up and makes things light and easy. Joy may also be expressed in merriments like festivities where giving is a distinguished feature, with the abundance of food, drinks and stories that make the attendees enjoy the time and event. Probably, one who is truly joyful could be such light hearted as to be so generous not only in material things but also in being kind to irritating people, loving one’s enemies and being at peace with them. It may be observed that a joyful person seems to have a magnetic force within him that attracts people to join his company and enjoy the time spent with him without a dull moment. This could be due to the influence one could bring to other people when he has joy in his heart. As they say, a smile could be epidemic, so joy could be more infectious. Joy could also be a person or thing which is a source of happiness and satisfaction. For example, a beloved child could be a parent’s joy. Whatever achievements the child may have would bring a sense of pride however, for a child who is said to be a source of joy, achievements would just be bonuses for them and not the source of joy itself. A well loved child, no matter what becomes of him, if he is considered a joy, would still be loved and well accepted without achievements. Although it is every parent’s desire for their children to become achievers, if one is considered a parent’s joy, achievements are not the basis of being proud and happy about them

The Syrian Civil War and the Regional Stability Essay

The Syrian Civil War and the Regional Stability - Essay Example Bashar al-Assad revealed to the citizens that he will abolish the party after he entered into power, in 1970 (Hirsch 35). However, he never abolished the party, but rather transformed it. Assad structured the Ba’ath party in order to make it fit in the dictatorial format of his presidential regime. The Syria government deployed the Army in order to control the Syrian uprising and they ordered soldiers to control and take action on any public protest. However, the demonstrations evolved later into a serious armed rebellion and some of the groups became armed terrorist. These created the commotion and crushes across the nation; thus impacting the regional stability of the Syrian nation. Thesis: Despite the political issues of the Assad dynasty and unapparent end of Syria crisis, politicians have emerged with political agendas regarding the way they can solve the political impact of Syria civil war on the regional stability of Middle East. Impact of Syria Civil War on the Regiona l Stability of the Middle East The Syria Civil War has contributed to varied impacts on the regional stability of the Middle East. First, the Syrian uprising is a threat to socio-economic development of the Middle East. ... The Middle East has become the home for multiple ethnicity and religious conflicts including the Kurds, Muslims, Arabs people, Christian community, Assyrians and many others. The conflicts has been sparkled by the Syrian Civil War; thus creating national disasters in the Middle East. Activist claims that more than 30 000 Syrians have lost their lives while others have lost their properties in the Syria uprising, which started on March of 2011 up to the present (Handler 42). This, many people from these regions have economically and politically felt the impact of the instability in the Middle East economies. Secondly, the harshly domestic war in Syria has contributed to local displacement and international isolation of many people. The international isolation revealed some signs of lessening after France and Russia made significant efforts of bringing the issue of Middle East conflicts back to the international fold. However, the Syrian violated the UN verdict that led to the banning of Lebanese militia, which also contributed to the annex of US sections on the war issues. The debate is now on the way US can respond to the escalating Middle East crisis that have led to increased internal displacement of many people. The IDPs have increased because Syrian uprising has impacted the stability of the Middle East economies; hence causing heavy constraints on the economic resources of Middle East economies. The Syria war has tremendously contributed to refugee problems and the internal displacement of people is further expanding. Pollack, Brookings Institution., Institute for the Study of War and American Enterprise Institute for Public

Gillette Essay Example | Topics and Well Written Essays - 1000 words

Gillette - Essay Example The 4Ps of marketing named product, place (distribution), price, and promotion helped in marketing Gillette, firstly the product that was having extraordinary features in it was it self an attraction, the distribution was done through normal hiring of distributors in U.S. and afterwards the company launched it internationally, the pricing system was cost based, means that it was on the basis of per unit cost, with some profit on it, and promotion was done by the store display as advertisement had not gained popularity. Henry Ford was a one in million entrepreneur and also an inventor, he was the first one to make assembly line manufacturing for mass production of the affordable automobiles of that time, car was a luxury from ages but it was Ford who gave them another perception, he made it so easy for us to travel, the product that is the car was in the simplest stage at the time of invention, though he had given it so many shapes and features like cars being used for fishing, cars being used for traveling etc. ... The people of old times were just concerned with the core product that was to travel the distance through some means with some standard but than came so many models that now Ford has become a status symbol, though there are so many other cars available in the market but it seems that one is legend while driving the Ford. The 4ps played even a bigger role in making sure that Ford is the most valuable car in the market, the product had so many new features, designs, style, quality was even good in comparison with the other cars of that time, the distribution was done in the entire U.S. on the basis of normal distribution through the transport services, pricing was done while keeping the value of the product, it was value based pricing that was used, and as the product was so unique and wonderful and everybody would have loved to buy it thus the promotion was done through good and effective store display (Showroom display), personal selling had also played some role but afterwards. TV Dinner Gerry Thomas invented TV Dinner while he was working for Swanson, he was criticized severely but he did not show any intimidation and he invented TV dinner, a packaged frozen meal that can be ready to eat at any time, the product was a creative thinking's outcome and it simplified the human life in many ways particularly the working class of U.S. which was in need of some thing that would not be consuming much of their time and can also be used till so many days and weeks. The product was initially a simple pack of aluminum foil having various foods in it such as turkey, but in modern day life it changed from foil to a tin pack and now to a big pack with some fancy packaging. The American

Strategic Alliance of two companies Essay Example | Topics and Well Written Essays - 2500 words

Strategic Alliance of two companies - Essay Example After being aligned together Sony Ericsson in a short span of time captured the market share of Nokia, Motorola and Samsung. The main reason behind this gaining of market share was the reasonable price of the phone, additional features, attractive looking of the mobile phones. Slowly and gradually they are making advancement in technologies and bring better phones into the market for the consumers. The consumers are satisfied with the products of Sony Ericsson and the eye catching mobile phones of Sony Ericsson are a brand in the minds of the customers. The Stylishness of the phone along with the features including Camera, Blue tooth, Infrared, Java enabled games, mp3 player being available at a reasonable price, and easy to use mobile phone. Most consumers are opting for the Sony Ericsson Mobile phones. With the changing times, people have started to adapt to changing technologies and quite rightly so, Sony Ericsson has caught on the bandwagon well. Strategic alliances are chances for small businesses to achieve things that would otherwise take much more money or staff time. There are several ways small businesses can work together with other business unit. While you may be courageously stepping down the path of running and increasing your businesses, there may come a time when you need to form strategic alliances for your business. Given the current state of business today, competitive pressures are forcing companies to come-up with creative ways to improve brand identity, attach with clientele and draw top-notch staff. Corporations are teaming up more today to enhance their competitiveness in the marketplace and keep speed with the quick modification of technological improvement. More than 20,000 corporate alliances have been formed worldwide over the past two years. Strategic alliances are shaped when one company alone cannot fill the gap in helping the needs

Multi scale modeling of complex neuronal networks Essay

Multi scale modeling of complex neuronal networks - Essay Example For the numerical simulation, MATLAB was used, with the simulation being discretized in time with a step size of one quarter of the frequency for a progressive visualization of the pattern, (606). The results of this simulation indicate that the induced activity of the sparsely distributed cholinergic neurons within the dorsal striatum leads to the identification of surrounding n-cells. The single-pulse activation induces abrupt spread and declining of spikes. The model used reveals characteristic pattern formations respective to the morphological structure of the activated cells. The figure basically shows the spatial pattern formation within the dorsal striatum of rats as a result of the cortical activation of cholinergic neurons. The distribution of active neurons is indicated by color pink while the distribution of inactive neurons is shown by color grey. The pink coloring is an indicator of the initial activation of the sparsely distributed cholinergic neurons. This can be shown by Fig 2a. On the other hand, the grey coloring indicates the ongoing inactivation process throughout the structure. This can be indicated by Fig 2d. Therefore, this figure presents the induced a ctivity in the dorsal striatum of a art as a result of cortical activation of cholinergic neurons,

Charity events and fundraising Essay Example | Topics and Well Written Essays - 3000 words

Charity events and fundraising - Essay Example The nurses of the centre are also actively involved with patients who stay at home. They give them support and best counselling to ensure that their situation is better. The centre was established in 1975 and it was the first of its kind and offers free services Payne, Seymour and Ingleton (2008. p. 368) The centre depends entirely on donations and financial commitment from other people to enable the centre run smoothly. Government funding accessed by the centre can only cater for 28% of budget. For 2014-2015 financial years, the centre will need about  £8 million. Out of this the government has only taken care of 28% and therefore the rest has to be raised by the centre. The centre uses 85% of its expenditure on direct costs where as the remaining 15% is used in support cost. Below is a description of a proposal aimed at creating awareness and raising funds for St. Luke’s Hospice. This is a one day event that is aimed at getting the community around Sheffield involved in raising funds as well as give emotional support to the patients in the centre. A community has high chances of participating in a charity especially if the community is the primary beneficiary Stelljes (2008, p. 150) Sheffield is known to produce top names in the world in all fields. May it be entertainment, sports, politics, business, education you name it. Most of these people were born, raised or live in Sheffield. They are what we call celebrities. They have a massive influence in the society and most people admire them. St. Luke’s is more of a community centre considering that its operations are primarily focused on the people of Sheffield. The centre has helped many people in fighting their illness. The idea of this proposal is to work with one of the celebrities who have their roots in Sheffield to hold a one day event that will attract all the residents within 20 miles radius in Sheffield.

International Travel Essay Example for Free

International Travel Essay No matter how much you read ahead of time, youll be confronted with culture and custom that you are unprepared for. The farther removed the culture is from your own, the more you can expect to be surprised. Novice travelers will struggle with the basics everything from getting a cab to finding a public bathroom can offer a challenge. Veteran travelers will be more secure with the small stuff and that may offer them a firm-enough foundation to give them the confidence to try the more challenging things. That is where we were on our recent adoption trip to China: Veteran third-time travelers who were confident that we could do anything and blend right in. Our trip to the real Chinese restaurant taught us otherwise. It was our second week in China. We were there with our two previously adopted Chinese children, ages ten and eleven, and wed just added a new family member. She was a new daughter, age twelve, and she spoke not a word of English. Things had been going very well, and our new daughter was really fitting in seamlessly. This being our third trip, we felt pretty cocky. We snickered good-naturedly as first-time travelers timidly peeked outside the doors of the hotel onto the Chinese thoroughfare. They might make a run for the McDonald’s now and again, or go all the way up the block to KFC, but actually heading out into the big city, sans guide, was not on their bucket list for the time being. That was not for us. We decided that wed all head out to an authentic local restaurant, the sort frequented by the Chinese rather than by westerners; the type with plastic curtains rather than doors; a restaurant with no western influences beyond the ubiquitous presence of Coca-Cola products. Three hungry children herded between us, my wife and I set out to find just the right place. We headed out the less-frequently-used rear entrance of Guangzhous China Hotel, which spilled out onto the broad Panfu Avenue, a typical busy main thoroughfare. It was filled with small shops and stalls, looking shabby and temporary to Western eyes, though in reality, permanent centers of street commerce. We wound our way through typical robust foot traffic, straining to keep the kids together amidst the crowds. We passed up several restaurants close to the hotel in an effort to separate ourselves from the tourist-oriented places, but several blocks away we came upon the Liushen Xiguan restaurant, which translates roughly as â€Å"Traditions of the Six Gods† restaurant. It was clad in gold paint, trimmed with red cloth, and several large Buddhas smiled at us as they stood sentry on the sidewalk. The wall in the entryway was covered with awards given by the local of chamber of commerce, and as an added benefit, the awards each offered a picture of the winning dish. Velvet padded bamboo chairs lined the wall in the waiting area. Peeking through the windows, we could see that the dining area was enormous. Such a place was likely to have good food, was clearly worth a stop. It was 4:50 when we asked to be seated, but oddly, the dining room was dark and the hostess desk was empty as were the tables. No table cloths or place settings were to be seen, and the chairs were upended and sitting atop the tables. A hostess apprehensively approached us to talk. After much arm flapping and hand gesturing, we came to understand that the restaurant would not open until five P. M, although we could not see how it would do so. Not a soul was to be seen besides the hostess, and nothing was prepared for customers. We began to have second thoughts and we started to wonder if wed misunderstood the hour that service would start. We decided to wait for a bit, if only to rest. At the stroke of five the lights came on to illuminate a dozen employees rushing from the kitchen, bearing ornate livery for the tables, and tools of the trade for the hungry guests. The dining space went from abandoned warehouse to friendly, well-lit, white linen appareled eatery in a matter of moments. Once seated, we began to notice differences from what we expected in a restaurant. Soup bowls appeared, as well as a pot of tea, tea cups, and a large empty ceramic bowl. We watched the other tables to see what use our fellow diners would have for the bowl. Some diners were watching us. Perhaps they didnt know what to make of the empty bowl either? More likely, they were wondering what a couple of Americans were doing here staring at them too. Other diners were taking the cups, bowls, and spoons and washing them in the tea, using a rather practiced method. The used tea was discarded into the empty bowl. I wasnt sure if this meant we needed to do our own dishes, or if it was simply a custom. To be on the safe side, we started washing. I noticed curious grins. Was I doing it wrong? Did we appear like children playing in a wading pool? Unblemished by the bemused stares, we toweled ourselves dry, and with confidence in the cleanliness of our place settings, we dug into the menu. There were thirty pages of menu items. Many had pictures and some had English translations, though mostly the translations read â€Å"Pork and vegetables in sauce† or â€Å"Chicken with vegetables in sauce†. While Im certain that was accurate, it was of little value in helping us to choose from amongst the twenty five varieties of â€Å"Pork with vegetables in sauce†. We struggled with the pictures and each made the best possible dinner choices we could, with a few appetizers added in. The waitress took our order promptly and returned in a few minutes with my meal, and nothing else. No appetizers. No other orders. Just mine. She placed it in the center of the table and left. My meal was far larger than I expected. In fact, it was large enough to feed us all. Suddenly we grasped what we had missed. The table top was essentially an enormous lazy Susan. It appeared that we would be eating family style. Other tables were sharing food as well, so we set out to share the barbecued pork I had ordered. A few moments later the next meal appeared, and shortly thereafter, the next, and then the next, each meal large enough to feed a family of five. Even the items wed been led to believe were appetizers seemed enormous. Before long, we had enough food for forty people. There was so much, that the server was barely able to find room for the last steaming bowl of fried rice. Ive been to weddings that served less food than wed purchased. We were clearly the center of attention now as we made an effort to at least put a dent in the spread we were responsible for. The pictures didnt do the food justice, nor were they worth the thousands words Id so often been promised. The fried rice was filled with boldly colored fresh carrots, peas and sprouts, and those turned out to be the only vegetables on the table that we easily recognized. We were served steamed and pan-fried dumplings, bursting with juices and filled with meat stuffing. There was a whole roasted chicken, the bright yellow color of a school bus. When I say whole, I mean it. Chicken in China often comes with feet, head and beak attached. It appeared that our dinner had walked straight from the barnyard to the oven. A second chicken was served in pieces which had the bright red color of a fire engine. Both birds were juicy and offered bold flavor, the yellow one having been seasoned with a curry and the red one more of a peppery spice. The seafood dish seemed a bit more tentacle-filled than we were used to, and it went largely unloved. I still have no clue to this day what was in it, though I will admit that the description â€Å"fish with vegetables in sauce† seemed unerringly accurate. Our crisp pork on a platter seemed straightforward. No sauce or vegetables, though I could swear that the translation of the dish said they were included. Our meal was rounded out by a course of tea smoked duck. The dark meat had been roasted over a tea leaf fueled fire and had a deep rich flavor. After some of our other mis-translations, I would not have been surprised to have had it served in a pipe for actual smoking, but it wound up being the best part of the meal. I do hope it was duck though. We left a great deal of food on the table. In very American fashion, we asked for containers to take the remaining food for thirty back to our hotel. That doesnt seem to be the norm in China, but we packed up our bags and loaded up with more victuals than a United Nations food convoy. I was concerned about the cost, but for all the entertainment that our endeavors provided for the patrons, perhaps they should have paid us. The price was thankfully low; bless you generous exchange rate. One last problem appeared. The tip. It is insulting to over tip in China. After having the experience of being publicly chastised by a cab driver for over tipping, I was leery. Loaded down as we were, there could be no quick escape should I insult the staff with too many Yuan, or too few. The Six Gods must have been watching out for us though. The older hostess (manager, cook, waitress, cashier no real idea) took pity on me and selected a bill to leave as a gratuity. It was far less than I would have chosen. Id have given her double that just for getting me out with my remaining dignity intact. We wound our way back to the hotel, filled with a good meal, good stories, and a good deal of new knowledge about how things are done in China. I mentioned the experience to our guide, who filled in a few of the blank spots. He was happy to hear that we were treated well by the local people. I was happy for the experience. A few days later, we coaxed some other group members to come out with us to the restaurant. We displayed our dining skills for them without ever mentioning the difficulties with which they were acquired. After all, that is how veterans maintain their mystique.

The continued discrimination against homosexuals

The continued discrimination against homosexuals Homosexuality is very common in society. However many individuals still discriminate against them. Their prejudgments are based on stereotypes, and lack of information. Due to our social perception, people who are different from them is deem to be threatening. In this report, discrimination against homosexuals will be discussed, with facts, different supporting examples and cases from Singapore and the United States, with Singapore being the more traditionally conservative one. Ways to reduce discriminations against them is also mentioned and explored. The issue and who are involved? We can fall in love, but why cant they? Homosexuality is romantic and/or sexual attraction or behavior among members of the same sex or gender, making up around 10% of the population. Sadly, they continue to be one of the least protected by the government and discriminated against by the society. Homosexuality was categorized as a mental disorder until 1973. The words gay and lesbian are used to refer to homosexual men and women and bisexual refers to those that are attracted to both men and women. Brief History on Homosexuals in Singapore In 1960s, Homosexuality was categorized as a condition in a Singapore Armed Forces (SAF). Before enlistment, all enlistees would undergo a medical checkup and asked to declare their homosexuality status. Those declared will be downgraded to a Public Employment Status of 3 and were assigned to be clerks. In 1998, Senior Minister, Mr Lee Kuan Yew , live on CNN International, said, what we are doing as a government is to leave people to live their own lives so long as they dont impinge on other people. I mean, we dont harass anybody. these words helped set the tenor for official policy on homosexuality for many years. His comments is said to be one of the most significant events relating to gay rights. Before 2003, homosexuals were forbidden from being employed in sensitive positions in the Singapore Civil Service. Prime Minister Goh Chok Tong abolished this in a widely publicized statement. In 2006, Liberty League, an organization that promotes gender and sexual health for the individual, family and society, was granted $100,000. Brief History on Homosexuals in the US After W.W.11, thousands of homosexuals were dishonorably fired from the armed services and jobs, due to public display of homosexuality, and were ostracized from families and communities. In early 1953, homosexuality became by a necessary and sufficient reason fire any federal employee from ones job. In the 1970s, in some cities, anti- discrimination for homosexual laws was placed. California had its first openly gay elected official; Harvey Milk. Compared to Singapore, the US has a richer and more open homosexuality culture. In recent years, the US has slowly begun acceptance for homosexuality. Several television programs with elements of homosexuality, Will and Grace, Glee, Queer Eye for the Straight Guy, Greys Anatomy were aired. As the popularity of these shows increases, the gay community is closer to acceptance and justice by the society. They have gay pride parades and homosexual marriages supported by many areas of US, unlike Singapore. Discrimination against Homosexuals With the laws placed and the better recognition of the homosexual community, the situation in both countries seems favorable. However, homosexuals still face rampant stereotypes from the world and may worsen if deeper understanding of homosexuals is not being promoted and measures are not taken. This topic has been chosen because this is a very important issue in this society, and feels that they should have the same rights as heterosexuals. There have been many incidents of bullying and victimizing homosexuals that led to deaths in the US. Many have gone into depression. These should not be tolerated and something has to be done. Homosexuals do not come out for many reasons, the most common being that they are uncomfortable to declare to any society that is perceived to be homophobic. Negative stereotyping is often a result of homophobia, which refers to an irrational fear, prejudice or discrimination towards homosexuals, and can be name-calling and teasing to serious crimes like assault and murder. Positive stereotypes, or counter-types, also exist but may be no less harmful, as they are still oversimplified views of the group being stereotyped. Some examples of the common stereotypes that gays are described to be expressing too much of his feelings, very vulnerable and sensitive, likes touching himself and other people. They are also stereotyped to love talking about feminine things; the use of cosmetics, very concerned with their lips, skin and hair protections. Why this prejudice and discrimination affect society and is important. Current situation in Singapore Although being homosexual in Singapore is not illegal, performing any homosexual acts in public or privately, is. Section 377 of the Singapore Penal Code records the penalty for indecency between individuals which includes consensual, private, adult homosexual acts; imprisonment is up to 2 years. A gay group was denied permission to hold a forum on the role of homosexuals in society. The local media avoids homosexual issues in fear of getting their licenses suspended. In schools, sexuality courses focus more on heterosexuality-the only mention of homosexuality reminds students that it is illegal. Moreover, homosexual couples in Singapore, cannot rightfully own a home through the public housing scheme, thus many rent as private housing is unaffordable to them. Unsurprisingly, this shows that Singaporean society remains deeply conservative and the governments are still not as open to discussions about gay rights. Attitudes towards homosexuality are also tied up closely with the different religious values in this multi-racial society, like Muslims and Christianity which considers it as a sin. In Singapore, the government uses Confucian readings to create a certain amount of ideological coherence in its version of Asian Values and to give it some academic respectability. From an interview, 68.6% of the surveyors expressed negative attitudes towards homosexuality. Christians and Muslims were found to be least tolerant, older people are less tolerant and more educated people are more tolerant. Therefore, Singapore who is a traditionally conservative society may not be ready for a change. Current situation in United States Recently, there have been many news on homosexual bullying leading to suicides, for example , Tyler Clementi, a 19 year old student from Rutgers University. After his college roommate lived-streamed Tyler having sexual relations with his boyfriend, Tyler threw himself off a bridge. Asher Brown was a 13-year-old was tormented for the way he dressed and being gay. His bullies acted out mock gay sex acts in classes. His parents repeatedly contacted school officials on his bullying. Nothing was ever done. He shot himself in the head. Policy on lesbian, gay, bisexual, in US has evolved over time and varies between different regions. Five states and one district have legalized same-sex marriage. President Obama announced that he will work with Congress and the military to repeal the dont ask, dont tell policy that forbids homosexuals from openly serving in the military. However, there is still much opposition, commenting that homosexuals identities should not be made known. However, there have been many interviews and surveys that show that the US is slowly accepting homosexuals. For example the graph below shows that attitudes towards homosexuality in the US, over the years seem more positive. Source: http://www.norc.org/GSS+Website/Browse+GSS+Variables/Subject+Index/ Why is it important? A continuation of homosexual discrimination is detrimental to their mental health, which may increase suicidal tendencies or other mental afflictions. There are many websites contending that homosexuality is a sin, stating that it is entirely up to choice, easily changeable, and giving excuses to put down homosexuals, using reasons like God hates fags. People tend to associate HIV and AIDS as a gay related disease, thinking that as long as they avoid having sex with homosexuals, they are safe from HIV. This ignorance can cause them to practice unsafe sexual intercourse. Stereotyping them to be rapist, pedophiles are very common and these send a wrong message to the public, causing fear. This increases the fear in homosexuals for being discovered to be gay, causing them to feel immense stress and pressure, doubling the chance of depression and suicidal tendencies. The rejection and misinformation results in homophobia causing them to bully other people , verbal assaults, causing other people psychological stress and pain. Homosexuals may also face family and friends rejections. The result is a vicious cycle of prejudice and discrimination. Where can we start to fix the problem? How such prejudice and discrimination creates inequality to the society. The law, sec 377a, criminalizing sexual acts between homosexuals, encourages Singaporeans discriminate against homosexuals indirectly. Other countries have accepted same sex marriage and have laws to protect them. Homosexuals should also have the same benefits as heterosexuals. In Singapore, some teachers were being forced to quit because of their sexuality like Otto Fong, and Alfian Saat. In national service, they are downgraded to positions like clerks, and disqualified from some sensitive areas. All these are deemed to be discrimination and homosexual inequality. Workable solutions for individuals and institutions From what I have found out, these prejudice and discriminations comes from ignorance and misinformation. Unbiased sex education can help to change mindsets of people about homosexuality at large. Singaporeans are consistently taught that sexual acts between homosexuals are illegal but do not talk about why and how we should learn to accept them in our society. This is an important issue, thus this topic should be in Civic Moral Education where students can learn about it. The society can also educate homosexuality in the media, television shows, or host public homosexuality talks and events. For example, in the US, they have a Wear a Purple Shirt Day in honor of homosexuals that committed suicides due to bullying. We as individuals have to learn not to stereotype and listen to peoples misconceptions, but taking initiative to learn more about homosexuality from places like, internet and books. We are more than capable of making our own decisions, and more than capable of being accepting and inclusive. We should create an environment of diversity and acceptance for both heterosexuals and homosexuals. http://socyberty.com/issues/prejudice-and-discrimination-on-homosexuality-in-singapore/#ixzz174Rz1JxF http://en.wikipedia.org/wiki/Singapore_gay_history:_2000_to_2009_A.D. http://www.sgwiki.com/wiki/Singapore_gay_history http://knol.google.com/k/discrimination-against-homosexuals-in-singapore# http://www.norc.org/GSS+Website/Browse+GSS+Variables/Subject+Index/ http://articles.cnn.com/2010-01-27/politics/obama.gays.military_1_repeal-policy-that-bars-gays-servicemembers-legal-defense-network?_s=PM:POLITICS http://filipspagnoli.wordpress.com/stats-on-human-rights/statistics-on-discrimination/statistics-on-discrimination-of-homosexuals/ http://en.wikipedia.org/wiki/LGBT_rights_in_the_United_States

Computer Forensics Investigation and Techniques

Computer Forensics Investigation and Techniques Introduction I am the student of International Advanced Diploma in Computer Studies (IADCS). In this course, I have to do Compute Forensic assignment. The assignment title is â€Å"Didsbury Mobile Entertainments LTD†. This assignment helps me understanding computer forensics investigation and techniques Before this assignment, although I am interested in computer forensic, I am hardly used computer forensics toolkit or done any investigation. Because of this assignment, I have learnt many techniques how to investigate computer and done it practically. So, by doing this assignment, I have gained in practical and much valuable knowledge in Computer Forensics.nd a heartfelt thanks to all the people in Myanma Computer Company Ltd. for their warmly welcome during the period of the IADCS course and this assignment developed. Task 1 i) Report DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 10, 2010 Introduction Computer forensics involves obtaining and analyzing digital information for figuring out what happened, when it happened, how it happened and who was involved. What is more, it is use as evidence in civil, criminal, or administrative cases. Reasons for a need for computer forensic investigation Computer forensics investigation can recover thousands of deleted mails, can know when the user log into the system and what he does, can determine the motivation and intent of the user, can search keywords in a hard drive in different languages and can gain evidence against an employee that an organization wished to terminate. For these reasons, in order to know whether Jalitha has been spending her time on her friend business or not, we need a computer forensic investigation. Steps to pursue the investigation In order to pursue the investigation, I would take the following steps: 1) Secure the computer system to ensure that the equipment and data are safe 2) Find every file on the computer system, including files that are encrypted, protected by passwords, hidden or deleted, but not yet overwritten. 3) Copy all files and work on this copy files as accessing a file can alter its original value 4) Start a detailed journal with the date and time and date/information discovered 5) Collect email, DNS, and other network service logs 6) Analyze with various computer forensics tools and software 7) Print out an overall analysis 8) Evaluating the information/data recovered to determine the case Conclusion After we know the reasons and steps for investigation, then we should move on to conduct the investigation. However, we should note that the first step of investigation is critical as if the system is not secure, then the evidence or data we found may not be admissible. ii a) Report for â€Å"The procedures to make sure the evidence holds up in court† DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 12, 2010 Introduction Evidence is any physical or electronic information (such as computer log files, data, reports, hardware, disk image, etc) that is collected during a computer forensic investigation. The purpose of gathering evidence is to help determine the source of the attack, and to introduce the evidence as testimony in a court of law. Procedures to make sure the evidence holds up in court In order to make the evidence admissible in court, we need to follow the following steps: 1) Before any evidence can be gathered, a warrant must be issued so that forensic specialist has the legal authority to seize, copy and examine the data 2) Have the responsibility to ensure that the law and the principles we used are met 3) Evidence must be obtained in a manner which ensures the authenticity and validity and that no tampering had taken place 4) Tracking the chain of custody is essential for preparing evidence as it shows the evidence was collected from the system in question, and was stored and managed without alteration. 5) Extracted/ relevant evidence is properly handled and protected from later mechanical or electromagnetic damage 6) Preventing viruses from being introduced to a computer during the analysis process 7) To ensure that original evidence must be described in complete details to present reliable evidence on the court 8) Must arrange to answer reliability questions relating to the software we have used Conclusion In gathering evidence, authenticity, reliability and chain of custody are important aspects to be considered. By following the above steps, we are proper in handling the evidence holds up in court. ii b) Evidence form Didsbury Mobile Entertainments Ltd IT Department Computer Investigation Case No.: 005 Investigation Organization: Gold Star Investigator: Win Pa Pa Aye Nature of Case: Companys policy violation case Location where evidence was obtained: On suspects office desk Description of evidence: Vendor Name Model No./ Serial No. Item #1 One CD Sony Item #2 A 4GB flash memory device Kingston 05360-374.A00LF Item #3 Evidence Recovered by: Win Pa Pa Aye Date Time: 10.12.2009 10:00 AM Evidence Placed in Locker: E2419 Date Time: 15.12.2009 11:00 AM Item # Evidence Processed by Description of Evidence Date/ Time 1 Win Pa Pa Aye Fully recovered deleted email on the drive which is sent to Radasas company, including data exchange between the businesses. 13.12.2009 3:00 PM 2 Win Pa Pa Aye Encrypted document hidden inside a bitmap file. Decrypted and saved on another media. 18.12.2009 9:00 AM 3 Win Pa Pa Aye Password-protected document covering the exchange of information with her friend. Password cracked and file saved on another media. 22.12.2009 2:00 PM Task 2 Report for â€Å"the way the data is stored, boot tasks and start up tasks for Windows and Linux systems† To effectively investigate computer evidence, we must understand how the most popular operating systems work in general and how they store files in particular. The type of file system an operating system uses determines how data is stored on the disk. The file system is the general name given to the logical structures and software routines used to control access to the storage on a hard disk system and it is usually related to an operating system. To know the way the data is stored in Windows XP and Linux, we need to get into file systems of Windows and Linux. The way the data is stored in Windows XP In Windows XP, although it supports several different file systems, NTFS is the primary file system for Windows XP. So, we will have a look in NTFS as the NTFS system offers better performance and features than a FAT16 and FAT 32 system. NTFS divides all useful places into clusters and supports almost all sizes of clusters from 512 bytes up to 64 Kbytes. And NTFS disk is symbolically divided into two parts MFT (Master File Table) area and files storage area. The MFT consumes about 12% of the disk and contains information about all files located on the disk. This includes the system file used by the operating system. MFT is divided into records of the fixed size (usually 1 Kbytes), and each record corresponds to some file. Records within the MFT are referred to as meta-data and the first 16 records are reserved for system files. For reliability, the first three records of MFT file is copied and stored exactly in the middle of the disk and the remaining can be stored anyplace of the disk. The remaining 88% of disk space is for file storage. Below is the partition structure of NTFS system. After we know the file system of Windows XP, then we will move on to the file system of Linux. The way the data is stored in Linux When it comes to Linux file system, ext2 has been the default file system as it main advantages is its speed and extremely robust. However, there is a risk of data loss when sudden crashes occur and take long time to recover. Sometimes the recovery may also end up with corrupt files. By using the advantage of ext2 and add some data loss protection and recovery speed led to the development of journaling file system ext3 and ReiserFs. Though ext2, ext3 and ReiserFs are the most popular file system, there are also some other file system used in the Linux world such as JSF and XFS. As Linux views all file systems from the perspective of a common set of objects, there are four objects superblock, inode, dentry and file. The superblock is a structure that represents a file system which includes vital information about the system. Moreover, it includes the file system name (such as ext2), the size of the file system and its state, a reference to the block device, and meta-data information. It also keeps track of all the nodes. Linux keeps multiple copies of the superblock in various locations on the disk to prevent losing such vital information. Every object that is managed within a file system (file or directory) is represented in Linux as an inode. The inode contains all the meta-data to manage objects in the file system. Another set of structures, called dentries, is used to translate between names and inodes, for which a directory cache exists to keep the most-recently used around. The dentry also maintains relationships between directories and files for traversing file systems. Finally, a VFS (Virtual file system) file represents an open file (keeps state for the open file such as the write offset, and so on). While the majority of the file system code exists in the kernel (except for user-space file systems), (2.3) shows the Linux file system from the point of view of high-level architecture and the relationships between the major file system-related components in both user space and the kernel. The boot task and start up task of Windows XP A good understanding of what happens to disk data at startup is also an important aspect as accessing to a computer system after it was used for illicit reasons can alter the disk evidence. First, we will discuss about the Windows XP startup and boot process, and then shift into the startup and boot process of Linux. Like any other PC system, Windows XP startup by running the POST test, performing an initialization of its intelligent system devices, and performing a system boot process. The boot process begins when the BIOS starts looking through the system for a master boot record (MBR). This record can reside on drive C: or at any other location in the system. When the BIOS execute the master boot record on the hard drive, the MBR examines the disks partition table to locate the active partition. The boot process then moves to the boot sector of that partition located in the first sector of the active partition. There, it finds the code to begin loading the Secondary Bootstrap Loader from the root directory of the boot drive. In NTFS partition, the bootstrap loader is named NTLDR and is responsible for loading XP operation system into memory. When the system is powered on, NTLDR reads the Boot.ini file. If boot.ini contains more than one operating system entry, a boot menu is displayed to the user, allowing the user to choose which operating system is to be loaded. Fig (2.4) shows Boot.ini contains two operating systems and allows user to choose. After the user has selected the desired mode to boot to, NTLDR runs Ntoskrnl.exe and reads Bootvid.dll, Hal.dll and the startup device drivers. After the file system driver has loaded, control is then passed from NTLDR to the kernel. At this time, Windows XP display Windows logo. Virtually, all applications we installed using the default installation decide that they should start up when windows starts. Under â€Å"Startup† tab in the system configuration utility, a list of programs that run when our system boots is listed. Fig (2.6) shows the listed program when our system boots. The boot task and start up task of Linux After we have get into the start up process of Windows XP, we will then shift into the startup process of Linux. In Linux, the flow of control during a boot is also from BIOS, to boot loader, to kernel. When you turn on the power, the BIOS perform hardware-platform specific startup tasks. Once the hardware is recognized and started correctly, the BIOS loads and executes the partition boot code from the designated boot device, which contains Linux boot loader. Linux Loader (LILO) is the Linux utility that initiates the boot process, which usually runs from the disks MBR. LILO is a boot manager that allows you to start Linux or other operating systems, including Windows. If a system has two or more operating systems, LILO gives a prompt asking which operating system the user wishes to initialize. When the user chooses the boot option, it then loads the choosing operating system into memory. The boot program, in turn, reads the kernel into memory. When the kernel is loaded, the boot program transfers control of the boot process to the kernel. The kernel then performs the majority of system setup (memory management, device initialization) before spawning separately, the idle process and scheduler and the init process which is executed in user space. The scheduler takes control of the system management. The init process executes scripts as needed that set up all non-operating system services and structures in order to allow a user environment to be created, and then presents the user with a login screen. We have described about the way the data stored, the boot task and startup task of Windows XP and Linux. After a thorough study of these areas, we can acquire or handle the evidence properly. Task 3 a) Features comparison of â€Å"EnCase, Access Datas Forensic and ProDiscover† Features of Guidance EnCase Forensic * In courts worldwide, forensically acquire data in a sound manner using software with an unparallel record * Using a single tool and investigate and analyze multiple platforms * With prebuilt EnScript ® modules such as initialized Case and Event Log analysis, it can automate complex and routine tasks, so it save time in analyzing * Find information despite efforts to hide, cloak or delete * Can easily handle large volumes of computer evidence, view all relevant files that includes deleted files, file slack and unallocated space * Directly transfer evidence files to law enforcement or legal representatives as necessary * Include review options that allow non-investigators to review evidence easily * Include report options that enable quick report preparation Features of Access Datas Forensic Toolkit * Provides integrated solution that is no need to purchase multiple tools to complete a case. * Provides integrated database that avoid application crashes, lost work and product instability. * Identify encrypted files automatically from more than 80 applications and crack those files. * Supports international language that allows us easily search and view foreign-language data in our native format * Include email analysis that can recover and analyze a wide range of email and web mail formats * Can generate different industry-standard report formats quickly and concisely * Collect key information from the registry that include user information, date of application installed, hardware, time zone and recently used information * While processing takes place, we can view and analyze data Features of ProDiscover * To keep original evidence safe, it create bit-stream copy of disk for analyzing that includes hidden HPA section * For complete disk forensic analysis, it search files or entire disk including slack space, HPA section and Windows NT/2000/XP alternate data streams * Without alter data on the disk, it can preview all files including metadata and hidden or deleted files * Support for VMware to run a captured image. * In order to ensure nothing is hidden, it examine data at the file or cluster level * To prove data integrity, it can generate and record MD5, SHA1 and SHA256 hashes automatically. * Examine FAT12, FAT16, FAT 32 and all NTFS file systems including Dynamic Disk and Software RAID for maximum flexibility. * Examine Sun Solaris UFS file system and Linux ext2 / ext3 file systems. * Integrated thumbnail graphics, internet history, event log file, and registry viewers to facilitate investigation process. * Integrated viewer to examine .pst /.ost and .dbx e-mail files. * Utilize Perl scripts to automate investigation tasks. * Extracts EXIF information from JPEG files to identify file creators. * Automated report generation in XML format saves time, improves accuracy and compatibility. * GUI interface and integrated help function assure quick start and ease of use. * Designed to NIST Disk Imaging Tool Specification 3.1.6 to insure high quality. AccessData FTK v2.0 Guidance EnCase Forensic 6.0 ProDiscover Forensic Report for Choosing Access Datas Forensic Toolkit I think Access Datas Forensic Toolkit is the most beneficial for our lab as it provides more forensic examination features than Encase and ProDiscover. In the evidence aspects, Access Data can acquire files and folders than others. So, it can be a powerful tool when we analyze files for evidence. Moreover, it uses database to support large volume of data that can avoid application crashes, lost work and product instability for our lab. As Access Data is a GUI-based utility that can run in Windows XP, 2000, Me, or 9x operating system and it demo version has most of the same features as full-licensed version, use multi-threading to optimize CPU usage, has task scheduler to optimize time and can view and analyze data while processing takes place, it meets the requirements of our lab. What is more, it supports international language so we can retrieve data no matter which languages they are using. On top of that, it is powerful in searching, recovery, email and graphic analysis. Because of these reasons and by viewing the above forensic tools comparison chart, I can conclude that Access Datas Forensic Toolkit is the most beneficial for our lab. b) Forensic Analysis Report for â€Å"Analyzing FAT32, NTFS and CDFS file system Using Access Datas FTK† Task 4 a) MD5 hash values of bmp, doc, xls files All hash values generated by the MD5 before modification is not the same with the hash value generated after modification. b) Why hash values are same or different A hash value is a numeric value of a fixed length that uniquely identifies data. Data can be compared to a hash value to determine its integrity. Data is hashed and the hash value is stored. At a later time or after the data has been received from mail, the data is hashed again and compared to the stored hash or the hash value it was sent to determine whether the data was altered. In order to compare the hash values, the original hashed data must be encrypted or kept secret from all untrusted parties. When it compared, if the compared hashed values are the same, then the data has not been altered. If the file has been modified or corrupted, the MD5 produces different hash values. In task 4 (a), first we created a doc file with data in this file, then we generated hash values of doc file with MD5. The hash value of info.doc file is da5fd802f47c9b5bbdced35b9a1202e6. After that, we made a modification to that info.doc file and regenerate the hash values. The hash value after modifying is 01f8badd9846f32a79a5055bfe98adeb. The hash value is completely different after modifying. Then we created a cv.xls file and generated the hash value. Before modifying, the hash value is ef9bbfeec4d8e455b749447377a5e84f. After that we add one record to cv.xls file and regenerated hash values. After modifying, ccfee18e1e713cdd2fcf565298928673 hash value is produced. The hash value changed in cv.xls file after data altered. Furthermore, we created fruit.bmp file to compare the hash value before and after modification. The hash value before modifying is 8d06bdfe03df83bb3942ce71daca3888 and after modifying is 667d82f0545f0d187dfa0227ea2c7ff6. So, the hash values comparison of bmp files is completely different after data has been modified. When we encrypted the text file into each image file, the text file is not visible in the image viewing utility and each image file is like its original image file. However, the comparison of the hash values of each image file before and after inserting short messages is completely different. As each image file has been altered by inserting short message, the regenerated hash value is totally different from the original hash values. On top of that, the original image file size has been changed after inserting short messages. The raster image file has slightly increased its file size after it has been modified. The raster image file size is increased from 50.5 KB to 50.7 KB. However, of the remaining three, two image files vector and metafile have decreased its file size a little sharply. The original file size of vector is 266 KB and has been decreased to 200 KB after modified. The metafile also decreased from 313 KB to 156 KB. Only the bitmap is remains stable as its file size does not increase or decrease. In a nut shell, we can conclude that the hash value would change if the file has been modified. However, depending on the file format, the file size can increase, decrease or remain stable. d) Report for â€Å"differences of bitmap, raster, vector and metafile† A bitmap image is a computer file and it is collected with dots or pixels that form an image. The pixel of bitmap is stored like a grid, tiny square. When we use the paint program, we can see the bitmap pixel is like a block and it is draw or clear block by block. A raster image is also a collection of pixels but the image stored pixels in rows to make it easy to print. And raster image is resolution dependent. It cannot scale up to an arbitrary resolution without loss of apparent quality. This is overcome by the vector image. Vector image is made up of many individual, scalable objects. These objects are defined by mathematical equations rather than pixels, so it always render at the highest quality. There are many attributes in vector like color, fill and outline. The attributes can be changed without destroying the basic object. Metafile is a combination of raster and vector graphics, and can have the characteristics of both image types. However, if you create a metafile with raster and vector and enlarge it, the area of raster format will lose some resolution while the vector formatted area remains sharp and clear. If we have lost an image file, before doing anything, we should be familiar with the data patterns of known image file types. Then the recovery process starts. The first step in recovery is to recover fragments file from slack space and free space. The fragment file can locate the header data that is partially overwritten. So, we use Drivespy to identify possible unallocated data sets that contain the full or partial image header values. To locate and recover the image header, we need to know the absolute starting cluster and ending cluster. If not, we could collect the wrong data. Using Drivespy, we can know started cluster number and file size of image that we want to recover. To know the exact ending cluster, add the total number of clusters assigned to the starting cluster position. As we have known the size of image file, we can calculate the total number of clusters. Then, we can locate the image file and retrieve image header. After we get the header value, open the file with Microsoft Photo Viewer. If the file has been opened successfully, then recovery of image file has been completed. If not, we need to use the Hex Workshop to examine the header of the file. Task 5 Report for â€Å"Investigation that prove Naomis innocence† Before we begin tracing an email, we should know which email is illegal and what constitutes an email crime. Illegal email includes selling narcotics, extortion, sexual harassment, stalking, fraud, child abductions, and child pornography. As Jazebel has received an offensive email, so we need to access the victim computer and copy and print the offensive email to recover the evidence contained in the email. Microsoft Outlook, Outlook Express or any other GUI email programs supports for copying the email from inbox to the place that we want to by dragging the message to the storage place. When copying email, the header of the email must be included as it contains unique identifying numbers, such as IP address of the server that sent the message. This helps us when tracing the email. After copy and printing the message, we should retrieve the email header to get the sender IP address. Right click on the message and choose message options to retrieve the email header. The following shows the header information that retrieved from the mail of the victim computer. At line 1(10.140.200.11) shows the IP address of the server sending the e-mail, and provides a date and time that the offending e-mails was sent. Although when we see at line 5, the victim is seemed to be Jezebel, however, line 1 identifies that the e-mail that is sent from the IP address (10.140.200.11) is the same as the victims computer IP address. So, we can conclude that Naomi does not include in sending offensive e-mail. She is innocence and the victim, Jezebel himself, is the one who send the offensive e-mails. References: Computer Forensics Textbook http://www.computerforensicsworld.com/index.php http://www.crime-research.org/library/Forensics.htm http://ixbtlabs.com/articles/ntfs/ www.wikipedia.com Computer Forensics Investigation and Techniques Computer Forensics Investigation and Techniques Introduction I am the student of International Advanced Diploma in Computer Studies (IADCS). In this course, I have to do Compute Forensic assignment. The assignment title is â€Å"Didsbury Mobile Entertainments LTD†. This assignment helps me understanding computer forensics investigation and techniques Before this assignment, although I am interested in computer forensic, I am hardly used computer forensics toolkit or done any investigation. Because of this assignment, I have learnt many techniques how to investigate computer and done it practically. So, by doing this assignment, I have gained in practical and much valuable knowledge in Computer Forensics.nd a heartfelt thanks to all the people in Myanma Computer Company Ltd. for their warmly welcome during the period of the IADCS course and this assignment developed. Task 1 i) Report DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 10, 2010 Introduction Computer forensics involves obtaining and analyzing digital information for figuring out what happened, when it happened, how it happened and who was involved. What is more, it is use as evidence in civil, criminal, or administrative cases. Reasons for a need for computer forensic investigation Computer forensics investigation can recover thousands of deleted mails, can know when the user log into the system and what he does, can determine the motivation and intent of the user, can search keywords in a hard drive in different languages and can gain evidence against an employee that an organization wished to terminate. For these reasons, in order to know whether Jalitha has been spending her time on her friend business or not, we need a computer forensic investigation. Steps to pursue the investigation In order to pursue the investigation, I would take the following steps: 1) Secure the computer system to ensure that the equipment and data are safe 2) Find every file on the computer system, including files that are encrypted, protected by passwords, hidden or deleted, but not yet overwritten. 3) Copy all files and work on this copy files as accessing a file can alter its original value 4) Start a detailed journal with the date and time and date/information discovered 5) Collect email, DNS, and other network service logs 6) Analyze with various computer forensics tools and software 7) Print out an overall analysis 8) Evaluating the information/data recovered to determine the case Conclusion After we know the reasons and steps for investigation, then we should move on to conduct the investigation. However, we should note that the first step of investigation is critical as if the system is not secure, then the evidence or data we found may not be admissible. ii a) Report for â€Å"The procedures to make sure the evidence holds up in court† DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 12, 2010 Introduction Evidence is any physical or electronic information (such as computer log files, data, reports, hardware, disk image, etc) that is collected during a computer forensic investigation. The purpose of gathering evidence is to help determine the source of the attack, and to introduce the evidence as testimony in a court of law. Procedures to make sure the evidence holds up in court In order to make the evidence admissible in court, we need to follow the following steps: 1) Before any evidence can be gathered, a warrant must be issued so that forensic specialist has the legal authority to seize, copy and examine the data 2) Have the responsibility to ensure that the law and the principles we used are met 3) Evidence must be obtained in a manner which ensures the authenticity and validity and that no tampering had taken place 4) Tracking the chain of custody is essential for preparing evidence as it shows the evidence was collected from the system in question, and was stored and managed without alteration. 5) Extracted/ relevant evidence is properly handled and protected from later mechanical or electromagnetic damage 6) Preventing viruses from being introduced to a computer during the analysis process 7) To ensure that original evidence must be described in complete details to present reliable evidence on the court 8) Must arrange to answer reliability questions relating to the software we have used Conclusion In gathering evidence, authenticity, reliability and chain of custody are important aspects to be considered. By following the above steps, we are proper in handling the evidence holds up in court. ii b) Evidence form Didsbury Mobile Entertainments Ltd IT Department Computer Investigation Case No.: 005 Investigation Organization: Gold Star Investigator: Win Pa Pa Aye Nature of Case: Companys policy violation case Location where evidence was obtained: On suspects office desk Description of evidence: Vendor Name Model No./ Serial No. Item #1 One CD Sony Item #2 A 4GB flash memory device Kingston 05360-374.A00LF Item #3 Evidence Recovered by: Win Pa Pa Aye Date Time: 10.12.2009 10:00 AM Evidence Placed in Locker: E2419 Date Time: 15.12.2009 11:00 AM Item # Evidence Processed by Description of Evidence Date/ Time 1 Win Pa Pa Aye Fully recovered deleted email on the drive which is sent to Radasas company, including data exchange between the businesses. 13.12.2009 3:00 PM 2 Win Pa Pa Aye Encrypted document hidden inside a bitmap file. Decrypted and saved on another media. 18.12.2009 9:00 AM 3 Win Pa Pa Aye Password-protected document covering the exchange of information with her friend. Password cracked and file saved on another media. 22.12.2009 2:00 PM Task 2 Report for â€Å"the way the data is stored, boot tasks and start up tasks for Windows and Linux systems† To effectively investigate computer evidence, we must understand how the most popular operating systems work in general and how they store files in particular. The type of file system an operating system uses determines how data is stored on the disk. The file system is the general name given to the logical structures and software routines used to control access to the storage on a hard disk system and it is usually related to an operating system. To know the way the data is stored in Windows XP and Linux, we need to get into file systems of Windows and Linux. The way the data is stored in Windows XP In Windows XP, although it supports several different file systems, NTFS is the primary file system for Windows XP. So, we will have a look in NTFS as the NTFS system offers better performance and features than a FAT16 and FAT 32 system. NTFS divides all useful places into clusters and supports almost all sizes of clusters from 512 bytes up to 64 Kbytes. And NTFS disk is symbolically divided into two parts MFT (Master File Table) area and files storage area. The MFT consumes about 12% of the disk and contains information about all files located on the disk. This includes the system file used by the operating system. MFT is divided into records of the fixed size (usually 1 Kbytes), and each record corresponds to some file. Records within the MFT are referred to as meta-data and the first 16 records are reserved for system files. For reliability, the first three records of MFT file is copied and stored exactly in the middle of the disk and the remaining can be stored anyplace of the disk. The remaining 88% of disk space is for file storage. Below is the partition structure of NTFS system. After we know the file system of Windows XP, then we will move on to the file system of Linux. The way the data is stored in Linux When it comes to Linux file system, ext2 has been the default file system as it main advantages is its speed and extremely robust. However, there is a risk of data loss when sudden crashes occur and take long time to recover. Sometimes the recovery may also end up with corrupt files. By using the advantage of ext2 and add some data loss protection and recovery speed led to the development of journaling file system ext3 and ReiserFs. Though ext2, ext3 and ReiserFs are the most popular file system, there are also some other file system used in the Linux world such as JSF and XFS. As Linux views all file systems from the perspective of a common set of objects, there are four objects superblock, inode, dentry and file. The superblock is a structure that represents a file system which includes vital information about the system. Moreover, it includes the file system name (such as ext2), the size of the file system and its state, a reference to the block device, and meta-data information. It also keeps track of all the nodes. Linux keeps multiple copies of the superblock in various locations on the disk to prevent losing such vital information. Every object that is managed within a file system (file or directory) is represented in Linux as an inode. The inode contains all the meta-data to manage objects in the file system. Another set of structures, called dentries, is used to translate between names and inodes, for which a directory cache exists to keep the most-recently used around. The dentry also maintains relationships between directories and files for traversing file systems. Finally, a VFS (Virtual file system) file represents an open file (keeps state for the open file such as the write offset, and so on). While the majority of the file system code exists in the kernel (except for user-space file systems), (2.3) shows the Linux file system from the point of view of high-level architecture and the relationships between the major file system-related components in both user space and the kernel. The boot task and start up task of Windows XP A good understanding of what happens to disk data at startup is also an important aspect as accessing to a computer system after it was used for illicit reasons can alter the disk evidence. First, we will discuss about the Windows XP startup and boot process, and then shift into the startup and boot process of Linux. Like any other PC system, Windows XP startup by running the POST test, performing an initialization of its intelligent system devices, and performing a system boot process. The boot process begins when the BIOS starts looking through the system for a master boot record (MBR). This record can reside on drive C: or at any other location in the system. When the BIOS execute the master boot record on the hard drive, the MBR examines the disks partition table to locate the active partition. The boot process then moves to the boot sector of that partition located in the first sector of the active partition. There, it finds the code to begin loading the Secondary Bootstrap Loader from the root directory of the boot drive. In NTFS partition, the bootstrap loader is named NTLDR and is responsible for loading XP operation system into memory. When the system is powered on, NTLDR reads the Boot.ini file. If boot.ini contains more than one operating system entry, a boot menu is displayed to the user, allowing the user to choose which operating system is to be loaded. Fig (2.4) shows Boot.ini contains two operating systems and allows user to choose. After the user has selected the desired mode to boot to, NTLDR runs Ntoskrnl.exe and reads Bootvid.dll, Hal.dll and the startup device drivers. After the file system driver has loaded, control is then passed from NTLDR to the kernel. At this time, Windows XP display Windows logo. Virtually, all applications we installed using the default installation decide that they should start up when windows starts. Under â€Å"Startup† tab in the system configuration utility, a list of programs that run when our system boots is listed. Fig (2.6) shows the listed program when our system boots. The boot task and start up task of Linux After we have get into the start up process of Windows XP, we will then shift into the startup process of Linux. In Linux, the flow of control during a boot is also from BIOS, to boot loader, to kernel. When you turn on the power, the BIOS perform hardware-platform specific startup tasks. Once the hardware is recognized and started correctly, the BIOS loads and executes the partition boot code from the designated boot device, which contains Linux boot loader. Linux Loader (LILO) is the Linux utility that initiates the boot process, which usually runs from the disks MBR. LILO is a boot manager that allows you to start Linux or other operating systems, including Windows. If a system has two or more operating systems, LILO gives a prompt asking which operating system the user wishes to initialize. When the user chooses the boot option, it then loads the choosing operating system into memory. The boot program, in turn, reads the kernel into memory. When the kernel is loaded, the boot program transfers control of the boot process to the kernel. The kernel then performs the majority of system setup (memory management, device initialization) before spawning separately, the idle process and scheduler and the init process which is executed in user space. The scheduler takes control of the system management. The init process executes scripts as needed that set up all non-operating system services and structures in order to allow a user environment to be created, and then presents the user with a login screen. We have described about the way the data stored, the boot task and startup task of Windows XP and Linux. After a thorough study of these areas, we can acquire or handle the evidence properly. Task 3 a) Features comparison of â€Å"EnCase, Access Datas Forensic and ProDiscover† Features of Guidance EnCase Forensic * In courts worldwide, forensically acquire data in a sound manner using software with an unparallel record * Using a single tool and investigate and analyze multiple platforms * With prebuilt EnScript ® modules such as initialized Case and Event Log analysis, it can automate complex and routine tasks, so it save time in analyzing * Find information despite efforts to hide, cloak or delete * Can easily handle large volumes of computer evidence, view all relevant files that includes deleted files, file slack and unallocated space * Directly transfer evidence files to law enforcement or legal representatives as necessary * Include review options that allow non-investigators to review evidence easily * Include report options that enable quick report preparation Features of Access Datas Forensic Toolkit * Provides integrated solution that is no need to purchase multiple tools to complete a case. * Provides integrated database that avoid application crashes, lost work and product instability. * Identify encrypted files automatically from more than 80 applications and crack those files. * Supports international language that allows us easily search and view foreign-language data in our native format * Include email analysis that can recover and analyze a wide range of email and web mail formats * Can generate different industry-standard report formats quickly and concisely * Collect key information from the registry that include user information, date of application installed, hardware, time zone and recently used information * While processing takes place, we can view and analyze data Features of ProDiscover * To keep original evidence safe, it create bit-stream copy of disk for analyzing that includes hidden HPA section * For complete disk forensic analysis, it search files or entire disk including slack space, HPA section and Windows NT/2000/XP alternate data streams * Without alter data on the disk, it can preview all files including metadata and hidden or deleted files * Support for VMware to run a captured image. * In order to ensure nothing is hidden, it examine data at the file or cluster level * To prove data integrity, it can generate and record MD5, SHA1 and SHA256 hashes automatically. * Examine FAT12, FAT16, FAT 32 and all NTFS file systems including Dynamic Disk and Software RAID for maximum flexibility. * Examine Sun Solaris UFS file system and Linux ext2 / ext3 file systems. * Integrated thumbnail graphics, internet history, event log file, and registry viewers to facilitate investigation process. * Integrated viewer to examine .pst /.ost and .dbx e-mail files. * Utilize Perl scripts to automate investigation tasks. * Extracts EXIF information from JPEG files to identify file creators. * Automated report generation in XML format saves time, improves accuracy and compatibility. * GUI interface and integrated help function assure quick start and ease of use. * Designed to NIST Disk Imaging Tool Specification 3.1.6 to insure high quality. AccessData FTK v2.0 Guidance EnCase Forensic 6.0 ProDiscover Forensic Report for Choosing Access Datas Forensic Toolkit I think Access Datas Forensic Toolkit is the most beneficial for our lab as it provides more forensic examination features than Encase and ProDiscover. In the evidence aspects, Access Data can acquire files and folders than others. So, it can be a powerful tool when we analyze files for evidence. Moreover, it uses database to support large volume of data that can avoid application crashes, lost work and product instability for our lab. As Access Data is a GUI-based utility that can run in Windows XP, 2000, Me, or 9x operating system and it demo version has most of the same features as full-licensed version, use multi-threading to optimize CPU usage, has task scheduler to optimize time and can view and analyze data while processing takes place, it meets the requirements of our lab. What is more, it supports international language so we can retrieve data no matter which languages they are using. On top of that, it is powerful in searching, recovery, email and graphic analysis. Because of these reasons and by viewing the above forensic tools comparison chart, I can conclude that Access Datas Forensic Toolkit is the most beneficial for our lab. b) Forensic Analysis Report for â€Å"Analyzing FAT32, NTFS and CDFS file system Using Access Datas FTK† Task 4 a) MD5 hash values of bmp, doc, xls files All hash values generated by the MD5 before modification is not the same with the hash value generated after modification. b) Why hash values are same or different A hash value is a numeric value of a fixed length that uniquely identifies data. Data can be compared to a hash value to determine its integrity. Data is hashed and the hash value is stored. At a later time or after the data has been received from mail, the data is hashed again and compared to the stored hash or the hash value it was sent to determine whether the data was altered. In order to compare the hash values, the original hashed data must be encrypted or kept secret from all untrusted parties. When it compared, if the compared hashed values are the same, then the data has not been altered. If the file has been modified or corrupted, the MD5 produces different hash values. In task 4 (a), first we created a doc file with data in this file, then we generated hash values of doc file with MD5. The hash value of info.doc file is da5fd802f47c9b5bbdced35b9a1202e6. After that, we made a modification to that info.doc file and regenerate the hash values. The hash value after modifying is 01f8badd9846f32a79a5055bfe98adeb. The hash value is completely different after modifying. Then we created a cv.xls file and generated the hash value. Before modifying, the hash value is ef9bbfeec4d8e455b749447377a5e84f. After that we add one record to cv.xls file and regenerated hash values. After modifying, ccfee18e1e713cdd2fcf565298928673 hash value is produced. The hash value changed in cv.xls file after data altered. Furthermore, we created fruit.bmp file to compare the hash value before and after modification. The hash value before modifying is 8d06bdfe03df83bb3942ce71daca3888 and after modifying is 667d82f0545f0d187dfa0227ea2c7ff6. So, the hash values comparison of bmp files is completely different after data has been modified. When we encrypted the text file into each image file, the text file is not visible in the image viewing utility and each image file is like its original image file. However, the comparison of the hash values of each image file before and after inserting short messages is completely different. As each image file has been altered by inserting short message, the regenerated hash value is totally different from the original hash values. On top of that, the original image file size has been changed after inserting short messages. The raster image file has slightly increased its file size after it has been modified. The raster image file size is increased from 50.5 KB to 50.7 KB. However, of the remaining three, two image files vector and metafile have decreased its file size a little sharply. The original file size of vector is 266 KB and has been decreased to 200 KB after modified. The metafile also decreased from 313 KB to 156 KB. Only the bitmap is remains stable as its file size does not increase or decrease. In a nut shell, we can conclude that the hash value would change if the file has been modified. However, depending on the file format, the file size can increase, decrease or remain stable. d) Report for â€Å"differences of bitmap, raster, vector and metafile† A bitmap image is a computer file and it is collected with dots or pixels that form an image. The pixel of bitmap is stored like a grid, tiny square. When we use the paint program, we can see the bitmap pixel is like a block and it is draw or clear block by block. A raster image is also a collection of pixels but the image stored pixels in rows to make it easy to print. And raster image is resolution dependent. It cannot scale up to an arbitrary resolution without loss of apparent quality. This is overcome by the vector image. Vector image is made up of many individual, scalable objects. These objects are defined by mathematical equations rather than pixels, so it always render at the highest quality. There are many attributes in vector like color, fill and outline. The attributes can be changed without destroying the basic object. Metafile is a combination of raster and vector graphics, and can have the characteristics of both image types. However, if you create a metafile with raster and vector and enlarge it, the area of raster format will lose some resolution while the vector formatted area remains sharp and clear. If we have lost an image file, before doing anything, we should be familiar with the data patterns of known image file types. Then the recovery process starts. The first step in recovery is to recover fragments file from slack space and free space. The fragment file can locate the header data that is partially overwritten. So, we use Drivespy to identify possible unallocated data sets that contain the full or partial image header values. To locate and recover the image header, we need to know the absolute starting cluster and ending cluster. If not, we could collect the wrong data. Using Drivespy, we can know started cluster number and file size of image that we want to recover. To know the exact ending cluster, add the total number of clusters assigned to the starting cluster position. As we have known the size of image file, we can calculate the total number of clusters. Then, we can locate the image file and retrieve image header. After we get the header value, open the file with Microsoft Photo Viewer. If the file has been opened successfully, then recovery of image file has been completed. If not, we need to use the Hex Workshop to examine the header of the file. Task 5 Report for â€Å"Investigation that prove Naomis innocence† Before we begin tracing an email, we should know which email is illegal and what constitutes an email crime. Illegal email includes selling narcotics, extortion, sexual harassment, stalking, fraud, child abductions, and child pornography. As Jazebel has received an offensive email, so we need to access the victim computer and copy and print the offensive email to recover the evidence contained in the email. Microsoft Outlook, Outlook Express or any other GUI email programs supports for copying the email from inbox to the place that we want to by dragging the message to the storage place. When copying email, the header of the email must be included as it contains unique identifying numbers, such as IP address of the server that sent the message. This helps us when tracing the email. After copy and printing the message, we should retrieve the email header to get the sender IP address. Right click on the message and choose message options to retrieve the email header. The following shows the header information that retrieved from the mail of the victim computer. At line 1(10.140.200.11) shows the IP address of the server sending the e-mail, and provides a date and time that the offending e-mails was sent. Although when we see at line 5, the victim is seemed to be Jezebel, however, line 1 identifies that the e-mail that is sent from the IP address (10.140.200.11) is the same as the victims computer IP address. So, we can conclude that Naomi does not include in sending offensive e-mail. She is innocence and the victim, Jezebel himself, is the one who send the offensive e-mails. References: Computer Forensics Textbook http://www.computerforensicsworld.com/index.php http://www.crime-research.org/library/Forensics.htm http://ixbtlabs.com/articles/ntfs/ www.wikipedia.com