Study of motivation Essay Example | Topics and Well Written Essays - 500 words

Study of motivation - Essay Example Achievement motivated people are mainly impressed by the opportunity to reach their goals. A sense of accomplishment satisfies them and they are pleased by their goals completion. Authority motivated people like being controlled and they feel safe in their subjective positions. Affiliation motivated group of people are fond of being involved in interaction with other people. This group of people performs perfectly in a team environment. Thus, McClelland approach to motivation can be justified, because he underlines the importance of group cooperation and subjection of an individual to the social factors and not only individual concerns. Cognitive approach and relation of motivation to human conscience is one of the popular interpretations of the nature of motivation. On the basis of a substantial body of experimental evidence the extrinsic motivation (contingent rewards) can be opposed to intrinsic motivation (when the individual wants to perform the task for himself. Cognitive Evaluation Theory (CET) describes underlying intrinsic motivation as the option for competence and self-determination. Rewards are external factors which influence motivation (Motivation Today). On the one hand, we can claim that an individual is motivated if he obtains something from the environment and in such a way he defines his further motivated behavior. On the other hand, an individual can rely more on his inner triggers of motivation and remain indifferent to external rewards. It depends on a human nature and his goal-orientation. Goal setting theory is based on the following principle: one can work hard to reach ones goal and it is necessary to define clear goals otherwise general and vague goals would be misleading. People should have a good stimulus. Employees motivation if based on this goal can lead to positive results. In case they can complete their works effectively

Baz Luhrmann’s Romeo and Juliet Essay Example for Free

Baz Luhrmann’s Romeo and Juliet Essay Being a virgin viewer of Baz Luhrmann’s Romeo and Juliet, I found myself dissatisfied as I began to see the famous balcony scene reveal itself on the courtyard floor. â€Å"Where is the barrier, the ‘stony limits’ that separates the lovers from each other?† I inquired. How could the most renowned scene of William Shakespeare’s most popular play be missing? I continued to watch in astonishment as the daring scene developed into a masterpiece. Baz Luhrmann and Franco Zeffirelli both achieved unique interpretations of William Shakespeare’s script which accomplish the chief goal of displaying the extremely passionate love between Romeo and Juliet. The movies were made twenty-nine years apart and had many specific and not so obvious differences between them including the setting, script, and camera work that are significant to accomplishing the two director’s diverse objectives for the films. The most noticeable difference found between the balcony scenes of the two movies is the different settings. There actually is a balcony in Luhrmann’s version, but it is much smaller and is only used for a brief instant in the scene. Romeo climbs to the top of the balcony in both versions, but in Luhrmann’s film, to his surprise, he finds an ugly nurse instead of the attractive Juliet. This comedic moment is essential for distracting the audience from their predictions. The Capulet mansions are both astounding and enormous but bestow different emotions. The mansion in Zeffirelli’s Romeo and Juliet is very castle-like with towering stone walls surrounded by trees, and a large balcony. This plain and simple appearance is important because the focus of the scene is on the two young lovers and the stony limits that separate them. Luhrmann’s film has a very luxurious and romantic looking set that captures the viewers’ attention from the start. The scene is more colorful with white sparkling lights, statues, ivy, and most importantly, a brightly lit up blue swimming pool. The water provides a perfect medium for Romeo and Juliet as they confess their love for each other. The water does not on ly serve symbolic importance but provides a modern obstacle between Romeo and Juliet that can be compared to the balcony. Although the viscous water acts as a barrier, the pool scene involves much more contact between the lovers than Zefferelli’s balcony scene. Light piano music fills the air instead of the louder rock music that is found throughout the film. In both versions, Juliet is clothed in all white, portraying her innocence. Zefferelli’s set resembles the setting William Shakespeare describes in his script, while Luhrmann modernizes the setting and translates script to appeal to today’s generations. Shakespeare wrote his plays in a Victorian language that is not especially familiar to most people today. Zefferelli was quite aware of this, but made very few adjustments to the script. His play targets people who already know the story of Romeo and Juliet. Zefferelli takes advantage of the opportunities film offers by using technology to create realism, background music, props, and backgrounds to aid in the comprehension of the balcony scene of this romantic tragedy. On the other hand, Baz Luhrmann cuts the original script from 190 lines to 100 lines. He also adds occasional words to enable a smooth flowing dialogue. He maintains Shakespeare’s Victorian language because of the ingenious poetry and rhythm it has that flows like music to one’s ears. Luhrmann eliminates a lot of the difficult and time-consuming language as well as lines that do not pertain to his modernized setting. For example, lines 70-182 of Act III, Scene II are eliminated, in which Juliet calls Romeo back then forgets why she did so. Luhrmann’s adjustments to the script allow for a more easy translation of Shakespeare’s language. In addition to the changes in the script, the scene can be comprehended strictly by viewing the moving picture due to the careful selection of costumes, the use of body language, the romantic setting, and the camera technique. The camera work during the balcony scene of both films is very strategically planed to give the viewers a much more personal experience than that of the stage. Zeffirelli’s scene makes use of the long balcony as the camera pans along it continuously, not allowing the eyes to rest. This keeps the viewers involved in the film while close ups are used to show the passionate emotions of the lovers. In Baz Luhrmann’s version of the scene, the camera is not as active as one might imagine. The scene begins with long shots and as it develops, the camera moves in to extreme close-ups to show every detail of the lovers’ expressions. The camera gives the viewers an intimate relationship as it moves slowly and more closely to the actors in contrast to the chaotic camera movement in other scenes. The quantity of editing used in Baz Luhrmann’s scene is significantly reduced when compared to the editing in other parts of his film. The editing pace goes from every couple seconds per shot to about twenty seconds per shot. The length of shots in Zeffirelli’s scene is even longer. Also, Zeffirelli’s scene uses slight high-angle shots on Juliet that gives the effect that Juliet is in a more superior position than Romeo. In Luhrmann’s film the lovers remain level with each other throughout most of the scene, giving a sense of equality. Both filming techniques used in the two versions were very effective in creating the close relationship between Romeo and Juliet as they reunite for the second time. The power and passion of love found within the balcony and pool scenes of the different films is one that leaves an everlasting impression in the hearts and minds of the viewers. Although interpreted very differently by two brilliant directors, the scenes both relay Shakespeare’s message. Baz Luhrmann did so in a way that transformed the play from Shakespearian times to the youth of the twentieth century. He used state of the art technology, familiar actors, a modernized setting, and adjustments to the actual script to translate Shakespeare’s play into modern times. On the other hand, Franco Zeffirelli attempted to make his film as much like Shakespeare’s play as possible. He used film to his advantage to provide a closer experience than that of the stage, but few changes to the actual script and setting were made. He wanted to reflect the play to the best of his ability to the screen. Baz Luhrmann’s objective was to bring Shakespeare’s Romeo and Juliet to the homes of people around the world. Both films were successful in achieving their goals, but were very unique because of the differences in the setting, script, and camera work. Works Cited â€Å"Imagery in Luhrmanns Romeo + Juliet.† American Film Institute. 1 Feb. 2005 http://www.fathom.com/course/28701907/session4.html. Marks, Margaret. â€Å"Brand New Old Stuff.† 1 Feb. 2005 . Romeo and Juliet. Dir. Franco Zeffirelli. Perf. Olivia Hussey and Leonard Whiting. Paramount Pictures, 1968. William Shakespeare’s Romeo and Juliet. Dir. Baz Luhrmann. Perf. Leonardo DiCaprio and Claire Danes. Twentieth Century Fox, 1997.

Participative Management Essays -- essays research papers fc

Participative management is a new approach in the work force today. Job enrichment, quality circles, and self-managing work teams are just some of the approaches. Companies share a common goal of increasing employee involvement. They want to raise the quality, performance, and productivity of their workers.   Ã‚  Ã‚  Ã‚  Ã‚  The questions that follow will be answered in this paper. What is participative management? What are the advantages of participative management? How does it raise quality, productivity, and performance? How can it be successfully started, implemented, and sustained? What are the results of experiments done in the work force? Participative management is a process by which a company attempts to increase the potential of its employees by involving them in decisions affecting their work lives. A distinguishing characteristic of the process is that its goals are not simply acquired, they focus on the improvement of productivity and efficiency, but they are also fulfilling and self-enhancing in themselves. The key goals of employee involvement programs is to enhance the quality of the employees’ working life, management must be responsive to the requests of the employees. The best way to ascertain those requests is to ask employees.   Ã‚  Ã‚  Ã‚  Ã‚  If workers can be motivated and given the opportunity to participate in the search for improved methods of job performance, and if this motivation and participation can be maintained over time, job performance should improve. Productivity is higher in companies with an organized program of worker participation. Employee participation can and does raise productivity. The most appropriate form will vary from company to company but participation works only when both parties want it to work. The solution to America’s pathetic productivity growth isn’t necessarily more capital spending (Lewis & Renn, 1992). People tend to accomplish what they decide they want to accomplish. Ideas, changes, suggestions and recommendations that are generated by the people who implement them stand a much greater chance of being successfully implemented. In theory, people who have a hand in making a decision are better motivated to execute it. Participation can improve the quality of decision making. Participative management appears to offer tremendous advantages... ...rcles, gainsharing, and self-managing teams because they are trying to change the entire organization, not just a few plants or a few practices (Lawler, 1986). The work place of the future will require greater emphasis on such key human resource factors as participative management, training programs, and teamwork. Employee involvement and participative initiatives are likely to expand considerably over the next several years in United States businesses. If they are to remain competitive in the marketplace and survive with the intense overseas challenges awaiting them, worker involvement and these initiatives must be present. Bibliography Lawler III, E. (1986). High-Involvement Management. San Francisco: Jossey-Bass Inc., Publishers. Lewis, J. & Renn, L. (1992). How To Start A Participative Management Program: Ten Easy Steps. Interlochen: Lewis & Renn Associates, Inc. Schuller, T. (1985). Democracy at Work. Oxford: Oxford University Press. Sirianni, C. (1987). Worker Participation and the Politics of Reform. Philadelphia: Temple University Press. Warner, M. (1984). Organizations and Experiments: Designing New Ways of Managing Work. New York: John Wiley & Sons.

A Comparison and Contrast of Ideas of Beauty

It has often been said that â€Å"beauty is in the eye of the beholder.† This may well be true, but many people, particularly women, have trouble seeing their own beauty, especially when they do not look just like everyone else.The three short stories that were assigned, â€Å"Beauty: When The Other Dancer Is The Self,† by Alice Walker, â€Å"Mirrors,† by Lucy Grealy, and â€Å"The Story of My Body,† by Judith Ortiz Cofer, all share the same premise. In each story, each young woman is faced with trials due to the way they look. The way that they choose to deal with these trials, however, is different for each one.â€Å"Beauty: When The Other Dancer Is The Self† is the story of Alice Walker’s life as a child. She thrived on being considered cute and â€Å"sassy.† At one point in the story, she even mentions that she was fond of staring at people, just so they would notice her and how beautiful she was. Unfortunately, all that changed wh en she was accidently shot in the eye with a BB pellet.She lost sight in that eye, and the eye formed a large white cataract that people would stare at and comment on. Walker refused to look anyone in the eye for years. She became extremely uncomfortable with the idea that she was no longer beautiful in the traditional sense, and her social and scholastic abilities suffered for it. When she was older, she had the chance to have the cataract removed, and nothing but a blue scar remained.This did wonders for her confidence, until she had a child of her own. She worried about what the child might think of her blind eye, but a television show featuring a blue globe gave the child the idea that her mother had a world in her eye. To the child, this was a wonderful thing. Walker, gaining acceptance from her child, was able to finally accept herself.â€Å"Mirrors,† by Lucy Grealy, is the story of the author’s battle with cancer of the jaw and the disfiguration it caused. Greal y was young when she had to have part of her jaw removed, so along with the normal trials of growing up, she was forced to deal with the pain of chemotherapy and the stares and taunts of insensitive children and adults.When the reconstruction of her face failed time after time, she gave up looking into mirrors. In fact, she avoided any shiny surface. She stayed in the library most of the time, reading books about the Holocaust and other dreadful times in history to make her pain seem less significant. When she finally had a chance to have work done on her face overseas, she jumped at the chance.She seemed to think that having a â€Å"perfect† face would solve all of her problems. Instead, the surgeries caused new problems. She had to have work done on the healthy side of her face to make a match, and she ended up looking nothing like what she thought she would. Not being able to reconcile with her new face, she ignored mirrors for a whole year. However, at the end of her stor y, she encountered a man who made her feel good about herself. Finally, she had the acceptance she needed to peak at her reflection in a window.â€Å"The Story of my Body,† by Judith Ortiz Cofer, tells the tale of what is was like for the young Cofer to grow up Puerto Rican. In her own society she was considered light skinned and tall. When she moved to the United States, she was considered dark and short. This instant change in the way people perceived her was very hard for the child to take.She got to the point where she no longer wanted to look at herself. She was an outcast at school, so much so that her parents had to send her to live with her grandparents in order to attend a different school. Unfortunately, things weren’t much better for her there. She was bone-thin at the age where most teenagers start to blossom.She was also considered â€Å"dirty† by white people, and was unable to date the boy she loved because his parents would not allow him to date a â€Å"dark† girl. However, Cofer excelled in school. It was the one thing that she could do right. When her good grades got her into college, she was in a different world where people found her â€Å"exotic† and beautiful. Being accepted came, oddly enough, by being different.These three stories have much in common. For instance, all three women gave up looking at themselves for various amounts of time. Being told that they were â€Å"ugly† and â€Å"dirty† took a toll on each one’s self esteem. Each woman had a physical problem. Walker had a discolored, blind eye, Grealy had a terribly disfigured face, and Cofer, along with being the exact opposite of the standards for beauty, had chicken pox scars all over her face.All of these reasons, although they vary in severity, were more than enough reason to make a young woman want to hang her head. No one ever said that the teenage and young adult years were easy, anyway. Perhaps the most important thi ng that they all had in common was the need for something to better their perceptions of themselves. For Walker, it was her child. Once she had acceptance from her little one, she was free to face the world.For Grealy, it was having lunch with a man who did not seem disgusted or turned off by her deformities. His attitude towards her was enough to make her want to see what he saw in her. For Cofer, it was excelling in school and making it to college. There she found people who didn’t care if she was different, and some that actually seemed to like her better because she was different. She could finally think of herself as pretty again.The stories also have some contrasting themes. The types of suffering experienced by the women were vastly different. Although one can emphasize with Cofer over being picked last in gym and looking different, her suffering was much less than Grealy’s loss of a portion of her face or Walker’s loss of sight. The way that each woman o vercame her difficulties is also different. Cofer used her smarts and her mental ability to rise above those who tortured her. Walker was partially freed by having her cataract removed in order to look more â€Å"normal.†However, Grealy turned her back on her femininity for a while and withdrew into books, not wanting to accept the fact that she lived in the real world. She was perked up by the man mentioned above, but she fell into a sad life of drug addiction and eventual suicide. This is perhaps the largest contrast. While Walker and Cofer found their beauty, Grealy apparently never did.In conclusion, these three stories have a lot to teach us about our reaction to suffering. We should not hide ourselves away from the world because of our problems, but neither should we cause other people to want to hide away because of our stares and comments. Beauty is subjective. Magazines and movies would have us believe that only one kind of beauty is acceptable, but that is not the c ase.People who rise from adversity are often left with beautiful souls, and that is what we should look for in a person. All these women mentioned were beautiful because they persevered, and it is a shame that Grealy could not come to see herself in that light. If nothing else, these stories should show the reader that beauty really is in the eye of the beholder, and we should never do or say anything to steal another person’s beauty from them.

Discuss the contribution that psychology has made to contemporary society

Since Psychology has been known as a subject, it is very broad, and has contributed to many areas of society to the work place, school, prison and institutions. In the work place, managers are trained to deal and communicate effectively with employees and customers alike. This helps to keep both parties happy, and this causes less distress. Most work places are under law in which even people with mental health issues are allowed to be employed, and only in severe cases they will be unaccepted to the job. An occupational psychologist is able to find a job for those who are disabled and that would be able to meet their skills and knowledge. A couple of centuries ago, people who had mental illnesses wouldn't be able to get a job, and are likely to be distinguished as ‘insane' or ‘crazy', because of the lack of help that was given at that time. In the school, the National Curriculum has been helped by the research of Psychology by the reflection of Piaget's stages – showing that children are likely to cope with ideas when they are ready or at a given age. For example, those children who are at the concrete operation stage at age 11 should not be given anything to do with formal reasoning. Although, Vygotsky believed in scaffolding, this means by actively participating in groups to their level of understanding to be able to make them understand what they are being taught better. In prison, they use token economy systems which is based on operant conditioning for those who have good behaviour they are reinforced with tokens, and these can be saved up to be able to have a privileges to go out. The token economy system allow for prisoners to continue their repeated good behaviour. During court sessions they need to know whether someone is classified as insane, and whether they should go to psychiatric hospital or ward, or to prison because they are a criminal. In institutions, they also use the operant conditioning of token economy systems to be able to have the patients do good behaviour and to be reinforced with tokens. This allows to substitute the tokens to be able to have leave or be able to do more activities within the institution. Institutions also have social skills to help those with mental health issues to be able to understand how to make social interactions with other people – many of both offenders as well as patients lack these skills, and these can be developed through number of ways such as role play and rehearsal.

f example apple Essay

f example apple Essay f example apple Essay Apple launched its new generation tablet the iPad Air today, describing it as a giant leap forward. The new device is slimmer, lighter, faster and more powerful than the previous model, the computing giant announced. It weighs 1lb, compared to 1.4lb of the iPad 4, and is 7.5mm thin compared to 9.4mm - making it 20% thinner. There is also 43% smaller bezel around the edge of the screen. The iPad Air will be available on November 1 in the UK and many other countries around the world. Apple also unveiled a new iPad mini with a retina display, which will be available later in November. They will both come in silver/white and grey/black versions. Speaking at the Yerba Buena Centre in San Francisco, Apple CEO Tim Cook said: "I couldn't be prouder of both new iPads." He said he could not think of another product that had come so far, so fast, adding: "We want to help our customers create even more amazing stories, because we know this is just the beginning for iPad, and so we've been busy working on the next generation of iPad." Phil Schiller, senior vice president of worldwide marketing described it as a "screaming fast iPad", with faster graphics and wifi access. He described the iPad Air as "a whole new generation" and added: "This is probably our biggest leap forward." The iPad Air will cost from  £399, including VAT, the price for the 16GB WiFi model. The price increases to  £479 for the 32GB model,  £559 for 64GB and  £639 for 128GB. The WiFi Cellular versions will be  £100 more expensive in each case. It will be the lightest full-sized tablet in the world, according to Apple. "When you hold it, it will be a dramatically different experience," said Mr Schiller. He said every possible hundredth of an inch had been shaved off to make it so thin. "To make an iPad this thin took a huge amount of work, over years," he added. "The first time you pick it up and feel it yourself, you will understand why we're so excited about it." It has a 9.7 inch retina display and an A7 chip inside, with over a billion transistors. It offers a twofold increase in rendering, is twice as fast at opening files and has double the graphics performance of the iPad 4. Other key features include a new FaceTime HD camera and dual microphones. The iPad Air will have the same 10-hour battery life as its predecessor. The new iPad mini costs from  £319, for the WiFi 16GB version, rising to  £399 for 32GB,  £479 for 64GB and  £559 for 128GB. Again, the cost for the WiFi cellular version is  £100 extra in each case. The new version of the iPad mini has the same 2048x1536 pixels of the iPad Air and the same apps will run on each. It is also powered by the A7 chip, which Mr Schiller described as "a big jump in performance". It will be up to four times faster at graphics than the first generation model. It will also have double the WiFi speed and expanded support for broadband wireless networks, like the iPad Air. The cost of the original iPad mini has been lowered to a starting price of  £249 for the 16GB version, with the cost  £349 for the WiFi cellular model. Mr Schiller said this was the lowest price ever. The iPad 2 will now cost  £329 for WiFi with 16GB, and  £429 with 3G. A range of new covers and cases for

Free Essays on Seeds Of Nationalism In Colonial Dutch East Indies

I’d like to start this paper by saying that I loved This Earth of Mankind, both for the story line and for the history lessons it contained. I now own the rest of the quartet and am half way through Child of All Nation. This Earth of Mankind addressed the struggle between the Javan native with oppressive colonial rule as well as the search for a new national identity by educated Javans. I thought that Pramoedya was successful in presenting the interrelated themes of social, cultural, and political life in the Dutch East Indies. He described the struggles of two different types of Native Javanese. Minke’s struggle was against himself and integration into, and identification with colonial civilization. Nyai’s struggle the brutalizing effects of Western civilization in her life. In the story the two struggles come together and both Minke and Nyai challenge the inhumanity of colonial justice. The introduction of modernity was having a profound effect in the Dutch East Indies at the time of Minke’s story. This modernity manifested itself through advanced learning, science, and technological advances. Minke considered his opportunity to experience modern learning and science a blessing whose beauty was beyond description. He was the only Native in the Dutch High School (H.B.S.) in Surabaya. Minke’s life was put on a path other than those of his fellow natives through this science and learning he had been taught at school. He knew that this made him different from his own people, the Javanese. Minke marveled at the wonders of science that he saw in his life all around him. He was particularly amazed at the development of printing, especially zincography. For the first time in history, someone like Minke could experience the rest of the world simply through looking at a photograph. On Java, trains had been introduced ten years before, but still his countrymen marveled. At the time of the story, a railroad networ... Free Essays on Seeds Of Nationalism In Colonial Dutch East Indies Free Essays on Seeds Of Nationalism In Colonial Dutch East Indies I’d like to start this paper by saying that I loved This Earth of Mankind, both for the story line and for the history lessons it contained. I now own the rest of the quartet and am half way through Child of All Nation. This Earth of Mankind addressed the struggle between the Javan native with oppressive colonial rule as well as the search for a new national identity by educated Javans. I thought that Pramoedya was successful in presenting the interrelated themes of social, cultural, and political life in the Dutch East Indies. He described the struggles of two different types of Native Javanese. Minke’s struggle was against himself and integration into, and identification with colonial civilization. Nyai’s struggle the brutalizing effects of Western civilization in her life. In the story the two struggles come together and both Minke and Nyai challenge the inhumanity of colonial justice. The introduction of modernity was having a profound effect in the Dutch East Indies at the time of Minke’s story. This modernity manifested itself through advanced learning, science, and technological advances. Minke considered his opportunity to experience modern learning and science a blessing whose beauty was beyond description. He was the only Native in the Dutch High School (H.B.S.) in Surabaya. Minke’s life was put on a path other than those of his fellow natives through this science and learning he had been taught at school. He knew that this made him different from his own people, the Javanese. Minke marveled at the wonders of science that he saw in his life all around him. He was particularly amazed at the development of printing, especially zincography. For the first time in history, someone like Minke could experience the rest of the world simply through looking at a photograph. On Java, trains had been introduced ten years before, but still his countrymen marveled. At the time of the story, a railroad networ...

Biography of Elizabeth of York, Queen of England

Biography of Elizabeth of York, Queen of England Elizabeth of York (February 11, 1466–February 11, 1503) was a key figure in Tudor history and in the Wars of the Roses. She was the daughter of Edward IV and Elizabeth Woodville; Queen of England and Queen Consort of Henry VII; and the mother of Henry VIII, Mary  Tudor, and Margaret Tudor, the only woman in history to have been daughter, sister, niece, wife, and mother to English kings. Fast Facts: Elizabeth of York Known For: Queen of England, mother of Henry VIIIBorn: February 11, 1466 in London, EnglandParents: Edward IV and Elizabeth WoodvilleDied:  February 11, 1503 in London, EnglandEducation: Trained in the palace as a future QueenSpouse: Henry VII  (m. January 18, 1486)Children: Arthur, Prince of Wales (September 20, 1486–April 2, 1502); Margaret Tudor (November 28, 1489–October 18, 1541) who married King James IV of Scotland); Henry VIII, King of England (June 18, 1491–January 28, 1547); Elizabeth (July 2, 1492–September 14, 1495); Mary Tudor (March 18, 1496–June 25, 1533) married King Louis XII of France; Edmund, Duke of Somerset (February 21, 1499–June 19, 1500); and Katherine (February 2, 1503) Early Life Elizabeth of York, known alternatively as Elizabeth Plantagenet, was born on February 11, 1466, at Westminster Palace in London, England. She was the eldest of the nine children of Edward IV, king of England (ruled 1461–1483) and his wife Elizabeth Woodville (sometimes spelled Wydeville). Her parents marriage had created trouble, and her father was briefly deposed in 1470. By 1471, likely challengers to her fathers throne had been defeated and killed. Elizabeths early years were spent in comparative calm, despite the disagreements and battles going on around her. She likely began her formal education in the palace by age 5 or 6, and learned history and alchemy from her father and his library. She and her sisters were taught by ladies-in-waiting, and by observing Elizabeth Woodville in action, the skills and accomplishments considered appropriate for future queens. That included reading and writing in English, mathematics, and household management, as well as needlework, horsemanship, music, and dancing. She spoke some French, but not fluently. In 1469, at the age of 3, Elizabeth was betrothed to George Neville, but it was called off when his father supported Edward VIIs rival, the Earl of Warwick. In August 29, 1475, Elizabeth was 11 and, as part of the Treaty of Picquigny, she became betrothed to Louis XIs son, the Dauphin Charles, who at the time was 5 years old. Louis reneged on the treaty in 1482.   Death of Edward IV In 1483, with the sudden death of her father Edward IV, Elizabeth of York was at the center of the storm, as the eldest child of King Edward IV. Her younger brother was declared Edward V, but because he was 13, his fathers brother Richard Plantagenet was named regent protector. Before Edward V could be crowned, Richard imprisoned him and his younger brother Richard in the Tower of London. Richard Plantagenet took the English crown as Richard III, and had the marriage of Elizabeth of Yorks parents declared invalid, claiming Edward IV had been betrothed before the marriage had occurred. Though Elizabeth of York was by that declaration made illegitimate, Richard III was rumored to have had plans to marry her. Elizabeths mother, Elizabeth Woodville, and Margaret Beaufort, mother of Henry Tudor, a Lancastrian claiming to be heir to the throne, planned another future for Elizabeth of York: marriage to Henry Tudor when he overthrew Richard III. The two princes, the only surviving male heirs of Edward IV, disappeared. Some have assumed that Elizabeth Woodville must have known, or at least guessed, that her sons, the Princes in the Tower, were already dead because she put her efforts into her daughters marriage to Henry Tudor. Henry Tudor Richard III was killed on the battlefield in 1485, and Henry Tudor (Henry VII) succeeded him, declared himself King of England by right of conquest. He delayed some months in marrying the Yorkist heiress, Elizabeth of York, until after his own coronation. They were married in January 1486, gave birth to their first child, Arthur, in September, and she was crowned Queen of England in November 25, 1487. Their marriage established the Tudor dynasty of the British crown. Her marriage to Henry VII brought together the House of Lancaster which Henry VII represented (though he grounded his claim to the crown of England in conquest, not birth), and the House of York, which Elizabeth represented. The symbolism of a Lancastrian king marrying a Yorkist queen brought together the red rose of Lancaster and the white rose of York, ending the Wars of the Roses. Henry adopted the Tudor Rose as his symbol, colored both red and white. Children Elizabeth of York apparently lived peacefully in her marriage. She and Henry had seven children, four surviving to adulthood- a fairly decent percentage for the time. Three of the four became kings or queens in their own right: Margaret Tudor (November 28, 1489–October 18, 1541) who married King James IV of Scotland); Henry VIII, King of England (June 18, 1491–January 28, 1547); Elizabeth (July 2, 1492–September 14, 1495); Mary Tudor (March 18, 1496–June 25, 1533) married King Louis XII of France; Edmund, Duke of Somerset (February 21, 1499–June 19, 1500); and Katherine (February 2, 1503). Their oldest son, Arthur, Prince of Wales (September 20, 1486–April 2, 1502) married Catherine of Aragon, a third cousin of both Henry VII and Elizabeth of York, in 1501. Catherine and Arthur became ill with sweating sickness soon after, and Arthur died in 1502. Death and Legacy Its been surmised that Elizabeth became pregnant again to try to have another male heir for the throne after Arthurs death, in case the surviving son, Henry died. Bearing heirs was, after all, one of the most crucial responsibilities of a queen consort, especially to the hopeful founder of a new dynasty, the Tudors. If so, it was a mistake. Elizabeth of York died in the Tower of London on February 11, 1503, at the age 37, of complications of the birth of her seventh child, a girl named Katherine, who died at birth on February 2. Only three of Elizabeths children survived at her death: Margaret, Henry, and Mary. Elizabeth of York is buried at the Henry VII Lady Chapel, Westminster Abbey. The relationship of Henry VII and Elizabeth of York is not well-documented, but there are several surviving documents which suggest a tender and loving relationship. Henry was said to have withdrawn in sorrow at her death; he never remarried, though it might have been advantageous diplomatically to do so; and he spent lavishly for her funeral, though he was usually quite tight with money. Fictional Representations Elizabeth of York is a character in Shakespeares Richard III. She has little to say there; she is merely a pawn to be married to either Richard III or Henry VII. Because she is the last Yorkist heir (assuming her brothers, the Princes in the Tower, have been killed), her childrens claim to the crown of England will be more secure. Elizabeth of York is also one of the major characters in the 2013 series  The White Queen  and is the key character in 2017 series The White Princess. Elizabeth of Yorks picture is the usual depiction of a queen in card decks. Sources License, Amy. Elizabeth of York: The Forgotten Tudor Queen. Gloucestershire, Amberley Publishing, 2013.Naylor Okerlund, Arlene. Elizabeth of York. New York: St. Martins Press, 2009.Weir, Alison. Elizabeth of York: A Tudor Queen and Her World. New York: Ballantine Books, 2013.

International bussiness Assignment Example | Topics and Well Written Essays - 3000 words

International bussiness - Assignment Example Brazil has experienced massive socioeconomic transformation, and this can be dated back since the World War II. The country has seen growth from an economy that relied more on exportation of few primary products to the present day economy that is characterised by large and diversified industrial sector. The country has also transformed from a previously largely rural population to an increasingly urbanised state today. All these are clear illustrations that show the enormous strides that Brazil has taken towards its status among the fastest growing and emerging nations in the world. Brazil has an estimated population of about 200 million people which is a rapid growth from the 17.4 million in 1900. About 87 percent of the country’s population is urbanised compared to 30 percent in 1940. After going through several decades of industrialisation, Brazil presently produces more than 35 million tonnes of steel, 3 million vehicles, 66 million tonnes of corn and 60 million tonnes of cement among others annually. Other primary goods produced in the country include refrigerators and television sets. The country has a well-developed road network covering over 1.5 million kilometres well as a widespread supply of electricity (TWB 2014). The political system in Brazil involves the president being the supreme entity especially in matters concerning executing policies approved by the lower and upper houses. The Congress has a regulatory function towards decisions and actions taken by the executive. The two chambers (Chamber of Deputies and the Senate) have a role in creating legislation which are thereafter signed into law by the president. In matters of national economy, the Brazilian government has a pivotal role and influence in many aspects of the economy and its consequential growth. For example, the Government expenditures accounts for more than 40 percent of the country’s GDP. Technological advancements is an essential part in the economic

Generational contrast & comparison Essay Example | Topics and Well Written Essays - 2500 words

Generational contrast & comparison - Essay Example Two consecutive generations, known as the Baby Boomers and Generation X, clearly fit this model. They are well defined by society, culture, economics, and history. Society retains the qualities of one generation to the next as traditions and social norms are passed from parent to child, but there are also new and striking differences. In the case of the Baby Boomers and generation X, the differences are fueled by history, socialization, and the exposure to a rapidly changing world. This research will be conducted to determine where the differences are between the Baby Boomer generation and the age group known as generation X. More importantly, it will critically assess why there is a difference and evaluate the forces that created their different values and social interactions. The research is an important method to gain a deeper insight into our society and its mechanisms of enculturation. In addition, it has a commercial value to marketing departments, product developers, managers, or political campaigns who wish to exploit the underlying differences between generations. Understanding how different age groups interact with each other is critical to developing modern management strategies. It is interesting to note that this research is being conducted during a national political campaign where the three major candidates are from different generations. John McCain was born during the depression and Hillary Clinton is a Baby Boomer. Though Barak Obama technica lly fits into the Baby Boomer demographic, he was born in 1961 and as such exhibits many of the traits and characteristics associated with Generation X. They are an ideal group that can be used for comparisons and contrasting viewpoints on public policy. There is no one firm definition for either a Baby Boomer or a member of Generation X and birth dates and ages vary by as much as seven years (Wallace, 2006, p.150). Almost all the previous research agrees that the first Baby Boomer was born in 1946. However, generations do not fit neat and tidy boundaries and there is some variance as to when one ends and the other begins. For the purposes of this study, a Baby Boomer is anyone born between January 1, 1946 and December 31, 1964 (Smith, 2005, p.440). A member of Generation X has a birth date of January 1, 1965 and December 31, 1980 (Smith, 2005, p.440). This places the age of a Baby Boomer at approximately 44 to 62 years old, while a member of Generation X is approximately 28 to 43 years of age. In addition, the age of the generation at the time that the previous research was conducted becomes important. Age and maturity also influences people as well as their identification with a generation. The research will be conducted through the analysis of previous research and studies on this topic. It will be organized as follows: 1.0 Introduction 2.0 Scope and Purpose 3.0 Literature Review 4.0 Discussion 5.0 Recommendations and Conclusion 3.0 Literature Review Both the Baby Boom generation and Generation X have been extensively described and characterized in the popular media. For the sake of marketing and sales, advertisers have sought to drawn clear distinctions between the groups. Schaie (2007) states that, "Baby boomers are hedonistic; they are self-centered; they are spendthrifts; they are altruistic; they strive to self-actualize" (p.131). These characterizations are

Costa Rican Coffee Industry Essay Example | Topics and Well Written Essays - 2500 words

Costa Rican Coffee Industry - Essay Example Costa Coffee refers to a British Multinational coffeehouse in United Kingdom, a subsidiary of Whitbread PLC. It forms the second largest coffeehouse chain worldwide after Starbucks. The Italian brothers; Bruno and Sergio Costa started the coffeehouse in 1971 as a wholesale supplier of roasted coffee to specialist and caterers in Italian shops. Currently, the business operates 1375 restaurants in UK and 2500 vending facilities, in Costa Coffee, as well as 800 overseas outlets. The Costa Coffee outlets can be found in airports, Tesco stores, bookstores, hospitals and in motorway services. Some subunits can be found in railway stations as well as in the airport throughout UK. Most of the branches within airports, hospitals and cinema halls are owned by either corporate franchise or individuals. Some outlets can also be found outside the business parks, often, among most leading companies and food retailers. The Costa Express created by coffee chain from the self-service coffee bars anti cipates rebranding Coffee Nation Machine to see the expansion to 3000 locations. The Coffee Nation operates in motorway services and within the Tesco stores. The company aims to target hospitals, transport interchanges and universities. The company’s roaster is in UK and is operated by three master roasters from Italy. The retail stores sell Mocha Italia coffee; six parts Arabica and four parts Robusta and use Gennaro Pelliccia as the coffee taster. The company sponsors awards such as Costa Book Awards that began in 2006.... Most of the branches within airports, hospitals and cinema halls are owned by either corporate franchise or individuals. Some outlets can also be found outside the business parks, often, among most leading companies and food retailers. The Costa Express created by coffee chain from the self-service coffee bars anticipates rebranding Coffee Nation Machine to see the expansion to 3000 locations. The Coffee Nation operates in motorway services and within the Tesco stores. The company aims to target hospitals, transport interchanges and universities. The company’s roaster is in UK and is operated by three master roasters from Italy. The retail stores sell Mocha Italia coffee; six parts Arabica and four parts Robusta and use Gennaro Pelliccia as the coffee taster. The company sponsors awards such as Costa Book Awards that began in 2006 (Allegra Strategies, 2009). Some of the controversies surrounding the Costa Coffee include the opening of Bristol outlet in 2011 without appropriate planning permission leading to planning appeals against any enforcement action in 2012. The company also faced opposition from residents who restricted them from opening up an outlet in Totnes making the company withdraw. Despite of opposition from resident and protests against opening up of the outlets, Costa Coffee managed to open some coffee shop, such as in Southwold, after getting the planning permission on the appeal. The Costa coffee possesses four characteristics. First is the miscela where the coffee is made from the unique blend called Mocha Italia. The other characteristic is grind, macinatura where each Costa cup contains freshly ground beans with appropriate consistency that ensures perfect aroma and flavours. The Mazzer comprises of Ferrari

The Present US Policy on Foreign Born Nurses Essay

The Present US Policy on Foreign Born Nurses - Essay Example As the report declares the present policy allows the foreign nurses to get a working visa in United States hospitals within an average of sixty days. The new policy will make the minimum working visa processing extended to the three years period. The new policy that will eventually affect doctors and technical workers is the result of the September 11 attack on the twin towers of New York and the White House. The longer waiting time for the foreign nurses will help the United States immigration department to scrutinize the application papers of these foreigners. This paper stresses that the advantages of the present US policy limiting the number of foreign workers has the following advantages: Only a selected few are admitted to the US workforce. Only those who pass the CGFNS and NCLEX and the Test of English as a foreign language plus they must have the necessary job experiences and educational requirements are most likely to be admitted to the United States. The job opportunities of the United States nursing workforce is not as much threatened. Only 4% of the total present nursing workforce is dominated by foreign nurses. There is a strong feeling among the a group of United States nurses that there is really no need to hire foreign nurses. Extending the time required to process a nurse working visa from six months to three years will make it similar to the time requirement of three years in other fields of study like engineers, doctors, among others.

E-Business , E-Commerce and Information System Case Study

E-Business , E-Commerce and Information System - Case Study Example ips with the customers and the development of a better website will allow PharmQuip to gather useful customer data and retain the customers’ loyalty. The global healthcare equipment industry is anticipated to grow around 5% more till the year 2012. Therefore this is the best opportunity for the company to go global and increase its market share. The developing countries such as Pakistan, India and Malaysia are the most attractive markets because these markets are not concentrated, hence, the demand for healthcare equipment for the disabled will be much higher than in developed countries. NGOs have played another role in creating demand for healthcare equipment as 1500 jobs were created in India in 2005 for the handicaps. The physically challenged individuals who go to jobs or are living alone are the main target segment for PharQuip. Although the international expansion looks very attractive at first glance but it presents a number of issues. As the PharmQuip business will ent er the global arena, it will require more ICT resources and streamlining of the current processes to meet the demand of international healthcare retailers and chemists. The company will need to employ more security measures to enhance the current payment system for its B2B customers. Security of customer data and supplier information will also be needed and will require significant expenditure when the company goes global. A higher budget will be required to advertise and for the promotional strategy to be implemented in all the countries where the company will operate. The single greatest risk that the company faces is from the changes in technologies and introduction of lower cost healthcare equipment. New regulatory requirements can be introduced in the countries which can harm the business. Other risks are the changes in the market dynamics, introduction of alternatives to healthcare equipments and breakthroughs in biotechnologies which can cure the physical disabilities of the

The Present US Policy on Foreign Born Nurses Essay

The Present US Policy on Foreign Born Nurses - Essay Example As the report declares the present policy allows the foreign nurses to get a working visa in United States hospitals within an average of sixty days. The new policy will make the minimum working visa processing extended to the three years period. The new policy that will eventually affect doctors and technical workers is the result of the September 11 attack on the twin towers of New York and the White House. The longer waiting time for the foreign nurses will help the United States immigration department to scrutinize the application papers of these foreigners. This paper stresses that the advantages of the present US policy limiting the number of foreign workers has the following advantages: Only a selected few are admitted to the US workforce. Only those who pass the CGFNS and NCLEX and the Test of English as a foreign language plus they must have the necessary job experiences and educational requirements are most likely to be admitted to the United States. The job opportunities of the United States nursing workforce is not as much threatened. Only 4% of the total present nursing workforce is dominated by foreign nurses. There is a strong feeling among the a group of United States nurses that there is really no need to hire foreign nurses. Extending the time required to process a nurse working visa from six months to three years will make it similar to the time requirement of three years in other fields of study like engineers, doctors, among others.

Application of different moral philosophies to an analysis of Term Paper

Application of different moral philosophies to an analysis of individual decision making - Term Paper Example The consequences of the ethical violations of the present case may not be the exact same but yet the ethical implications and the issues related to the present case is most certainly a reflection of the ethical violations in the business practices. The case study has Carla and Jack as the two central characters and all the aspects related the business ethics revolves around those central characters only. One of the first ethical issues related to the case could be the listed as the denying of Jack from a potential partnership deal by the organization. As per the case study, Jack has been working for sixty to seventy hours a week for the last ten years. The contribution made by jack towards the organization can be analyzed. Hence it can be said that based on the contributions and the amount of time spent by Jack in the company (more than 17 years), the company could have decided to provide a partnership deal. Although it has been identified as a potential issue, it has to be said that the reasons for which the company decided to deny Jack from the partnership deal has not been mentioned in the case study. The next ethical issue is the behavior of Jack after being denied of the deal. As per the case study, Carla one day found out that Jack has been behaving strangely. Also it was found that Jack was copying some software used by the company for consulting and auditing purpose. It is also believed that Jack had got hold some clients from the internal database of the company and was using them for own benefit. Jack also had a plan to open a new firm. Next case of ethical violations is associated with Carla. As per the case study, Carla has been using the office phones for personal calls and other issues like using the company machine for personal usage. Although the magnitude of the violation may not be as immense as the ones conducted by Jack but it may be notified as a case of ethical violation. However the next phase of the case could lead to severe consequences . Carla decided to keep some of the facts in mind that she has been using the company resources for personal usage also. Add to that Jack has been with the company for a long period of time and the company may not believe her. She also did not want to leave the job. Such a behavior may lead to potential disaster for the company not from a financial perspective but also it may actually threaten the existence of the firm also. Answer 2 Teleology is one of the most important among the six major types of moral philosophy. It describes the acts by any human beings according to a specific situation where the acts need to be acceptable or morally right in terms of achievement of expected results (no author, Chapter 6, 2006). An example of teleology is clear understanding of utility or self interest. Therefore, according to the behavior of Jack with respect to the specific situation in the case, it can be stated that teleology would be the most suitable moral philosophy that describes the b ehavior and acts of Jack in the case. To be really honest the readers of the case would have full sympathy with Jack, for denied a position of partner but not for the acts after being denied. The probable options for Jack have been discussed in this section. There is very little doubt over the fact after putting

United Nations Environmental Program Essay Example for Free

United Nations Environmental Program Essay There are a lot of articles, books and essays that have been written, touching on the relationship that land has with agricultural practices. For instance, Helmut Geist and Lambin Eric in their essay make postulations that irresponsible agricultural practices have been responsible for the disappearance of tropical forest covers, both at the local and regional levels. The two, being postdoctoral researchers in geography, specializing in the field of global climatic change, posit that irresponsible agriculture is far much responsible for the concept of land use and land cover change (LUCC). To back this argument up, Helmut and Lambin elucidate on the matter, postulating that irresponsible agriculture negatively affects the LUCC than any other practice carried out within the auspices of human civilization. To bolster this notion, it is posited by the two that apart from the fact that agricultural activities has the potency to deliver negative environmental degradation, irresponsible agriculture has the ability to deliver soil erosion- a feat that environmental degradation cannot receive from the industrial sector and its pollution. Evidence Presented The strengths in these claims are that farming and irresponsible agriculture has in most times been blamed for soil degradation. Much evidence is adduced and presented by Helmut and Lambin in this work. For instance, Helmut and Lambin quote the United Nations Environmental Program 2004 statistics that indicate that tilling land that is on a hill and failure to build gabions have in most instances been blamed for over 75% of cases touching on soil erosion (Levine 2006). In another wavelength, it is true that irresponsible farming activities harms the soil when very strong inorganic fertilizers are used, making the soil become resistant to fertilizers and pesticides. Weaknesses Critics such as Geist (2006) point that there are pitfalls in this work that was presented by Helmut and Lambin. For example, in the first case, not all the adverse effects of irresponsible farming practices are dealt with herein. For example, there is no point on the role overstocking (of animals) plays towards soil erosion and the depletion of the scarce resources within the environment. Nevertheless, it is true that all the above factors contribute to the disappearance of the land cover. Assumptions made by the writers At the same time, there are some assumptions that Helmut and Lambin make. Assuming that keeping the right size of cattle, building gabions, using the right quantities of organic fertilizers and pesticides are the only panacea in themselves against the spread of the loss of fertile land is a fallacy on its own. On the contrary, the two forget to address important farming practices such as the growing of leguminous crops, crop rotation and fallowing of land, as being instrumental in the cause against soil erosion. Growing leguminous crops such as beans help in nitrogen fixing in the soil, whereas crop rotation and mixed cropping helps the land receive nutrition from different types of crops. Letting land lay fallow on the other hand, enables the revitalization of pedological energy and the recovery of humus. These are the counterarguments that have been put forth by other critics such as Singh and Fox (2001). Conclusion and importance of the problems and the argument being tackled The sacrosance of the argument at hand is that there is a serious interrelationship between LUCC and human life. This means that mismanagement of the former has the potency to ruthlessly damage the cause of human life. It is no wonder that calls are rife from UNEP for the leading economies to tow the line in ensuring that there is the assuaging of soil, water and air pollution so that the prospects of future human survival can be consolidated. Works Cited Singh, Ram and Fox, Jefferson. A Look at Land Use and Cover Change. New York: McGraw Hill. 2001. Geist, Helmut. A Study on Earth’s Changing Landscape. Colorado: John Wiley and Sons. 2006. Levine, Joel. Global Change and the Burning of Biomass. Massachusetts: Massachusetts Institute of Technology. 2006.

Computer Forensics Investigation and Techniques

Computer Forensics Investigation and Techniques Introduction I am the student of International Advanced Diploma in Computer Studies (IADCS). In this course, I have to do Compute Forensic assignment. The assignment title is â€Å"Didsbury Mobile Entertainments LTD†. This assignment helps me understanding computer forensics investigation and techniques Before this assignment, although I am interested in computer forensic, I am hardly used computer forensics toolkit or done any investigation. Because of this assignment, I have learnt many techniques how to investigate computer and done it practically. So, by doing this assignment, I have gained in practical and much valuable knowledge in Computer Forensics.nd a heartfelt thanks to all the people in Myanma Computer Company Ltd. for their warmly welcome during the period of the IADCS course and this assignment developed. Task 1 i) Report DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 10, 2010 Introduction Computer forensics involves obtaining and analyzing digital information for figuring out what happened, when it happened, how it happened and who was involved. What is more, it is use as evidence in civil, criminal, or administrative cases. Reasons for a need for computer forensic investigation Computer forensics investigation can recover thousands of deleted mails, can know when the user log into the system and what he does, can determine the motivation and intent of the user, can search keywords in a hard drive in different languages and can gain evidence against an employee that an organization wished to terminate. For these reasons, in order to know whether Jalitha has been spending her time on her friend business or not, we need a computer forensic investigation. Steps to pursue the investigation In order to pursue the investigation, I would take the following steps: 1) Secure the computer system to ensure that the equipment and data are safe 2) Find every file on the computer system, including files that are encrypted, protected by passwords, hidden or deleted, but not yet overwritten. 3) Copy all files and work on this copy files as accessing a file can alter its original value 4) Start a detailed journal with the date and time and date/information discovered 5) Collect email, DNS, and other network service logs 6) Analyze with various computer forensics tools and software 7) Print out an overall analysis 8) Evaluating the information/data recovered to determine the case Conclusion After we know the reasons and steps for investigation, then we should move on to conduct the investigation. However, we should note that the first step of investigation is critical as if the system is not secure, then the evidence or data we found may not be admissible. ii a) Report for â€Å"The procedures to make sure the evidence holds up in court† DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 12, 2010 Introduction Evidence is any physical or electronic information (such as computer log files, data, reports, hardware, disk image, etc) that is collected during a computer forensic investigation. The purpose of gathering evidence is to help determine the source of the attack, and to introduce the evidence as testimony in a court of law. Procedures to make sure the evidence holds up in court In order to make the evidence admissible in court, we need to follow the following steps: 1) Before any evidence can be gathered, a warrant must be issued so that forensic specialist has the legal authority to seize, copy and examine the data 2) Have the responsibility to ensure that the law and the principles we used are met 3) Evidence must be obtained in a manner which ensures the authenticity and validity and that no tampering had taken place 4) Tracking the chain of custody is essential for preparing evidence as it shows the evidence was collected from the system in question, and was stored and managed without alteration. 5) Extracted/ relevant evidence is properly handled and protected from later mechanical or electromagnetic damage 6) Preventing viruses from being introduced to a computer during the analysis process 7) To ensure that original evidence must be described in complete details to present reliable evidence on the court 8) Must arrange to answer reliability questions relating to the software we have used Conclusion In gathering evidence, authenticity, reliability and chain of custody are important aspects to be considered. By following the above steps, we are proper in handling the evidence holds up in court. ii b) Evidence form Didsbury Mobile Entertainments Ltd IT Department Computer Investigation Case No.: 005 Investigation Organization: Gold Star Investigator: Win Pa Pa Aye Nature of Case: Companys policy violation case Location where evidence was obtained: On suspects office desk Description of evidence: Vendor Name Model No./ Serial No. Item #1 One CD Sony Item #2 A 4GB flash memory device Kingston 05360-374.A00LF Item #3 Evidence Recovered by: Win Pa Pa Aye Date Time: 10.12.2009 10:00 AM Evidence Placed in Locker: E2419 Date Time: 15.12.2009 11:00 AM Item # Evidence Processed by Description of Evidence Date/ Time 1 Win Pa Pa Aye Fully recovered deleted email on the drive which is sent to Radasas company, including data exchange between the businesses. 13.12.2009 3:00 PM 2 Win Pa Pa Aye Encrypted document hidden inside a bitmap file. Decrypted and saved on another media. 18.12.2009 9:00 AM 3 Win Pa Pa Aye Password-protected document covering the exchange of information with her friend. Password cracked and file saved on another media. 22.12.2009 2:00 PM Task 2 Report for â€Å"the way the data is stored, boot tasks and start up tasks for Windows and Linux systems† To effectively investigate computer evidence, we must understand how the most popular operating systems work in general and how they store files in particular. The type of file system an operating system uses determines how data is stored on the disk. The file system is the general name given to the logical structures and software routines used to control access to the storage on a hard disk system and it is usually related to an operating system. To know the way the data is stored in Windows XP and Linux, we need to get into file systems of Windows and Linux. The way the data is stored in Windows XP In Windows XP, although it supports several different file systems, NTFS is the primary file system for Windows XP. So, we will have a look in NTFS as the NTFS system offers better performance and features than a FAT16 and FAT 32 system. NTFS divides all useful places into clusters and supports almost all sizes of clusters from 512 bytes up to 64 Kbytes. And NTFS disk is symbolically divided into two parts MFT (Master File Table) area and files storage area. The MFT consumes about 12% of the disk and contains information about all files located on the disk. This includes the system file used by the operating system. MFT is divided into records of the fixed size (usually 1 Kbytes), and each record corresponds to some file. Records within the MFT are referred to as meta-data and the first 16 records are reserved for system files. For reliability, the first three records of MFT file is copied and stored exactly in the middle of the disk and the remaining can be stored anyplace of the disk. The remaining 88% of disk space is for file storage. Below is the partition structure of NTFS system. After we know the file system of Windows XP, then we will move on to the file system of Linux. The way the data is stored in Linux When it comes to Linux file system, ext2 has been the default file system as it main advantages is its speed and extremely robust. However, there is a risk of data loss when sudden crashes occur and take long time to recover. Sometimes the recovery may also end up with corrupt files. By using the advantage of ext2 and add some data loss protection and recovery speed led to the development of journaling file system ext3 and ReiserFs. Though ext2, ext3 and ReiserFs are the most popular file system, there are also some other file system used in the Linux world such as JSF and XFS. As Linux views all file systems from the perspective of a common set of objects, there are four objects superblock, inode, dentry and file. The superblock is a structure that represents a file system which includes vital information about the system. Moreover, it includes the file system name (such as ext2), the size of the file system and its state, a reference to the block device, and meta-data information. It also keeps track of all the nodes. Linux keeps multiple copies of the superblock in various locations on the disk to prevent losing such vital information. Every object that is managed within a file system (file or directory) is represented in Linux as an inode. The inode contains all the meta-data to manage objects in the file system. Another set of structures, called dentries, is used to translate between names and inodes, for which a directory cache exists to keep the most-recently used around. The dentry also maintains relationships between directories and files for traversing file systems. Finally, a VFS (Virtual file system) file represents an open file (keeps state for the open file such as the write offset, and so on). While the majority of the file system code exists in the kernel (except for user-space file systems), (2.3) shows the Linux file system from the point of view of high-level architecture and the relationships between the major file system-related components in both user space and the kernel. The boot task and start up task of Windows XP A good understanding of what happens to disk data at startup is also an important aspect as accessing to a computer system after it was used for illicit reasons can alter the disk evidence. First, we will discuss about the Windows XP startup and boot process, and then shift into the startup and boot process of Linux. Like any other PC system, Windows XP startup by running the POST test, performing an initialization of its intelligent system devices, and performing a system boot process. The boot process begins when the BIOS starts looking through the system for a master boot record (MBR). This record can reside on drive C: or at any other location in the system. When the BIOS execute the master boot record on the hard drive, the MBR examines the disks partition table to locate the active partition. The boot process then moves to the boot sector of that partition located in the first sector of the active partition. There, it finds the code to begin loading the Secondary Bootstrap Loader from the root directory of the boot drive. In NTFS partition, the bootstrap loader is named NTLDR and is responsible for loading XP operation system into memory. When the system is powered on, NTLDR reads the Boot.ini file. If boot.ini contains more than one operating system entry, a boot menu is displayed to the user, allowing the user to choose which operating system is to be loaded. Fig (2.4) shows Boot.ini contains two operating systems and allows user to choose. After the user has selected the desired mode to boot to, NTLDR runs Ntoskrnl.exe and reads Bootvid.dll, Hal.dll and the startup device drivers. After the file system driver has loaded, control is then passed from NTLDR to the kernel. At this time, Windows XP display Windows logo. Virtually, all applications we installed using the default installation decide that they should start up when windows starts. Under â€Å"Startup† tab in the system configuration utility, a list of programs that run when our system boots is listed. Fig (2.6) shows the listed program when our system boots. The boot task and start up task of Linux After we have get into the start up process of Windows XP, we will then shift into the startup process of Linux. In Linux, the flow of control during a boot is also from BIOS, to boot loader, to kernel. When you turn on the power, the BIOS perform hardware-platform specific startup tasks. Once the hardware is recognized and started correctly, the BIOS loads and executes the partition boot code from the designated boot device, which contains Linux boot loader. Linux Loader (LILO) is the Linux utility that initiates the boot process, which usually runs from the disks MBR. LILO is a boot manager that allows you to start Linux or other operating systems, including Windows. If a system has two or more operating systems, LILO gives a prompt asking which operating system the user wishes to initialize. When the user chooses the boot option, it then loads the choosing operating system into memory. The boot program, in turn, reads the kernel into memory. When the kernel is loaded, the boot program transfers control of the boot process to the kernel. The kernel then performs the majority of system setup (memory management, device initialization) before spawning separately, the idle process and scheduler and the init process which is executed in user space. The scheduler takes control of the system management. The init process executes scripts as needed that set up all non-operating system services and structures in order to allow a user environment to be created, and then presents the user with a login screen. We have described about the way the data stored, the boot task and startup task of Windows XP and Linux. After a thorough study of these areas, we can acquire or handle the evidence properly. Task 3 a) Features comparison of â€Å"EnCase, Access Datas Forensic and ProDiscover† Features of Guidance EnCase Forensic * In courts worldwide, forensically acquire data in a sound manner using software with an unparallel record * Using a single tool and investigate and analyze multiple platforms * With prebuilt EnScript ® modules such as initialized Case and Event Log analysis, it can automate complex and routine tasks, so it save time in analyzing * Find information despite efforts to hide, cloak or delete * Can easily handle large volumes of computer evidence, view all relevant files that includes deleted files, file slack and unallocated space * Directly transfer evidence files to law enforcement or legal representatives as necessary * Include review options that allow non-investigators to review evidence easily * Include report options that enable quick report preparation Features of Access Datas Forensic Toolkit * Provides integrated solution that is no need to purchase multiple tools to complete a case. * Provides integrated database that avoid application crashes, lost work and product instability. * Identify encrypted files automatically from more than 80 applications and crack those files. * Supports international language that allows us easily search and view foreign-language data in our native format * Include email analysis that can recover and analyze a wide range of email and web mail formats * Can generate different industry-standard report formats quickly and concisely * Collect key information from the registry that include user information, date of application installed, hardware, time zone and recently used information * While processing takes place, we can view and analyze data Features of ProDiscover * To keep original evidence safe, it create bit-stream copy of disk for analyzing that includes hidden HPA section * For complete disk forensic analysis, it search files or entire disk including slack space, HPA section and Windows NT/2000/XP alternate data streams * Without alter data on the disk, it can preview all files including metadata and hidden or deleted files * Support for VMware to run a captured image. * In order to ensure nothing is hidden, it examine data at the file or cluster level * To prove data integrity, it can generate and record MD5, SHA1 and SHA256 hashes automatically. * Examine FAT12, FAT16, FAT 32 and all NTFS file systems including Dynamic Disk and Software RAID for maximum flexibility. * Examine Sun Solaris UFS file system and Linux ext2 / ext3 file systems. * Integrated thumbnail graphics, internet history, event log file, and registry viewers to facilitate investigation process. * Integrated viewer to examine .pst /.ost and .dbx e-mail files. * Utilize Perl scripts to automate investigation tasks. * Extracts EXIF information from JPEG files to identify file creators. * Automated report generation in XML format saves time, improves accuracy and compatibility. * GUI interface and integrated help function assure quick start and ease of use. * Designed to NIST Disk Imaging Tool Specification 3.1.6 to insure high quality. AccessData FTK v2.0 Guidance EnCase Forensic 6.0 ProDiscover Forensic Report for Choosing Access Datas Forensic Toolkit I think Access Datas Forensic Toolkit is the most beneficial for our lab as it provides more forensic examination features than Encase and ProDiscover. In the evidence aspects, Access Data can acquire files and folders than others. So, it can be a powerful tool when we analyze files for evidence. Moreover, it uses database to support large volume of data that can avoid application crashes, lost work and product instability for our lab. As Access Data is a GUI-based utility that can run in Windows XP, 2000, Me, or 9x operating system and it demo version has most of the same features as full-licensed version, use multi-threading to optimize CPU usage, has task scheduler to optimize time and can view and analyze data while processing takes place, it meets the requirements of our lab. What is more, it supports international language so we can retrieve data no matter which languages they are using. On top of that, it is powerful in searching, recovery, email and graphic analysis. Because of these reasons and by viewing the above forensic tools comparison chart, I can conclude that Access Datas Forensic Toolkit is the most beneficial for our lab. b) Forensic Analysis Report for â€Å"Analyzing FAT32, NTFS and CDFS file system Using Access Datas FTK† Task 4 a) MD5 hash values of bmp, doc, xls files All hash values generated by the MD5 before modification is not the same with the hash value generated after modification. b) Why hash values are same or different A hash value is a numeric value of a fixed length that uniquely identifies data. Data can be compared to a hash value to determine its integrity. Data is hashed and the hash value is stored. At a later time or after the data has been received from mail, the data is hashed again and compared to the stored hash or the hash value it was sent to determine whether the data was altered. In order to compare the hash values, the original hashed data must be encrypted or kept secret from all untrusted parties. When it compared, if the compared hashed values are the same, then the data has not been altered. If the file has been modified or corrupted, the MD5 produces different hash values. In task 4 (a), first we created a doc file with data in this file, then we generated hash values of doc file with MD5. The hash value of info.doc file is da5fd802f47c9b5bbdced35b9a1202e6. After that, we made a modification to that info.doc file and regenerate the hash values. The hash value after modifying is 01f8badd9846f32a79a5055bfe98adeb. The hash value is completely different after modifying. Then we created a cv.xls file and generated the hash value. Before modifying, the hash value is ef9bbfeec4d8e455b749447377a5e84f. After that we add one record to cv.xls file and regenerated hash values. After modifying, ccfee18e1e713cdd2fcf565298928673 hash value is produced. The hash value changed in cv.xls file after data altered. Furthermore, we created fruit.bmp file to compare the hash value before and after modification. The hash value before modifying is 8d06bdfe03df83bb3942ce71daca3888 and after modifying is 667d82f0545f0d187dfa0227ea2c7ff6. So, the hash values comparison of bmp files is completely different after data has been modified. When we encrypted the text file into each image file, the text file is not visible in the image viewing utility and each image file is like its original image file. However, the comparison of the hash values of each image file before and after inserting short messages is completely different. As each image file has been altered by inserting short message, the regenerated hash value is totally different from the original hash values. On top of that, the original image file size has been changed after inserting short messages. The raster image file has slightly increased its file size after it has been modified. The raster image file size is increased from 50.5 KB to 50.7 KB. However, of the remaining three, two image files vector and metafile have decreased its file size a little sharply. The original file size of vector is 266 KB and has been decreased to 200 KB after modified. The metafile also decreased from 313 KB to 156 KB. Only the bitmap is remains stable as its file size does not increase or decrease. In a nut shell, we can conclude that the hash value would change if the file has been modified. However, depending on the file format, the file size can increase, decrease or remain stable. d) Report for â€Å"differences of bitmap, raster, vector and metafile† A bitmap image is a computer file and it is collected with dots or pixels that form an image. The pixel of bitmap is stored like a grid, tiny square. When we use the paint program, we can see the bitmap pixel is like a block and it is draw or clear block by block. A raster image is also a collection of pixels but the image stored pixels in rows to make it easy to print. And raster image is resolution dependent. It cannot scale up to an arbitrary resolution without loss of apparent quality. This is overcome by the vector image. Vector image is made up of many individual, scalable objects. These objects are defined by mathematical equations rather than pixels, so it always render at the highest quality. There are many attributes in vector like color, fill and outline. The attributes can be changed without destroying the basic object. Metafile is a combination of raster and vector graphics, and can have the characteristics of both image types. However, if you create a metafile with raster and vector and enlarge it, the area of raster format will lose some resolution while the vector formatted area remains sharp and clear. If we have lost an image file, before doing anything, we should be familiar with the data patterns of known image file types. Then the recovery process starts. The first step in recovery is to recover fragments file from slack space and free space. The fragment file can locate the header data that is partially overwritten. So, we use Drivespy to identify possible unallocated data sets that contain the full or partial image header values. To locate and recover the image header, we need to know the absolute starting cluster and ending cluster. If not, we could collect the wrong data. Using Drivespy, we can know started cluster number and file size of image that we want to recover. To know the exact ending cluster, add the total number of clusters assigned to the starting cluster position. As we have known the size of image file, we can calculate the total number of clusters. Then, we can locate the image file and retrieve image header. After we get the header value, open the file with Microsoft Photo Viewer. If the file has been opened successfully, then recovery of image file has been completed. If not, we need to use the Hex Workshop to examine the header of the file. Task 5 Report for â€Å"Investigation that prove Naomis innocence† Before we begin tracing an email, we should know which email is illegal and what constitutes an email crime. Illegal email includes selling narcotics, extortion, sexual harassment, stalking, fraud, child abductions, and child pornography. As Jazebel has received an offensive email, so we need to access the victim computer and copy and print the offensive email to recover the evidence contained in the email. Microsoft Outlook, Outlook Express or any other GUI email programs supports for copying the email from inbox to the place that we want to by dragging the message to the storage place. When copying email, the header of the email must be included as it contains unique identifying numbers, such as IP address of the server that sent the message. This helps us when tracing the email. After copy and printing the message, we should retrieve the email header to get the sender IP address. Right click on the message and choose message options to retrieve the email header. The following shows the header information that retrieved from the mail of the victim computer. At line 1(10.140.200.11) shows the IP address of the server sending the e-mail, and provides a date and time that the offending e-mails was sent. Although when we see at line 5, the victim is seemed to be Jezebel, however, line 1 identifies that the e-mail that is sent from the IP address (10.140.200.11) is the same as the victims computer IP address. So, we can conclude that Naomi does not include in sending offensive e-mail. She is innocence and the victim, Jezebel himself, is the one who send the offensive e-mails. References: Computer Forensics Textbook http://www.computerforensicsworld.com/index.php http://www.crime-research.org/library/Forensics.htm http://ixbtlabs.com/articles/ntfs/ www.wikipedia.com Computer Forensics Investigation and Techniques Computer Forensics Investigation and Techniques Introduction I am the student of International Advanced Diploma in Computer Studies (IADCS). In this course, I have to do Compute Forensic assignment. The assignment title is â€Å"Didsbury Mobile Entertainments LTD†. This assignment helps me understanding computer forensics investigation and techniques Before this assignment, although I am interested in computer forensic, I am hardly used computer forensics toolkit or done any investigation. Because of this assignment, I have learnt many techniques how to investigate computer and done it practically. So, by doing this assignment, I have gained in practical and much valuable knowledge in Computer Forensics.nd a heartfelt thanks to all the people in Myanma Computer Company Ltd. for their warmly welcome during the period of the IADCS course and this assignment developed. Task 1 i) Report DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 10, 2010 Introduction Computer forensics involves obtaining and analyzing digital information for figuring out what happened, when it happened, how it happened and who was involved. What is more, it is use as evidence in civil, criminal, or administrative cases. Reasons for a need for computer forensic investigation Computer forensics investigation can recover thousands of deleted mails, can know when the user log into the system and what he does, can determine the motivation and intent of the user, can search keywords in a hard drive in different languages and can gain evidence against an employee that an organization wished to terminate. For these reasons, in order to know whether Jalitha has been spending her time on her friend business or not, we need a computer forensic investigation. Steps to pursue the investigation In order to pursue the investigation, I would take the following steps: 1) Secure the computer system to ensure that the equipment and data are safe 2) Find every file on the computer system, including files that are encrypted, protected by passwords, hidden or deleted, but not yet overwritten. 3) Copy all files and work on this copy files as accessing a file can alter its original value 4) Start a detailed journal with the date and time and date/information discovered 5) Collect email, DNS, and other network service logs 6) Analyze with various computer forensics tools and software 7) Print out an overall analysis 8) Evaluating the information/data recovered to determine the case Conclusion After we know the reasons and steps for investigation, then we should move on to conduct the investigation. However, we should note that the first step of investigation is critical as if the system is not secure, then the evidence or data we found may not be admissible. ii a) Report for â€Å"The procedures to make sure the evidence holds up in court† DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 12, 2010 Introduction Evidence is any physical or electronic information (such as computer log files, data, reports, hardware, disk image, etc) that is collected during a computer forensic investigation. The purpose of gathering evidence is to help determine the source of the attack, and to introduce the evidence as testimony in a court of law. Procedures to make sure the evidence holds up in court In order to make the evidence admissible in court, we need to follow the following steps: 1) Before any evidence can be gathered, a warrant must be issued so that forensic specialist has the legal authority to seize, copy and examine the data 2) Have the responsibility to ensure that the law and the principles we used are met 3) Evidence must be obtained in a manner which ensures the authenticity and validity and that no tampering had taken place 4) Tracking the chain of custody is essential for preparing evidence as it shows the evidence was collected from the system in question, and was stored and managed without alteration. 5) Extracted/ relevant evidence is properly handled and protected from later mechanical or electromagnetic damage 6) Preventing viruses from being introduced to a computer during the analysis process 7) To ensure that original evidence must be described in complete details to present reliable evidence on the court 8) Must arrange to answer reliability questions relating to the software we have used Conclusion In gathering evidence, authenticity, reliability and chain of custody are important aspects to be considered. By following the above steps, we are proper in handling the evidence holds up in court. ii b) Evidence form Didsbury Mobile Entertainments Ltd IT Department Computer Investigation Case No.: 005 Investigation Organization: Gold Star Investigator: Win Pa Pa Aye Nature of Case: Companys policy violation case Location where evidence was obtained: On suspects office desk Description of evidence: Vendor Name Model No./ Serial No. Item #1 One CD Sony Item #2 A 4GB flash memory device Kingston 05360-374.A00LF Item #3 Evidence Recovered by: Win Pa Pa Aye Date Time: 10.12.2009 10:00 AM Evidence Placed in Locker: E2419 Date Time: 15.12.2009 11:00 AM Item # Evidence Processed by Description of Evidence Date/ Time 1 Win Pa Pa Aye Fully recovered deleted email on the drive which is sent to Radasas company, including data exchange between the businesses. 13.12.2009 3:00 PM 2 Win Pa Pa Aye Encrypted document hidden inside a bitmap file. Decrypted and saved on another media. 18.12.2009 9:00 AM 3 Win Pa Pa Aye Password-protected document covering the exchange of information with her friend. Password cracked and file saved on another media. 22.12.2009 2:00 PM Task 2 Report for â€Å"the way the data is stored, boot tasks and start up tasks for Windows and Linux systems† To effectively investigate computer evidence, we must understand how the most popular operating systems work in general and how they store files in particular. The type of file system an operating system uses determines how data is stored on the disk. The file system is the general name given to the logical structures and software routines used to control access to the storage on a hard disk system and it is usually related to an operating system. To know the way the data is stored in Windows XP and Linux, we need to get into file systems of Windows and Linux. The way the data is stored in Windows XP In Windows XP, although it supports several different file systems, NTFS is the primary file system for Windows XP. So, we will have a look in NTFS as the NTFS system offers better performance and features than a FAT16 and FAT 32 system. NTFS divides all useful places into clusters and supports almost all sizes of clusters from 512 bytes up to 64 Kbytes. And NTFS disk is symbolically divided into two parts MFT (Master File Table) area and files storage area. The MFT consumes about 12% of the disk and contains information about all files located on the disk. This includes the system file used by the operating system. MFT is divided into records of the fixed size (usually 1 Kbytes), and each record corresponds to some file. Records within the MFT are referred to as meta-data and the first 16 records are reserved for system files. For reliability, the first three records of MFT file is copied and stored exactly in the middle of the disk and the remaining can be stored anyplace of the disk. The remaining 88% of disk space is for file storage. Below is the partition structure of NTFS system. After we know the file system of Windows XP, then we will move on to the file system of Linux. The way the data is stored in Linux When it comes to Linux file system, ext2 has been the default file system as it main advantages is its speed and extremely robust. However, there is a risk of data loss when sudden crashes occur and take long time to recover. Sometimes the recovery may also end up with corrupt files. By using the advantage of ext2 and add some data loss protection and recovery speed led to the development of journaling file system ext3 and ReiserFs. Though ext2, ext3 and ReiserFs are the most popular file system, there are also some other file system used in the Linux world such as JSF and XFS. As Linux views all file systems from the perspective of a common set of objects, there are four objects superblock, inode, dentry and file. The superblock is a structure that represents a file system which includes vital information about the system. Moreover, it includes the file system name (such as ext2), the size of the file system and its state, a reference to the block device, and meta-data information. It also keeps track of all the nodes. Linux keeps multiple copies of the superblock in various locations on the disk to prevent losing such vital information. Every object that is managed within a file system (file or directory) is represented in Linux as an inode. The inode contains all the meta-data to manage objects in the file system. Another set of structures, called dentries, is used to translate between names and inodes, for which a directory cache exists to keep the most-recently used around. The dentry also maintains relationships between directories and files for traversing file systems. Finally, a VFS (Virtual file system) file represents an open file (keeps state for the open file such as the write offset, and so on). While the majority of the file system code exists in the kernel (except for user-space file systems), (2.3) shows the Linux file system from the point of view of high-level architecture and the relationships between the major file system-related components in both user space and the kernel. The boot task and start up task of Windows XP A good understanding of what happens to disk data at startup is also an important aspect as accessing to a computer system after it was used for illicit reasons can alter the disk evidence. First, we will discuss about the Windows XP startup and boot process, and then shift into the startup and boot process of Linux. Like any other PC system, Windows XP startup by running the POST test, performing an initialization of its intelligent system devices, and performing a system boot process. The boot process begins when the BIOS starts looking through the system for a master boot record (MBR). This record can reside on drive C: or at any other location in the system. When the BIOS execute the master boot record on the hard drive, the MBR examines the disks partition table to locate the active partition. The boot process then moves to the boot sector of that partition located in the first sector of the active partition. There, it finds the code to begin loading the Secondary Bootstrap Loader from the root directory of the boot drive. In NTFS partition, the bootstrap loader is named NTLDR and is responsible for loading XP operation system into memory. When the system is powered on, NTLDR reads the Boot.ini file. If boot.ini contains more than one operating system entry, a boot menu is displayed to the user, allowing the user to choose which operating system is to be loaded. Fig (2.4) shows Boot.ini contains two operating systems and allows user to choose. After the user has selected the desired mode to boot to, NTLDR runs Ntoskrnl.exe and reads Bootvid.dll, Hal.dll and the startup device drivers. After the file system driver has loaded, control is then passed from NTLDR to the kernel. At this time, Windows XP display Windows logo. Virtually, all applications we installed using the default installation decide that they should start up when windows starts. Under â€Å"Startup† tab in the system configuration utility, a list of programs that run when our system boots is listed. Fig (2.6) shows the listed program when our system boots. The boot task and start up task of Linux After we have get into the start up process of Windows XP, we will then shift into the startup process of Linux. In Linux, the flow of control during a boot is also from BIOS, to boot loader, to kernel. When you turn on the power, the BIOS perform hardware-platform specific startup tasks. Once the hardware is recognized and started correctly, the BIOS loads and executes the partition boot code from the designated boot device, which contains Linux boot loader. Linux Loader (LILO) is the Linux utility that initiates the boot process, which usually runs from the disks MBR. LILO is a boot manager that allows you to start Linux or other operating systems, including Windows. If a system has two or more operating systems, LILO gives a prompt asking which operating system the user wishes to initialize. When the user chooses the boot option, it then loads the choosing operating system into memory. The boot program, in turn, reads the kernel into memory. When the kernel is loaded, the boot program transfers control of the boot process to the kernel. The kernel then performs the majority of system setup (memory management, device initialization) before spawning separately, the idle process and scheduler and the init process which is executed in user space. The scheduler takes control of the system management. The init process executes scripts as needed that set up all non-operating system services and structures in order to allow a user environment to be created, and then presents the user with a login screen. We have described about the way the data stored, the boot task and startup task of Windows XP and Linux. After a thorough study of these areas, we can acquire or handle the evidence properly. Task 3 a) Features comparison of â€Å"EnCase, Access Datas Forensic and ProDiscover† Features of Guidance EnCase Forensic * In courts worldwide, forensically acquire data in a sound manner using software with an unparallel record * Using a single tool and investigate and analyze multiple platforms * With prebuilt EnScript ® modules such as initialized Case and Event Log analysis, it can automate complex and routine tasks, so it save time in analyzing * Find information despite efforts to hide, cloak or delete * Can easily handle large volumes of computer evidence, view all relevant files that includes deleted files, file slack and unallocated space * Directly transfer evidence files to law enforcement or legal representatives as necessary * Include review options that allow non-investigators to review evidence easily * Include report options that enable quick report preparation Features of Access Datas Forensic Toolkit * Provides integrated solution that is no need to purchase multiple tools to complete a case. * Provides integrated database that avoid application crashes, lost work and product instability. * Identify encrypted files automatically from more than 80 applications and crack those files. * Supports international language that allows us easily search and view foreign-language data in our native format * Include email analysis that can recover and analyze a wide range of email and web mail formats * Can generate different industry-standard report formats quickly and concisely * Collect key information from the registry that include user information, date of application installed, hardware, time zone and recently used information * While processing takes place, we can view and analyze data Features of ProDiscover * To keep original evidence safe, it create bit-stream copy of disk for analyzing that includes hidden HPA section * For complete disk forensic analysis, it search files or entire disk including slack space, HPA section and Windows NT/2000/XP alternate data streams * Without alter data on the disk, it can preview all files including metadata and hidden or deleted files * Support for VMware to run a captured image. * In order to ensure nothing is hidden, it examine data at the file or cluster level * To prove data integrity, it can generate and record MD5, SHA1 and SHA256 hashes automatically. * Examine FAT12, FAT16, FAT 32 and all NTFS file systems including Dynamic Disk and Software RAID for maximum flexibility. * Examine Sun Solaris UFS file system and Linux ext2 / ext3 file systems. * Integrated thumbnail graphics, internet history, event log file, and registry viewers to facilitate investigation process. * Integrated viewer to examine .pst /.ost and .dbx e-mail files. * Utilize Perl scripts to automate investigation tasks. * Extracts EXIF information from JPEG files to identify file creators. * Automated report generation in XML format saves time, improves accuracy and compatibility. * GUI interface and integrated help function assure quick start and ease of use. * Designed to NIST Disk Imaging Tool Specification 3.1.6 to insure high quality. AccessData FTK v2.0 Guidance EnCase Forensic 6.0 ProDiscover Forensic Report for Choosing Access Datas Forensic Toolkit I think Access Datas Forensic Toolkit is the most beneficial for our lab as it provides more forensic examination features than Encase and ProDiscover. In the evidence aspects, Access Data can acquire files and folders than others. So, it can be a powerful tool when we analyze files for evidence. Moreover, it uses database to support large volume of data that can avoid application crashes, lost work and product instability for our lab. As Access Data is a GUI-based utility that can run in Windows XP, 2000, Me, or 9x operating system and it demo version has most of the same features as full-licensed version, use multi-threading to optimize CPU usage, has task scheduler to optimize time and can view and analyze data while processing takes place, it meets the requirements of our lab. What is more, it supports international language so we can retrieve data no matter which languages they are using. On top of that, it is powerful in searching, recovery, email and graphic analysis. Because of these reasons and by viewing the above forensic tools comparison chart, I can conclude that Access Datas Forensic Toolkit is the most beneficial for our lab. b) Forensic Analysis Report for â€Å"Analyzing FAT32, NTFS and CDFS file system Using Access Datas FTK† Task 4 a) MD5 hash values of bmp, doc, xls files All hash values generated by the MD5 before modification is not the same with the hash value generated after modification. b) Why hash values are same or different A hash value is a numeric value of a fixed length that uniquely identifies data. Data can be compared to a hash value to determine its integrity. Data is hashed and the hash value is stored. At a later time or after the data has been received from mail, the data is hashed again and compared to the stored hash or the hash value it was sent to determine whether the data was altered. In order to compare the hash values, the original hashed data must be encrypted or kept secret from all untrusted parties. When it compared, if the compared hashed values are the same, then the data has not been altered. If the file has been modified or corrupted, the MD5 produces different hash values. In task 4 (a), first we created a doc file with data in this file, then we generated hash values of doc file with MD5. The hash value of info.doc file is da5fd802f47c9b5bbdced35b9a1202e6. After that, we made a modification to that info.doc file and regenerate the hash values. The hash value after modifying is 01f8badd9846f32a79a5055bfe98adeb. The hash value is completely different after modifying. Then we created a cv.xls file and generated the hash value. Before modifying, the hash value is ef9bbfeec4d8e455b749447377a5e84f. After that we add one record to cv.xls file and regenerated hash values. After modifying, ccfee18e1e713cdd2fcf565298928673 hash value is produced. The hash value changed in cv.xls file after data altered. Furthermore, we created fruit.bmp file to compare the hash value before and after modification. The hash value before modifying is 8d06bdfe03df83bb3942ce71daca3888 and after modifying is 667d82f0545f0d187dfa0227ea2c7ff6. So, the hash values comparison of bmp files is completely different after data has been modified. When we encrypted the text file into each image file, the text file is not visible in the image viewing utility and each image file is like its original image file. However, the comparison of the hash values of each image file before and after inserting short messages is completely different. As each image file has been altered by inserting short message, the regenerated hash value is totally different from the original hash values. On top of that, the original image file size has been changed after inserting short messages. The raster image file has slightly increased its file size after it has been modified. The raster image file size is increased from 50.5 KB to 50.7 KB. However, of the remaining three, two image files vector and metafile have decreased its file size a little sharply. The original file size of vector is 266 KB and has been decreased to 200 KB after modified. The metafile also decreased from 313 KB to 156 KB. Only the bitmap is remains stable as its file size does not increase or decrease. In a nut shell, we can conclude that the hash value would change if the file has been modified. However, depending on the file format, the file size can increase, decrease or remain stable. d) Report for â€Å"differences of bitmap, raster, vector and metafile† A bitmap image is a computer file and it is collected with dots or pixels that form an image. The pixel of bitmap is stored like a grid, tiny square. When we use the paint program, we can see the bitmap pixel is like a block and it is draw or clear block by block. A raster image is also a collection of pixels but the image stored pixels in rows to make it easy to print. And raster image is resolution dependent. It cannot scale up to an arbitrary resolution without loss of apparent quality. This is overcome by the vector image. Vector image is made up of many individual, scalable objects. These objects are defined by mathematical equations rather than pixels, so it always render at the highest quality. There are many attributes in vector like color, fill and outline. The attributes can be changed without destroying the basic object. Metafile is a combination of raster and vector graphics, and can have the characteristics of both image types. However, if you create a metafile with raster and vector and enlarge it, the area of raster format will lose some resolution while the vector formatted area remains sharp and clear. If we have lost an image file, before doing anything, we should be familiar with the data patterns of known image file types. Then the recovery process starts. The first step in recovery is to recover fragments file from slack space and free space. The fragment file can locate the header data that is partially overwritten. So, we use Drivespy to identify possible unallocated data sets that contain the full or partial image header values. To locate and recover the image header, we need to know the absolute starting cluster and ending cluster. If not, we could collect the wrong data. Using Drivespy, we can know started cluster number and file size of image that we want to recover. To know the exact ending cluster, add the total number of clusters assigned to the starting cluster position. As we have known the size of image file, we can calculate the total number of clusters. Then, we can locate the image file and retrieve image header. After we get the header value, open the file with Microsoft Photo Viewer. If the file has been opened successfully, then recovery of image file has been completed. If not, we need to use the Hex Workshop to examine the header of the file. Task 5 Report for â€Å"Investigation that prove Naomis innocence† Before we begin tracing an email, we should know which email is illegal and what constitutes an email crime. Illegal email includes selling narcotics, extortion, sexual harassment, stalking, fraud, child abductions, and child pornography. As Jazebel has received an offensive email, so we need to access the victim computer and copy and print the offensive email to recover the evidence contained in the email. Microsoft Outlook, Outlook Express or any other GUI email programs supports for copying the email from inbox to the place that we want to by dragging the message to the storage place. When copying email, the header of the email must be included as it contains unique identifying numbers, such as IP address of the server that sent the message. This helps us when tracing the email. After copy and printing the message, we should retrieve the email header to get the sender IP address. Right click on the message and choose message options to retrieve the email header. The following shows the header information that retrieved from the mail of the victim computer. At line 1(10.140.200.11) shows the IP address of the server sending the e-mail, and provides a date and time that the offending e-mails was sent. Although when we see at line 5, the victim is seemed to be Jezebel, however, line 1 identifies that the e-mail that is sent from the IP address (10.140.200.11) is the same as the victims computer IP address. So, we can conclude that Naomi does not include in sending offensive e-mail. She is innocence and the victim, Jezebel himself, is the one who send the offensive e-mails. References: Computer Forensics Textbook http://www.computerforensicsworld.com/index.php http://www.crime-research.org/library/Forensics.htm http://ixbtlabs.com/articles/ntfs/ www.wikipedia.com