Marketing funtions

Principles of Marketing Seaworthy College In any type of organization, the internal marketing strategy and end result can greatly affect the outcome of any measured external results. Internal marketing is created and carried out In order to align, motivate and empower all employees on all levels of the business. When employees feel motivated and empowered, what follows is typically positive customer experiences that are truly aligned with the firms' organizational goals. Success in any business starts with the many roles that employees will play, in which each roll affects all others.One role the employee will play is the worker that they are in the environment they are provided. An employer or internal marketer needs to provide a work environment that enables the employee to feel excited and rewarded by their everyday duties. If the employee feels motivated by the excitement or reward, they will strive to Increase their performance. Increased performance, In turn, Increases customer satisfaction. With both employees and customers satisfied, all levels of the organization will then be satisfied. If satisfied, the employees and customers will remain loyal to the organization.Employees will also be more apt to remain loyal if they are aware of any possible challenges and given direction. All of these roles will help evolve and preserve the compass culture, with little culture or low productivity could greatly benefit from internal marketing. Internal marketing is also achieved through quality management training. This is a form of training that will enable the staff to see the cycle between employee relations and producing quality products or services. Communication with employees will increase heir knowledge, which in turn creates greater awareness and allows for the expression of opinion.Along with communication and awareness, incentives can greatly affect attitude, knowledge, and the willingness to offer an opinion. Some incentives available are positive worki ng conditions, salary recognition, and personal growth. Positive internal marketing looks to adjoin departments which will increase harmony and further improve communication. Overall, the main objectives of internal marketing are to keep the internal stakeholders satisfied and motivated. In turn, as an end result, it will keep the external customers satisfied. It will also improve employee relations and core competencies.Core competencies are defined as the strengths and advantages of a business. These competencies allow a company to expand, but should be unique enough where they cannot be replicated. All internal marketing will affect the external outcomes of each business. When the internal strengths are matched with external opportunities, all needs of customers will be met. Therefore, organizations should convert any internal weakness to strengths and all external threats into opportunities. Internal strengths ND weaknesses should be analyzed for insight on accomplishing any int ernal goals.It will also open awareness for advantages in achieving external goals. A review of employees and production will allow someone to spot possible advantages or impediments. A review of the financial ratios should be conducted to compare with other competitors. Possible external opportunities would be gaps in the market where no company is actually serving. This will allow for a new market or growth opportunity. Possible threats would be any competitors or new products. Most successful businesses not only consistently analyze their marketing, but also look to create a customer centered business.This is done by starting with the customers instead of starting with the product. Starting with the customer is creating a business' actions to support sales and staff to meet the specific clients' needs. More simply put, it's putting the customer first. Same positive result. The strategies are based around creating a quality product and correctly responding to complaints and inquir ies. This is achieved through seven steps that are completed at the business level. The first step is to communicate your central philosophy simply but meaningfully. A few short words shouldn't be hard to remember but mean the business.The second step is to elaborate the company's core values. This is a definition of how the customers, employees, and vendors should be treated at all times. The third step is to reinforce your commitment continually. The more often it is stated, the better it will stick. The fourth step is to make it visual. If an employee sees the philosophy and commitment in every day surroundings, it will become second nature. If the customer sees the same, they will begin to realize what the company strives on. The fifth step is to make it a focus during orientation.Orientation is the time where new hires take the key elements of the business away from the table. If it is mentioned in orientation, they will know the importance. The sixth step is to train, support, hire, and enforce. Some employees need to be taught and encouraged to follow new ways of thinking and acting. This will, in turn, generate loyalty and enthusiasm amongst customers. This is typically done through training, learning, coaching, observation, and feedback. The final step is to instill the idea of including the world. It creates the actions of going above and ended. Customer's decisions are based on a five step process.This process consists of problem recognition, information search, alternative evaluation, purchase decision, and post purchase behavior. Interactions with a company can be placed anywhere in steps two through four due to impact factors. These impact factors consist of past experiences, cognitive bias, individual differences, personal relevance, and escalation of commitment. Past results of a product will determine if the product will continue to be purchased. If the result was positive, then the action will be repeated. If the result was negative, then the action will be avoided in the future.Cognitive bias consists of many factors. Belief bias is the overconfidence on prior knowledge. Hindsight bias is when one is ready to explain the inevitable. Omission bias is omitting any info that may be perceived as risky. Confirmation bias is that the customer observes what they expected. Individual differences are based on socioeconomic status, age, and cognitive abilities. The older generation may be more confident in decision making because they have more ability to apply strategy. The socioeconomic status is meaning that some may eve less access to education and resources so they are not informed enough to make a decision.Personal relevance comes from a person feeling that their decision matters. When they feel this way, they are more likely to decide. They want to see the importance of their actions. Escalation of commitment is simply continued loyalty. Decisions, it's time to investigate the effectiveness of the marketing. This is done by various investigation techniques. One way is through search engine optimization. This is the ability to gauge the company's popularity as compared to other companies. It tracks how many times internet users have clicked on the links for the particular site.Another option is through quarterly revenue. This compares revenue against marketing campaigns. This will inform you of what actually makes the product sell. Surveys are a basic way of questioning how people feel. Surveys are done in a variety of ways, but if sent via email, there are certain services that are able to track how many of the sent emails were opened. From that number, they can they track how many went into the website. All of the options for data collection are sent through a marketing decision purport system. This is a system that is used to interpret and evaluate data.

Media Impect Essay

Introduction Children and adolescents have access to and consume a variety of different media forms, including television, the Internet, music and music videos, film and video games, many of which contain high levels of violent content. The concern (and the controversy) lies in whether violent content in media affects a young person’s beliefs and behaviors, and more specifically, if frequent exposure contributes to increased aggression and even violence in young people. Much of the research on the relationship between media exposure and aggression supports such a connection. Although critics have challenged the validity of these findings, suggesting that the studies focused only on short-term effects and were conducted in controlled laboratory settings, one study suggests that exposure to violent media in home environments has long-term implications.1 Promising strategies for reducing exposure to media violence are available and include limit setting by parents/guardians, technological innovations such as the v-chip (which blocks inappropriate shows or content from being viewed by children), and media literacy training. Scope of the Problem Most American homes (99%) have a television set, and â€Å"over half of all children have a television set in their bedrooms.† After sleeping, watching television is the most frequent activity of children. The average child spends 28 hours a week watching television. By the time the average child is 18 years old, he or she will have witnessed 200,000 acts of violence, including 16,000 murders. Up to 20 acts of violence per hour occur in children’s programming.2 Movies, music videos, video games, and the Internet also contain high levels of violent content correlated with youth violence. Internet websites showing violence (killing, shooting, fighting, etc.) correlate with a 50% increase in reports of seriously violent behavior. Violence on the internet is also possibly the most damaging and in need of more research.3 In 2003, about 12.5% of roughly 22 million adolescents (10-14 years old) saw 40 of the most violent movies.4 One recent study showed a physiological connection with desensitization to violent video games.5 There is little research on the effects of music videos and behavior, but there is limited information on rap videos and their effect on aggressive attitudes.6 Media as a Risk Factor The relationship between exposure to violent media and aggression has been researched extensively over the past 30 years. Different types of studies have confirmed a correlation.2 A review of almost 600 studies shows three main results of media violence: aggression, desensitization, and fear.7 Exposure to media violence also has been correlated with changes in youth attitudes about the use of violence in interpersonal relationships.8 While the evidence may be compelling, translation of these findings to the â€Å"real† world has been problematic.6 Findings are criticized on the grounds that most studies were conducted under controlled laboratory conditions and focused on short-term changes in behavior. It is unclear whether violent media has similar effects when viewed in home or community settings and whether such exposure has long-term consequences.8 Research involving the Children in the Community Study addressed these limitations and demonstrated a relationship between consistent consumption of media (3 hours a day) in the home/community and an increased likelihood of aggression toward others. Researchers followed 707 families for a 17-year period and examined the relationship between consumption of media and aggression, using youth self-report, parental report, and criminal arrest data. Forty-two percent of males who viewed television more than 3 hours per day at age 14 were reported to have been involved in aggressive acts that resulted in injury when they were 16 or 22 years old, this compared to 9% of males who viewed less than 1 hour of television per day. This relationship persisted even after controlling for other factors such as prior history of aggressive behavior, child neglect, neighborhood violence, family income, psychiatric disorders, and gender.1 Social learning theory provides an explanation for how violent media may influence childhood aggression. Social learning theory posits that a child learns how to act and forms his or her attitudes from observing important role models in his or her life. Characters portrayed in the media may become models that influence the child’s attitudes, beliefs, and behavior. He or she may learn to see violence as a part of everyday life and an acceptable way to solve interpersonal problems. Because violence in the media is so frequently presented without negative consequences, youth may fail to accurately assess or even understand the real-life consequences of violent actions against others.8 Children 7 years and younger do not understand the difference between reality and fantasy, according to research.9 Developmentally, they are less able to discern reality from fantasy and are more likely to be emotionally and cognitively affected by the violence they observe.8 Finally, the effects of violent media appear to be race-, class-, and gender-blind. Violent media influences both males and females (although some data suggest that males may be slightly more affected), and while some studies suggest a connection between socioeconomic and community factors and vulnerability to the effects of media violence, most research shows that all groups can experience the effects of media violence on attitudes and behaviors.8 Promising Strategies At present, little research exists on the effectiveness of different interventions for reducing the effects of violent media on children. Some common sense approaches such as limiting children’s access to violent media and teaching them to be informed media consumers have gained support from professional and legislative groups. Despite the lack of research, available interventions have both intuitive and theoretical appeal. Limiting Access To and Consumption of Violent Media Researchers have found that limiting media consumption, including television viewing and video game playing, can reduce short-term aggressiveness in children.10 Since the majority of children’s media exposure occurs in the home, parents/caretakers play a pivotal role in limiting consumption both by monitoring their child’s viewing habits and by regulating what and how much media they consume. Parents/guardians should engage their children in discussion of this issue but realize that they may not share their children’s opinions or interpretations of violent programming and content. 8 In 1996 Congress passed the Telecommunications Act, which was intended to assist parents and caregivers in reducing children’s exposure to violent media.11 The legislation calls for the inclusion of V-Chips in all new televisions and for the development of a rating system to enable parents/caretakers to assess the violence content of specific shows.11,12 The ratings system, however, is voluntary and networks are allowed to rate their own shows.9 To some extent, the industry is responding with devices such as Weemote and TVGuardian, which can filter out certain television channels and even offensive language, thereby providing some level of parental control over children’s viewing preferences.12 Developing Media Literacy in Parents and Youth Another strategy to reduce the effects of violent media is media literacy training. Parents/caregivers and children are taught to critically appraise the media they consume and develop strategies for reducing exposure to violence. They are taught to distinguish between real and fantasy violence, identify the real-life consequences of violent acts that occur in the media, critically assess the motivations of the producers in making the media product, and describe nonviolent alternatives to the violent actions contained in the programming. Despite this training, â€Å"more than half of Americans do not know their television is equipped with a V-Chip and two-thirds have never used it.† 9 Media literacy training resources include the Just Think Foundation, which focuses on children by providing educational programs that can be utilized during or after school and on-line13; the Center for Media Literacy, which offers media literacy training for teachers, parents, and community, civic, and youth leaders through exercises and activities in small group settings14; and the American Academy of Pediatrics Media Matters program, which provides training for health care professionals in media literacy and educational materials for use in the health care setting. 15 References 1. Johnson Jeffrey G., Patricia Cohen, Elizabeth M. Smailes, Stephanie Kasen, and Judith S. Brook. 2002. â€Å"Television viewing and aggressive behavior during adolescence and adulthood.† Science295(5564):2468-2471. 2. Beresin, Eugene V. 2009. â€Å"The Impact of Media Violence on Children and Adolescents: Opportunities for Clinical Interventions.† American Academy of Child Adolescents Psychiatry. Retrieved February 16, 2010 (http://www.aacap.org/cs/root/developmentor/the_impact_of_media_violence_on_chi ldren_and_adolescents_opportunities_for_clinical_interventions). 3. See Ybarra, Michele L., Marie Diener-West, Dana Markow, Philip J. Leaf, Merle Hamburger, and Paul Boxer. 2008. â€Å"Linkages between Internet and Other Media Violence with Seriously Violent Behavior by Youth.† Pediatrics 122(5):929-937. Retrieved February 23, 2010 (www.pediatrics.org/cgi/doi/10.1542/peds.2007-3377). 4. Worth, Keilah A., Jennifer Gibson Chambers, Daniel H. Nassau, Balvinder K. Rakhra, and James D. Sargent. 2008. â€Å"Exposure of U.S. Adolescents to Extremely Violent Movies.† Pediatrics 122(2):306-312. Retrieved February 23, 2010 (www.pediatrics.org/cgi/doi/10.1542/peds.2007-1096). 5. See Carnagey, Nicholas L., Craig A. Anderson, and Brad J. Bushman. 2007. â€Å"The effect of video game violence on physiological desensitization to real-life violence.† Journal of Experimental Social Psychology 43:489-496. Retrieved February 23, 2010 (http://anderson.socialpsychology.org/). 6. US Department of Health and Human Services. 2001. Youth Violence: A Report of the Surgeon General. Rockville, MD: US Department of Health and Human Services, Centers for Disease Control and Prevention, National Center for Injury Prevention and Control, Substance Abuse and Mental Health Services Administration, Center for Mental Health Services and National Institutes of Health, National Institute of Mental Health. 7. Murray, John P. 2008. â€Å"Media Violence: The Effects Are Both Real and Strong.† American Behavioral Scientist 51(8):1212-1230. 8. Bushman, Brad J., and L. Rowell Huesmann. 2001. Effects of Televised Violence on Aggression. In: Singer DG, Singer JL, eds. Handbook of Children and the Media. Thousand Oaks, CA: Sage Publications. 4 9. Federal Communications Commission. In the matter of violent television programming and its impact on children: statement of Commissioner Deborah Taylor Tate. MB docket No. 04-261, April 25, 2007. Available at: http://fjallfoss.fcc.gov/edocs_public/attachmatch/FCC-07-50A5.pdf. Accessed February 23, 2010. 10. Robinson, Thomas N., Marta L. Wilde, Lisa C. Navracruz, K. Farish Haydel, and Ann Varady. 2001. â€Å"Effects of reducing children’s television and video game use on aggressive behavior: a randomized controlled trial.† Arch Pediatr Adolesc Med. 155:17-23. 11. See http://www.fcc.gov/telecom.html 12. See http://www.familysafemedia.com/v-chip.html 13. See http://www.justthink.org 14. See http://www.medialit.org 15. See http://www.aap.org/advocacy/mediamatters.htm Related Publications on Media Violence Anderson CA, Dill KE. Video games and aggressive thoughts, feelings, and behavior in the laboratory and in life. J Personality Social Psychol. 2000;78:772-790. Bushman BJ. Effects of television violence on memory of commercialized messages. J Exper Psychol Applied. 1998;4:291-307. Council on Communications and Media. 2009. â€Å"Policy Statement: Media Violence.† Pediatrics 124(5):1495-1503. Retrieved February 23, 2010 (www.pediatrics.org/cgi/doi/10.1542/peds.2009-2146). Tangney JP, Feshbach S. Children’s television viewing frequency: individual differences and demographic correlates. Personality Social Psychol Bull. 1998;14:145-158. Willis E, Strasburger VC. Media violence. Pediatr Clin North Am. 1998;45:319-331. Internet Resources American Academy of Pediatrics Media Matters: http://www.aap.org/advocacy/mediamatters.htm The Center for Media Literacy: http://www.medialit.org Center for the Prevention of School Violence: http://www.ncdjjdp.org/cpsv

Organisational Performance and Customer Satisfaction Equation.

As the Chief Executive Officer of Sierra Lighthouse Hotel Freetown, I’ve been provided with an Organisational Performance and Customer Satisfaction equation: Consumer Expected Quality – Organisational Actual Quality = Customer Perceived Quality EQ > AQ => Dissatisfaction EQ = AQ => Mere Satisfaction AQ > EQ => Delighted Customer An Organization Performance includes multiple activities, that help in establishing the goals of the organization, and monitor the progress towards the target. It is used to make adjustments to accomplish goals more efficiently and effectively. Organization Performance is what business executives and owners are usually frustrated about. This is so because, even though the employees of the company are hard-working, and are busy doing their tasks, their companies are unable to achieve the planned results. Results are achieved more due to unexpected events and good fortune rather than the efforts made by the employees. Customer satisfaction, a business term, is a measure of how products and services supplied by a company meet or surpass customer expectation. It is seen as a key performance indicator within business and is part of the four of a Balanced Scorecard. The balanced scorecard (BSC) is a strategic performance management tool – a semi-standard structured report supported by proven design methods and automation tools that can be used by managers to keep track of the execution of activities by staff within their control and monitor the consequences arising from these actions. In a competitive marketplace where businesses compete for customers, customer satisfaction is seen as a key differentiator and increasingly has become a key element of business strategy. Organizations need to retain existing customers while targeting non-customers. Measuring customer satisfaction provides an indication of how successful the organization is at providing products and/or services to the marketplace. Customer satisfaction is an abstract concept and the actual manifestation of the state of satisfaction will vary from person to person and product/service to product/service. The state of satisfaction depends on a number of both psychological and physical variables which correlate with satisfaction behaviors such as return and recommend rate. The level of satisfaction can also vary depending on other factors the customer, such as other products against which the customer can compare the organization's products. Consumer Expected Quality – Organisational Actual Quality = Customer Perceived Quality Analyzing the equation showing how it could lead to all the possible customer perception outcomes: EQ ; AQ =; Dissatisfaction EQ = AQ =; Mere Satisfaction AQ ; EQ =; Delighted Customer The above figure provides a view of the process in which customers needs and expectations are translated into output during the design, production and delivery process. True consumer needs and expectations are called Expected Quality ( EQ ). EQ is what the customer assumes will be received from the product. The producer identifies these needs and expectations and translates them into specification for products and services. Actual Quality ( AQ ) is the outcome of the production process and what is delivered to the customer. AQ may differ considerably from EQ. This difference happens when information gets lost or misinterpreted from one step to the next. Perceived Quality ( PQ ) is the customer's perception of the overall quality or superiority of a product or service with respect to its intended purpose, relative to alternatives. The quality of the product may considerably differ form what the customer actual receives. Because PQ derives customer behavior, this area is where producers should really concentrate. Any difference between the EQ and AQ can cause either a delighted customer ( AQ > EQ ) or dissatisfied customer ( EQ> AQ ), but when EQ = AQ results in merely satisfied customer. EQ > AQ = Dissatisfaction This is were in the actual quality of a product or service is greater than what the customer expected I. e. the expected quality. Example, a person may have heard only good things about the food at Sierra Lighthouse restaurant and decides to eat there. The food is expensive since it’s a five star hotel. Upon arrival he orders a dish and instead of being served within 20 minutes like it’s suppose to be the dish comes after 45 minutes. The customer tastes the food and it’s tasteless, the customer would be dissatisfied and would never visit Sierra Lighthouse. The customer would also tell his friends and family about his/her bad experience and they too would never visit Sierra Lighthouse. EQ = AQ = Mere satisfaction This is were in the what a customer expects ( EQ ) is exactly what the customer gets ( AQ ). Example, a person is used to eating grilled shrimps at Kimbima’s Restaurant then a friend comes along and offer to take him/her to Sierra Lighthouse for Dinner. The customer orders grilled shrimps at the Sierra Lighthouse and when customer taste the food it’s tastes the same as Kimbima’s. The customer would have a mere satisfaction because that’s the taste he/she has been used to already. All the customer would have is another place to eat his/her favourite dish in case Kimbima runs out of shrimps. AQ > EQ = Delighted Customer This is were in what a customer gets from a product or service ( AQ ) is more than what the customer expected ( EQ ). Example, a person is used to eating Pizza at King David’s restaurant and one day a friend tells him the pizza at Sierra Lighthouse is better. The person decides to visit Sierra Lighthouse with already high perception of the pizza prepared there. The customer orders a large pizza and was told that by ordering a large pizza he/she gets 1 small pizza free. When the pizza arrived and the customer tasted it, it was more delicious than he/she imagined. The customer was delighted because he/she not only at a very delicious pizza but he had an extra one to go home. As the CEO of Sierra Lighthouse Hotel I would like to show in details how I can create dissatisfaction, mere satisfaction and Delight in my customers using my hotel. A Japanese professor Noriaki Kano, suggests three classes of customer requirements: Dissatisfiers Satisfiers Exciters/Delighters Dissatisfiers- These are linked to customer dissatisfaction. These are requirements that are expected by customers in a product or service which are generally not stated by a customer but assumed to be there. If these features are not present the customer would be dissatisfied. Example, a customer takes a room at Sierra Lighthouse hotel for a week, he/she knows that it is a five star hotel and it should have certain standards. Five star hotels most have a hair drier, hot water, air condition, towels ( both bath and hand towels ), 24 hour electricity, internet connection and cable TV. The customer who is a woman after unpacking and going for a shower and washing her hair realizes there is no hair drier. The customer would be dissatisfied because it is a most for a five star hotel to have a hair drier in their bathrooms. Satisfiers- These are linked to mere customer satisfaction. These are requirements that customers say they want. Although these requirements are generally not expected fulfilling them creates satisfaction. Example, a customer calls and books a room at Sierra Lighthouse and tell us if possible he/she would like a room with a bath tub and a balcony with sea view if possible. When the customer is show his/her room it’s exactly what he/she asked for, the customer would be merely satisfied because he/she know that my hotel would always meet customer wants. Exciters/Delighters- These are linked to delighted customer. These are requirements that a customer doesn’t ask for or expect. These requirements are generally not asked for or expected but are offer to create delight. Example, a customer calls from over seas and books a room with Sierra Lighthouse hotel and gives us the date and time of his arrival. The hotel sends a car to the airport to pick up the customer, the customer would be delighted. This is because he/she didn’t ask or expected to be picked up but was delighted to see that the hotel offered an extra service. The effects of the three possible performance outcomes on the profitability or other wise of the organisation: Dissatisfaction When a customer’s expectation about a product or service is greater than the actual quality of the product or service, the customer will be dissatisfied. When a customer is not satisfied he/she would simple stop requiring the product or service I. . stop buying them. When a customer stops buying a product or service that mean the organisation looses that customer because the customer would go and look for a better replacement. If customers of an organisation are not satisfied with the product or service that, that organisation produces, then the organisation is not only loosing it customers but also looses it money. An unsatis fied customer is a customer who’d give bad publicity to the business, and as long as the word is out the business would start losing money because there would be no customers to buy their products or services. Dissatisfaction has a negative impact on the profitability of the organisation, which would eventually turn into loses and the collapse of the business. Mere Satisfaction When a customer is merely satisfied, it means that customer expectation is equal to the actual quality of the product or service. Merely satisfied customers are not enough for an organisation to become very profitable, instead the organisation maybe on the edge of collapsing. Customers may patronize the organisation out of loyalty, but for most customers, they’d be looking for somewhere to get extra value for their money’s worth. An organisation which offers products or services that merely satisfy it customer wouldn’t be very profitable. Either the organisation works on their quality to get delighted customers or shut down for good because in the long run the organisation would collapse. It will collapse because at the end of the day all the customers would leave to look for an organisation that will offer them better products or services. Delighted customer When a customer is delighted, it means that the actual quality of the product or services exceeds the customers expectation. A delighted customer has little incentive to even consider other brands. On the contrary, by changing brands they risk loosing some of their current delight. The organisation which delights it customers would become very profitable and have a great publicity. Old customer will keep on buying from that organisation and bringing new customer to the organisation.

Managing Partnerships - Governance UK Educational Charity Essay

Managing Partnerships - Governance UK Educational Charity - Essay Example (ICNL, 2002) Aiming to protect the public trust from the big and small charitable sectors, the Cabinet Office and the Charity Commission published the ‘Charities Act 2006’ – the most recent regulation for charities in England and Wales. In line with the purpose of providing the trustees with a more flexible and less bureaucracy among the small-scale charities, the new regulation implements some changes in the charity structures and administration. (p. 5) For this study, the researcher will critically discuss the partnership among the key stakeholders2 in relation to the governance of an educational charity including the factors that could make or break a good partnership among the major stakeholders. The trustees or Charity Trustees are people who are directly responsible in the management control of the charity’s administration. Based on the charity’s governing document, these people are sometimes called the trustees, managing trustees, committee members, governors, directors, or whichever title they may be referred to. (p. 46) The role of trustees or employees is voluntary but the Act allows the trustees to be paid for the services they have rendered for the charity provided that the terms are officially set out in a written agreement and that the amount paid to the trustees is reasonable. (p. 23) The Commission which is composed of up to four newly elected non-executive board members regulates the charities based on the newly implemented legal framework. (p. 42) In line with the purpose of increasing the public confidence on charities, the Commission strictly encourage the charity trustees to comply with the proper documentation and management of its administration in terms of effectively using its monetary resources and being accountable to the public, beneficiaries, and the donors. (p. 41) Based on Charity Act

See the dise Essay Example | Topics and Well Written Essays - 500 words

See the dise - Essay Example Its economy is strong and prosperous. This country is regarded as one of the finest place for the tourism. It holds almost 80% non- nationals as stated by Boleat (2012). One of the cities of U.A.E, Dubai is known as ‘city of Gold’. Boleat(2012) also reports about the economy of this country by saying â€Å"Dubai has a highly developed economy†. With increasing living standards and lifestyle people have become conscious about their lifestyles and looks. The rapid economic growth of the country has also contributed to improved diets and thereby obesity (Faust, 2012). This information from different resources suggest that population of U.A.E due to the availability of different fast foods and high scale income is directing themselves towards obesity. This fast growth in the obesity in U.A.E ‘s population has made them consious of their health. Different researches in this field have proved that people of U.A.E are becoming health – conscious and they are demanding for clothes that are specifically sports-outfits in which they can easily work out. This information about the need of opening sports clothing company in UAE is provided by Nasser who is form United Arab Emirates. He translated the local papers from there and provided the relevant information which was needed for the research. His information was a guide to study about the living standards, lifestyle, population, education, religion, language etc.Before analyzing the fitness adverstisements in the local megazines and the newspapers, the ethnographic research on the people of U.A.E was necessary. The conclusion drawn upon the information about the people was done with the help provided by Nasser. As U.A.E’s population consists of 80% of non – nationals; multi – cultured people live there. People are mostly Asians, mainly from Pakistan, India and Bangladesh. The languages spoken in this country are mixed Asian languages by the people. Apart from those languages English also

Mri tech Essay Example | Topics and Well Written Essays - 2000 words

Mri tech - Essay Example Therefore, with T1 weighted MRIs, the images will appear to be bright (high intensity). This is because the major composition of yellow marrow is fat and fat possess very short T1 relaxation phase. The red or hematopoietic marrow is framed up with 40% of water and fat and 20% protein. Water holds a longer T1 relaxation phase and therefore, the images of red marrow is low intense or dark in nature due to very low signal intensity. The diagnoses of bone marrow lesion on yellow marrow background are effective using T1 weighted MRIs but it can be difficult with the case of lesion on a red marrow. With T2 weighted images, the red marrow and yellow marrow cannot be easily distinguished. STIR is more effective than T2 weighted spin images. (Dimopoulos, Moulopoulos, 1997). The figure shows dark signals highlighted with small arrows that indicate the red marrow in the spinal region and bright signals highlighted with long arrows indicates yellow marrow around femoral epiphyses as well as apop hyses. This is an image of a normal bone marrow of a child. (Dimopoulos, Moulopoulos,1997). An abnormal situation characterized by severe pain and irritation in the knee as a result of high level of pressure offered from patella or kneecap is referred as Chondromalacia (cluett, 2010). The patella is normally covered with a smooth layer composed of cartilage. The cartilage moves effortlessly and flexibly across our knee and thus, facilitates easy bending of the knee joint. The case is different with patients affected with chondromalacia wherein the patella inclines to rub against one or another side of the joint. This results in irritation and pain in the knee. Chondromalacia patella symptoms include distributed knee pain mainly in the front and back side of knee cap. It is accompanied with worsening of pain while arising from an elongated sitting posture, climbing upstairs, wearing heels, kneeling or jumping. (Cluett, 2010) MRI appearance of chondromalacia comprises of signal hetero geneity surrounded by hyaline cartilage, predominantly with T2 weighted MR images, hyaline cartilage covered focal hyperintensity, mainly showing linear or focal abnormalities in the hyaline cartilage and asymmetrical configuration to the hyaline cartilage surface. It is required to use the modifier â€Å"severe† when variations that are greater than one cm in diameter are observed. If high density central defects are present then also the severe modifier need to be used. These defects can be distinguished from usual chondral defects by comparing the centralization of the final lesion that are widely spread and lacks surroundings (Loren, 2008) Full thickness chondral defect is appeared with high signal joint surface lesion represented in black arrow is covered by normal low intense hyaline cartilage on this spin echo T2 weighted image. (Loren, 2008) Osteochondritis dessecans is a medical condition that arises when certain amount of cartilage in a joint connected with a thin b oney layer separates from the rest of the bone. The affected person usually experience server pain, irritation and discomfort near a bone ending position. (Kennedy, no date) OCD is usually seen with larger joints such as the hips, knees and the ankles. The condition is also accompanied by severe rib pain. In association with rib pain, the uneasiness normally occurs in breastbone or in the spine where the ribs get connected. The major cause of OCD is certain type of repetitive injury or

Neoclassical architecture in England Essay Example | Topics and Well Written Essays - 2000 words

Neoclassical architecture in England - Essay Example Soane's style is marked by clean lines, adherence to form, detail, excellent sense of mood and light in the interior, which can be attributed to his influence to classical architecture. His creations, which came to be known by the end of the Georgian era were overshadowed by the Romantic period and it was only in the 19th century that he was duly acknowledged for his contribution. Though Soane's life is marked by controversies, his creations have left their mark and have been a source of inspiration for many. Born in 1753, this son of a bricklayer, trained under George Dance the Younger and Henry Holland before entering the Royal Academy Schools in 1771. His hard work was rewarded when he won a gold medal for his design for a triumphal bridge and a scholarship to France and Italy. This trip was significant since it not only shaped his opinions on architecture but also enabled him to form valuable contacts that would be of use to him in later years. It was during this study tour that he studied classical architecture in minute detail and worked on designs for many public buildings. He drew influence from the work of Ledoux, Boullee and Goindoin and got the chance to meet Piranesi in Italy. He later moved to Ireland in search of good prospects but had to return to England and set up a practice. His early career comprised renovations and additions to country est ates and in publishing his designs. The turning point of his career occurred when he took over as the architect and surveyor of the Bank of England. A major task, which set the tone for his later creations, he was entrusted with the responsibility of enlarging and rebuilding the entire structure of the bank, a complicated task because of its form and structure. He reconstructed the edifice using the Roman Corinthian, a variety found in the temple of Sibyl at Tivoli, which, despite its shortcomings, was considered a great innovation in that era. His most popular work, The Bank of England embodies the values of Greek architecture and had a profound influence on commercial architecture of that time. Soane served many posts many of which were controversial and it has been argued that his unconventional style flourished largely due to the security of his position. He undertook many public and private commissions such as public galleries and renovating country homes. He faced a lot of ridicule for his designs because though they were carefully planned, his later creations had a lot of faulty elevation details and ostentatious ornamentation. This did not affect Soane who gained membership to the Royal Academy in Britain and seven years later was elevated to first class, where he replaced late William Chambers. In 1806, he became a professor of architecture with a commitment to deliver series of lectures annually. He then began collecting various forms of art and books for the benefit of students of architecture, which were later, offered to the nation after his death. A quiet and a withdrawn person by nature, his architectural affiliations were based on French theory and exuberance combined with the formal opulence of the English picturesque theory. He was deeply influenced by classical architecture as his lectures laid emphasis on "good taste" and "sound judgement". But along with these values, he also stressed on the need for character and

The economic consequences for Ukraine in joining the Thesis

The economic consequences for Ukraine in joining the Russia-Belarus-Kazakhstan customs union - Thesis Example 1 Overview Statistics of Ukraine Economic Status p. 19 Fig. 2 Real Sector Performance of Ukraine p. 20 Fig. 3 State Budget Execution p. 21 Fig. 4 main State Budget Indicators for 2012-2013 p. 21 Fig. 5 Map of the Commonwealth of Independent States p. 22 Fig. 6 A Look at the Economic Picture for the CU in 2010-2011 p. 25 Fig. 7 EEU Timeline Implementation Infrastructure p. 29 Fig. 8 Nominal GDP of BRK Countries and Ukraine, 2000-2011 p. 32 Fig. 9 Structure of Gross Value Added in BRK and Ukraine, 2005 and 2010 p. 33 Fig 10 Structure of Industry by Branch in BRK and Ukraine, 2005 and 2010 p. 34 Fig. 11 Belarus Foreign Trade by Country Groupings p. 35 Fig. 12 Russia Foreign Trade by Country Groupings p.37 Fig. 13 Kazakhstan Foreign Trade by Country Groupings p. 39 Fig. 14 Ukraine Foreign Trade by Country Groupings p. 40 Fig. 15 Kazakhstan Foreign Trade Developments p.41 Fig. 16 Russia Foreign Trade Developments p.42 Fig. 17 Belarus Foreign Trade Developments p.43 Fig. 18 Ukraine Foreign Trade Developments p.44 Fig. 19 Service Imports p. 45 Fig. 20 Service Exports p. 46 Fig. 21 Belarus Export/Import Charts p. 47 Fig. 22 Kazakhstan Export/Import Charts p. 47 Fig. 23 Russia Export/Import Charts p. 48 Fig. 24 Common External Tariff of the BRK Customs Union p.50 Fig. 25 Gas Production Forecast Table 2005-2016 p. 52 Fig. 26 Gas Production Forecast Table 2014-2021 p. 53 Fig. 27 Major LNG Fields and Pipeline Network p. 54 Fig. 28 Global Competitiveness Index (GCI) Rankings p.55 Fig. 29 Mutualism in Europe: The Diverse Realities of the EU p. 57 Fig. 30 Common Principles of European Mutual Societies p.58 Fig. 31 Import Tariffs Before and After the Customs Union Creation p. 51 Fig.32.Global Financial... The purpose for this paper is to look at the surrounding circumstances of the Ukraine, what state the economy is in, what Ukraine’s main resources are, and how export and import situations would benefit if Ukraine were to join the Customs Union. In one section, three examples of Ukraine’s position in the marketplace will be examined with a projected analysis gleaned from literature review research as to whether joining the Union on a limited basis would be better or whether joining as a full member would be best, and finally, how Ukraine would manage by not joining at all. Consequently, this analysis would present a picture in time, based on certain circumstances only. War and natural disasters can strongly disrupt any strategic plans, no matter how carefully set up. Notwithstanding unexpected occurrences, perhaps other Unions may decide to relax some of their rules in order to bring Ukraine in to membership. For now, the European Union, while once a possibility, seems to be sidelined by Ukraine’s current political environment. The research motivation is to compare the various literature reviews by expert economists and scholars of scenarios and resulting factors of Ukraine joining the CU under various structures of membership. In that capacity, literature review is necessary for finding the picture currently available for the Ukraine and for the Customs Union through economic trends over the last few years and to bring that forward into the comparative analysis. The question in this thesis is to ‘determine how the Ukraine will fare economically if it does join the Common Union currently consisting of Russia, Kazakhstan and Belarus.’

Database Theory and Design Coursework Example | Topics and Well Written Essays - 500 words

Database Theory and Design - Coursework Example Normalization is a formal process for deciding which attributes should be grouped together in a relation (Elmasri & Navathe, 1994). It involves decomposing relations with anomalies to produce smaller, well-structured relations. Three problems usually arise in databases where relations are not normalized. First we could have insertion anomaly, this is where adding new rows forces the user to create duplicate data in the database. Secondly we have modification anomaly, i.e. where changing data in a row forces us to make changes to other rows because of duplication. Finally we have deletion anomaly which means that when we delete rows we may cause a loss of data that would be needed for other future rows (Connoly & Begg, 2005). First Normal Form (1NF) means that all multi-valued attributes are removed, so that we have a single value at the intersection of each row and column of the relation table. Second Normal Form (2NF) means we apply the rule for 1NF then we remove all partial functional dependencies. Third Normal Form means we apply the rules for 2NF then we remove all transitive dependencies. ASSIGNMENT – client-id#, consultant-id#, start-date, work-hours, job-code, rate-per-hour is in 2NF (second normal form). This is because rate-per hour is transitively dependent on job-code. Therefore to make ASSIGNMENT into third normal form (3NF) we remove rate-per-hour from its attributes to end up with ASSIGNMENT – client-id#, consultant-id#, start-date, work-hours,

Essay Example | Topics and Well Written Essays - 750 words - 102

Essay Example The geographical location of Johns Hopkins School of Medicine is Baltimore, Maryland, U.S. Johns Hopkins School of Medicine is an arm of Johns Hopkins University and is mainly popular for giving medical related educational programs and its involvement in medical researches. It is one of the highest rated medical graduate schools in the United States of America. Johns Hopkins School of Medicine was founded by famous medical professionals including William Henry Welch who was a pathologist, William Osler who was an internist, William Stewart Halsted who was a surgeon, and Howard Atwood Kelly who was a gynecologist (Grauer 165). Johns Hopkins School of Medicine is one of the highest rated medical higher learning institutions in terms of their performance in medical researches. Ithas been impressive in medical studies in the past four years. It has in a very long period been ranked amongst the best three research oriented medical higher learning institutes in the United States of America. This is something that can attract any nurse that is willing to further their education. One thing about medical related professions is that they highly rely on findings from researches and studies (Flynn and Longmore 211). As a nurse getting a chance to further your education at an institution whose prowess in medical researches has been proved is something that does not require any second thoughts. Another thing that is notable about the Johns Hopkins School of Medicine is that it has a team of highly capable teaching staff. In medical professions the skills and experience of instructors usually matters allot. This does not only matter in nursing, but also in other profession. At Johns Hopkins School of Medicine hiring of instructors and lecturers is always done on the virtue of the merits. Most of the lecturers who have been accorded contracts are people who have proved their ability in developing highly

Attitudes towards Christianity Essay Example | Topics and Well Written Essays - 750 words

Attitudes towards Christianity - Essay Example He has several incisive interpretations with regard to slaveholders’ religion. He described them as ‘allegedly Christians who have no worries about isolating and selling some of their own church members. He showcases different slavery styles practiced by native and European Americans. Â  Bibb presents an image of a man trapped between a dilemma of two worlds; a past of slavery and a freedom in the future that he was eagerly awaiting to be part of. Unlike other slave narratives, Henry Bibb showed the value of family through his relentless struggle for freedom. Â  Harriet Wilson uses her epigraph, ‘Our Nig’, to foreground images of blood, distress, crucifixion, and misery that the blacks experienced in the hands of their masters. Mrs. Wilson, unlike her fellow novelists of black origin within that particular decade, was able to underpin her materials a little more readily. This she did by taking a closer adherence to experiences which had details of pain and suffering. This epigraph showcases a horror of how the healthy body Frado is transformed to utmost liability from her toughest asset. She is beaten, tortured and even fractured just because her color was hated upon. Â  A bible (derived from a Latin word Biblia which means books) is made up of Christian scriptures which make up the books in the bible. These books are referred to as canons (a Greek word that refers to norms or rules). Canons contain only the authoritative books hence studied regularly during church sessions. Here the people are taught on the commandments and their importance to Christians. These commandments act as guidelines for the people maintaining a peaceful coexistence amongst them. These commandments are mostly derived from the old testament of the bible. Â  In Henry Bibb’s narrative, we learn that the slaveholders manipulated the scripture in the sense that it benefited them.

Vietnam and Iraq Wars Essay Example for Free

Vietnam and Iraq Wars Essay American involvement in Vietnam has roots which preceded the actual deployment of troops, just as the current chapter of the Iraqi War has roots that reach, some would argue, at least as far back as the end of World War II. These two arenas, where America chose to enforce its foreign policy at gunpoint, have many similarities, though ostensibly they appear to be radically different. The two wars began with two very different American presidents telling the Big Lie to the American people and their duly elected representatives, though there are subtle differences in how they came to be told. The Gulf of Tonkin Incident supposedly occurred when two American cruisers, operating within a few miles of the North Vietnamese coast are said to have come under fire by North Vietnamese gunboats. This fabricated incident led Congress to grant Johnson powers to prosecute the war. According to reports released under the Freedom of Information Act it is seriously doubtful as to whether such attacks actually occurred. The 21st century continuation of the Persian Gulf War of the 1990s began with an American president telling the American people and their duly elected representatives another Big Lie. He said, while in possession of reports to the contrary, that the leader of Iraq had amassed weapons of mass destruction, meaning, it was assumed, either nuclear devices or chemical and/or biological weapons. He further stated, knowing it was not likely, that the Iraqi leader was involved in the attack on the twin towers of the World Trade Center. For their own reasons, Lyndon Johnson and George Walker Bush both chose to obfuscate facts in furtherance of their political agenda. In Vietnam the American fighting men never lost an engagement with the enemy. They won every battle, yet lost the war. Some say the war was lost in the streets of America, victim of bad publicity. The French had held the Vietnamese in colonial slavery since the 19th century, and were only driven out by the Japanese in 1941. At the end of World War II the French decided that they had the right to return as feudal lords. The Viet Minh challenged this assertion, and in 1954, at the battle of Dien Bien Phu, they drove home their point. The French commander committed suicide before the garrison fell to the guerillas under command of the brilliant tactician, General Giap. France pulled out once again, but instead of letting Vietnam unify and hold elections, the U. N. partitioned it. This set the stage for North Vietnam’s president Ho Chi Min to begin to unify his nation by force, which the Americans inexplicably chose to challenge, culminating in Lyndon Johnson lying to get his war powers act through Congress. This war, which seemed to be the sole business of the Vietnamese people, became a quagmire to the Americans, and cost Johnson his presidency in the end. It brought shame and disrepute on the United States as Bush’s Iraqi War has done in the 21st century. Bush lied to obtain the needed powers to wage a war in Iraq. The Iraq War began with Americans watching U. S. Military power raining destruction from the air on the people of Iraq. The American president screamed, â€Å"Bring it on! † to taunt the enemy, and after a short time landed on an American carrier ship, greeted by a banner proclaiming, â€Å"Mission Accomplished†. Unfortunately that was another deception. Now Iraq, like Vietnam, is a quagmire and Bush has no more of an exit strategy then did Lyndon Johnson. Of Vietnam, Pete Seeger, the folk singer sang, â€Å"Waist deep in the big muddy, and the big fool said to push on† (Seeger 1967). The big muddy was, naturally, Vietnam, and the big fool giving the order to keep marching was Lyndon Johnson. Few march today in protest of an equally un-winnable war and no one but the loyal opposition calls Bush a big fool. Still the parents of America fatalities know that their sons and daughters are just as dead as those who died in Vietnam, for the same lame reasons, in wars justified by lies. In declassified documents released in late 2005, Robert Hanyok, a National Security Agency Historian said, â€Å"that a second attack, on August 4, 1964, by North Vietnamese torpedo boats on U. S. ships, did not occur despite claims to the contrary by the Johnson administration (Prados 2004). Prados, a NSA archivist has said he believes it is vital to have this information come to light, saying that the Johnson Administration, â€Å"used this claim to support retaliatory air strikes† (ibid). There are disturbing parallels between the lie concerning the Gulf of Tonkin Incident and the ‘manipulated’ intelligence used to justify the Iraqi War, according to the historian. It is only due to public pressure that the secret agency allowed the documents to be declassified some forty years after the fact. The Bush Administration did not want the truth out for the obvious reason of the comparisons that can be made to his untruths concerning Iraq. John W. Dean, former White House counsel to Richard Nixon, said in 2003, that, â€Å"[George W. Bush] made a number of unequivocal statements about the reason the United States needed to pursue the most radical actions any nation can undertake acts of war against another nation. †¦Now it is clear that many of his statements appear to be false† (Dean 2003). Dean posed the rhetorical question of whether lying to start a war is an impeachable offense against a sitting U. S. President. It is only rhetorical because of the fact the lying chief executive’s party had sufficient control of the legislative branch of government. The party apparently believed that lying about sex is impeachable but lying to start war is simply presidential politics. Bush began a series of misstatements, obfuscations, diversions and lies beginning in 2002 as he began to beat his war drum across the United States. In speech after speech he made wilder and wilder claims regarding the Iraqi weapons of mass destruction. Intelligence gathered by this and other governments leaves no doubt that the Iraq regime continues to possess and conceal some of the most lethal weapons ever devised (Bush, G. W. 2003). He even sent his Secretary of Defense, Donald Rumsfeld, on the speech circuit, saying (Rumsfeld) personally knew where these weapons were located. They were never found. They never existed. It was all a lethal charade foisted on America by the Bush/Cheney regime. It was argued that Vietnam was fought in defense of the Domino Theory. It has also been suggested that the Iraq War is being fought for the Haliburton Theory, in which American troops have seized Iraqi oil to increase the profits of an American corporation under the control of the sitting vice-president. What is proven is that the Iraq War, like its predecessor, the Vietnam War, was begun with a Big Lie for which the liar has not been called to account. Intelligence sources’ reports exposed each set of lies for what they are, yet neither Johnson nor Bush has been held accountable. References Bush, G.W. Iraq: Denial and Deception (speech) Mar. 17, 2003     Retrieved 5-10-08 From: http://www.whitehouse.gov/news/releases/2003/03/20030317-7.html Dean, J. 2003   Missing Weapons of Mass Destruction Retrieved 5-  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚  Ã‚   11-08 from: http://writ.news.findlaw.com/dean/20030606.html Prados, J. 2004  Ã‚  Ã‚  Ã‚  Ã‚   Tonkin Gulf Intelligence ‘Skewed’ Retrieved   5-10-08 From:

Motivation

Motivation Why are there multiple theories of motivation in organisational behaviour? Firstly I believe that we need to understand what motivation is before we can understand why there are lots of motivational theories. ‘Motivation comes from the Latin word movere, meaning ‘to move (kreitner R., kinicki A., Buelens M., 2002, p: 176) which means as fact, need, emotion and organic state which encourages a person to take an action. A persons performance at work is affected by several individual factors (Personality, attitudes and beliefs, motivation, perception) but in particular, by Motivation. The dictionary defines motivation as â€Å"the reason why somebody does something or behaves in a particular way† (Oxford Advanced Learners Dictionary of Current English, 2000, p1128). Many theorists over the years starting from the industrial revolution have analysed what makes workers work harder. This essay will illustrate why there are multiple theories of motivation I will be looking at two theories Maslows hierarchy and Hertzbergs two factor theories to try to determine why there is a need to have so many theories of motivation. Many organisations face difficulties when trying to motivate their staff. If the employees are motivated the company is likely to be more successful. To be able to understand motivation and the way it works, we have to understand human nature itself, managers also need to understand the work effort motivation cycle as to not loose there staff to more exciting rewarding and satisfying roles else were.( French, R., et al, 2008, Organizational Behaviour p157) There has to be effective management and leadership to motivate staff. Many companies believe that pay is the prime motivator; however people may want to exceed, receive acknowledgment for there efforts, they may want to feel a part of a group and also want to feel a heightened sense of worth at the workplace. This is where empowerment plays a very important part in a companys progression. ( French, R., et al, 2008, Organizational Behaviour. p 156) â€Å"Empowerment is the process by which managers delegate power to employees to motivate greater responsibility in balancing the achievement of both personal and organisational goals†. (Ref.- Chapter 4: Motivation and Empowerment page 184French, R. ,et al, 2008, Organizational Behaviour. Chichester: Wiley) By empowering employees this will make the staff more satisfied, productive and motivated throughout their working hours. Throughout the years many theorists have tried to explain what motivation is by designing theories describing how managers should stimulate their staff. (French, R. et al.,2008, Organizational Behaviour pp157-159) There are two main types of motivation theories content and process theories, the content theories look at the needs that individuals have, it includes 4 component theories: Maslows hierarchy of needs model, Alderfers modified need hierarchy model, McClellands achievement motivation theory and Herzbergs two-factor theories. The Process Theories are a understanding of the thought process that influence behaviour. The major process theories of motivation include Vrooms expectancy theory, goal-setting theory, and reinforcement theory and Adams equity theory. (French, R et al, 2008 Organizational Behaviour p160) Abraham Maslow has a structure which he has called the hierarchy of needs. There are five basic needs, which people are supposed to uphold. These are physiological, safety, social, esteem and self-actualization. (French, R et al, 2008 Organizational Behaviour p161) Physiological needs are food, drink, shelter and sex, Safety needs are the security and protection from physical and emotional harm. Social needs refer to a need for love. That means a person will strive for good relationships with people and a place within there group. .(Wilson, F M(2004) Organizational Behaviour and work) The needs that Maslow has at the bottom of the pyramid are based on basic needs concerned with survival or lower order needs, and these must be satisfied before a person can go to the next level on the hierarchy of needs until self actualization which Maslow argued that although everybody is able to, not many reach this level. (Wilson, F M (2004) Organizational Behaviour and work) While Maslows theory seems to make sense at first, there is little to show that a strict hierarchy works in every day working life. In fact research contradicts the order of needs because in some cultures they tend to put social needs before any other need. Maslows hierarchy also has trouble explaining cases such as the â€Å"starving artist† where a individual will neglect there physical needs to gain a spiritual need. Maslow also suggests that one need is satisfied at a time where there is no evidence this is true. In all motivation theories there are always advantages and disadvantages, Maslow has been critical of his theory himself, in a statement he said: â€Å"My motivation theory was published 20 years ago and in all that time nobody repeated it, or tested, or really analyzed it or criticised it. They just used it, swallowed it whole with only the minor modification† Ref- Wilson, F.M (2004). Organisational behaviour and work. Oxford University press, page146 (Lowry 1982:6 Clayton Alderfer proposed the ERG theory, which is very similar to Maslows theory, it also describes needs as a hierarchy. The letters ERG stand for three levels of needs: Existence, Relatedness, and Growth. This theory is based on the work of Maslow, so it has a lot which is similar with it but it also differs in some important aspects. He argues that Maslows theory is not flexible and as a result of this people may become frustrated as they are not able to move to the next stage. Alderfer has minimized Maslows 5 level theories into 3 levels; this theory is more flexible as people are able to go up and down the hierarchy if their needs keep changing. (French, R et al, 2008 Organizational Behaviour p160) Fredrick Herzbergs hygiene-motivation theory, Frederick Hertzberg put forward the idea that certain factors in the workplace cause job satisfaction, while others lead to dissatisfaction, he proposed the Two Factor theory of human motivation in the workplace, he believed that man has two sets of needs one as an animal to avoid pain and the second as a human being to grow psychologically. Hertzberg believes that the growth or the motivator factors such as achievement, the work its self, responsibility and advancement are the primary cause of job satisfaction. Hygiene factors the dissatisfiers using the term hygiene are considered maintenance factors that are to avoid dissatisfaction but by themselves do not provide satisfaction company policy, administration, supervision interpersonal relationships, working conditions salary status and security. Hertzberg used two open ended questions ‘tell me about a time when you felt exceptionally good about your job. and ‘tell me about a time when you felt exceptionally bad about your job.Herzberg analysed a diverse range of employees twelve different investigations informed the theory.( Herzberg et al 1959,. Wilson, F M(2004) Organizational Behaviour and work) There have been many criticisms of this theory one being some researchers have used other methods and have not been able to confirm the theory there for the theory is said to be method-bound as only Hertzbergs original method is able to support the theory. Other critics found it to be too convenient that Hertzbergs theory fits so neatly into two boxes, intrinsic contributing to job satisfaction and extrinsic to dissatisfaction. In the study by Ewan (1963) found that sometimes the hygiene factor, dissatisfies acted as satisfiers and satisfiers, motivators caused both satisfaction and dissatisfaction. (Wilson, F M(2004) Organizational Behaviour and work) Looking briefly at the most well known motivational theories David McClelland Need for Achievement Theory proposed that an individuals specific needs are acquired over time and are shaped by a persons life experiences. Most of the needs can be classed as achievement, affiliation, or power. A persons motivation in a certain job is influenced by these three needs. McCelland believed that having the right resources available such as raw materials, time, having the right skills to do the job and also having the necessary support to get the job done like supervisor support, or correct information on the job, McCelland believed that even if two of the three were met that there would still not be positive motivation and all three must be met to achieve positive motivation. (French, R et al, 2008 Organizational Behaviour pp163- 165) The expectancy theory of motivation is by Victor Vroom. Victor Vroom is very different to Maslow and Hertzberg, Vroom focuses on outcomes not on needs. Expectancy is the belief that more effort will lead to better performance. (French, R et al, 2008 Organizational Behaviour pp172- 174) Looking closely at the theories of motivation I believe that there are multiple theories of motivation as there is neither a right or wrong theory all seem to out line the basics of motivation weather it is in a hierarchy or set in two boxes we all have a need for the basics in life plus achievement, recognition and we all would be happier and more motivated to work in better conditions, I believe that a person has each one of these needs at or maybe many at a time so there for many theories are essential to get a wider knowledge of motivation and how to motivate an individual at work.

Computer Forensics Investigation and Techniques

Computer Forensics Investigation and Techniques Introduction I am the student of International Advanced Diploma in Computer Studies (IADCS). In this course, I have to do Compute Forensic assignment. The assignment title is â€Å"Didsbury Mobile Entertainments LTD†. This assignment helps me understanding computer forensics investigation and techniques Before this assignment, although I am interested in computer forensic, I am hardly used computer forensics toolkit or done any investigation. Because of this assignment, I have learnt many techniques how to investigate computer and done it practically. So, by doing this assignment, I have gained in practical and much valuable knowledge in Computer Forensics.nd a heartfelt thanks to all the people in Myanma Computer Company Ltd. for their warmly welcome during the period of the IADCS course and this assignment developed. Task 1 i) Report DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 10, 2010 Introduction Computer forensics involves obtaining and analyzing digital information for figuring out what happened, when it happened, how it happened and who was involved. What is more, it is use as evidence in civil, criminal, or administrative cases. Reasons for a need for computer forensic investigation Computer forensics investigation can recover thousands of deleted mails, can know when the user log into the system and what he does, can determine the motivation and intent of the user, can search keywords in a hard drive in different languages and can gain evidence against an employee that an organization wished to terminate. For these reasons, in order to know whether Jalitha has been spending her time on her friend business or not, we need a computer forensic investigation. Steps to pursue the investigation In order to pursue the investigation, I would take the following steps: 1) Secure the computer system to ensure that the equipment and data are safe 2) Find every file on the computer system, including files that are encrypted, protected by passwords, hidden or deleted, but not yet overwritten. 3) Copy all files and work on this copy files as accessing a file can alter its original value 4) Start a detailed journal with the date and time and date/information discovered 5) Collect email, DNS, and other network service logs 6) Analyze with various computer forensics tools and software 7) Print out an overall analysis 8) Evaluating the information/data recovered to determine the case Conclusion After we know the reasons and steps for investigation, then we should move on to conduct the investigation. However, we should note that the first step of investigation is critical as if the system is not secure, then the evidence or data we found may not be admissible. ii a) Report for â€Å"The procedures to make sure the evidence holds up in court† DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 12, 2010 Introduction Evidence is any physical or electronic information (such as computer log files, data, reports, hardware, disk image, etc) that is collected during a computer forensic investigation. The purpose of gathering evidence is to help determine the source of the attack, and to introduce the evidence as testimony in a court of law. Procedures to make sure the evidence holds up in court In order to make the evidence admissible in court, we need to follow the following steps: 1) Before any evidence can be gathered, a warrant must be issued so that forensic specialist has the legal authority to seize, copy and examine the data 2) Have the responsibility to ensure that the law and the principles we used are met 3) Evidence must be obtained in a manner which ensures the authenticity and validity and that no tampering had taken place 4) Tracking the chain of custody is essential for preparing evidence as it shows the evidence was collected from the system in question, and was stored and managed without alteration. 5) Extracted/ relevant evidence is properly handled and protected from later mechanical or electromagnetic damage 6) Preventing viruses from being introduced to a computer during the analysis process 7) To ensure that original evidence must be described in complete details to present reliable evidence on the court 8) Must arrange to answer reliability questions relating to the software we have used Conclusion In gathering evidence, authenticity, reliability and chain of custody are important aspects to be considered. By following the above steps, we are proper in handling the evidence holds up in court. ii b) Evidence form Didsbury Mobile Entertainments Ltd IT Department Computer Investigation Case No.: 005 Investigation Organization: Gold Star Investigator: Win Pa Pa Aye Nature of Case: Companys policy violation case Location where evidence was obtained: On suspects office desk Description of evidence: Vendor Name Model No./ Serial No. Item #1 One CD Sony Item #2 A 4GB flash memory device Kingston 05360-374.A00LF Item #3 Evidence Recovered by: Win Pa Pa Aye Date Time: 10.12.2009 10:00 AM Evidence Placed in Locker: E2419 Date Time: 15.12.2009 11:00 AM Item # Evidence Processed by Description of Evidence Date/ Time 1 Win Pa Pa Aye Fully recovered deleted email on the drive which is sent to Radasas company, including data exchange between the businesses. 13.12.2009 3:00 PM 2 Win Pa Pa Aye Encrypted document hidden inside a bitmap file. Decrypted and saved on another media. 18.12.2009 9:00 AM 3 Win Pa Pa Aye Password-protected document covering the exchange of information with her friend. Password cracked and file saved on another media. 22.12.2009 2:00 PM Task 2 Report for â€Å"the way the data is stored, boot tasks and start up tasks for Windows and Linux systems† To effectively investigate computer evidence, we must understand how the most popular operating systems work in general and how they store files in particular. The type of file system an operating system uses determines how data is stored on the disk. The file system is the general name given to the logical structures and software routines used to control access to the storage on a hard disk system and it is usually related to an operating system. To know the way the data is stored in Windows XP and Linux, we need to get into file systems of Windows and Linux. The way the data is stored in Windows XP In Windows XP, although it supports several different file systems, NTFS is the primary file system for Windows XP. So, we will have a look in NTFS as the NTFS system offers better performance and features than a FAT16 and FAT 32 system. NTFS divides all useful places into clusters and supports almost all sizes of clusters from 512 bytes up to 64 Kbytes. And NTFS disk is symbolically divided into two parts MFT (Master File Table) area and files storage area. The MFT consumes about 12% of the disk and contains information about all files located on the disk. This includes the system file used by the operating system. MFT is divided into records of the fixed size (usually 1 Kbytes), and each record corresponds to some file. Records within the MFT are referred to as meta-data and the first 16 records are reserved for system files. For reliability, the first three records of MFT file is copied and stored exactly in the middle of the disk and the remaining can be stored anyplace of the disk. The remaining 88% of disk space is for file storage. Below is the partition structure of NTFS system. After we know the file system of Windows XP, then we will move on to the file system of Linux. The way the data is stored in Linux When it comes to Linux file system, ext2 has been the default file system as it main advantages is its speed and extremely robust. However, there is a risk of data loss when sudden crashes occur and take long time to recover. Sometimes the recovery may also end up with corrupt files. By using the advantage of ext2 and add some data loss protection and recovery speed led to the development of journaling file system ext3 and ReiserFs. Though ext2, ext3 and ReiserFs are the most popular file system, there are also some other file system used in the Linux world such as JSF and XFS. As Linux views all file systems from the perspective of a common set of objects, there are four objects superblock, inode, dentry and file. The superblock is a structure that represents a file system which includes vital information about the system. Moreover, it includes the file system name (such as ext2), the size of the file system and its state, a reference to the block device, and meta-data information. It also keeps track of all the nodes. Linux keeps multiple copies of the superblock in various locations on the disk to prevent losing such vital information. Every object that is managed within a file system (file or directory) is represented in Linux as an inode. The inode contains all the meta-data to manage objects in the file system. Another set of structures, called dentries, is used to translate between names and inodes, for which a directory cache exists to keep the most-recently used around. The dentry also maintains relationships between directories and files for traversing file systems. Finally, a VFS (Virtual file system) file represents an open file (keeps state for the open file such as the write offset, and so on). While the majority of the file system code exists in the kernel (except for user-space file systems), (2.3) shows the Linux file system from the point of view of high-level architecture and the relationships between the major file system-related components in both user space and the kernel. The boot task and start up task of Windows XP A good understanding of what happens to disk data at startup is also an important aspect as accessing to a computer system after it was used for illicit reasons can alter the disk evidence. First, we will discuss about the Windows XP startup and boot process, and then shift into the startup and boot process of Linux. Like any other PC system, Windows XP startup by running the POST test, performing an initialization of its intelligent system devices, and performing a system boot process. The boot process begins when the BIOS starts looking through the system for a master boot record (MBR). This record can reside on drive C: or at any other location in the system. When the BIOS execute the master boot record on the hard drive, the MBR examines the disks partition table to locate the active partition. The boot process then moves to the boot sector of that partition located in the first sector of the active partition. There, it finds the code to begin loading the Secondary Bootstrap Loader from the root directory of the boot drive. In NTFS partition, the bootstrap loader is named NTLDR and is responsible for loading XP operation system into memory. When the system is powered on, NTLDR reads the Boot.ini file. If boot.ini contains more than one operating system entry, a boot menu is displayed to the user, allowing the user to choose which operating system is to be loaded. Fig (2.4) shows Boot.ini contains two operating systems and allows user to choose. After the user has selected the desired mode to boot to, NTLDR runs Ntoskrnl.exe and reads Bootvid.dll, Hal.dll and the startup device drivers. After the file system driver has loaded, control is then passed from NTLDR to the kernel. At this time, Windows XP display Windows logo. Virtually, all applications we installed using the default installation decide that they should start up when windows starts. Under â€Å"Startup† tab in the system configuration utility, a list of programs that run when our system boots is listed. Fig (2.6) shows the listed program when our system boots. The boot task and start up task of Linux After we have get into the start up process of Windows XP, we will then shift into the startup process of Linux. In Linux, the flow of control during a boot is also from BIOS, to boot loader, to kernel. When you turn on the power, the BIOS perform hardware-platform specific startup tasks. Once the hardware is recognized and started correctly, the BIOS loads and executes the partition boot code from the designated boot device, which contains Linux boot loader. Linux Loader (LILO) is the Linux utility that initiates the boot process, which usually runs from the disks MBR. LILO is a boot manager that allows you to start Linux or other operating systems, including Windows. If a system has two or more operating systems, LILO gives a prompt asking which operating system the user wishes to initialize. When the user chooses the boot option, it then loads the choosing operating system into memory. The boot program, in turn, reads the kernel into memory. When the kernel is loaded, the boot program transfers control of the boot process to the kernel. The kernel then performs the majority of system setup (memory management, device initialization) before spawning separately, the idle process and scheduler and the init process which is executed in user space. The scheduler takes control of the system management. The init process executes scripts as needed that set up all non-operating system services and structures in order to allow a user environment to be created, and then presents the user with a login screen. We have described about the way the data stored, the boot task and startup task of Windows XP and Linux. After a thorough study of these areas, we can acquire or handle the evidence properly. Task 3 a) Features comparison of â€Å"EnCase, Access Datas Forensic and ProDiscover† Features of Guidance EnCase Forensic * In courts worldwide, forensically acquire data in a sound manner using software with an unparallel record * Using a single tool and investigate and analyze multiple platforms * With prebuilt EnScript ® modules such as initialized Case and Event Log analysis, it can automate complex and routine tasks, so it save time in analyzing * Find information despite efforts to hide, cloak or delete * Can easily handle large volumes of computer evidence, view all relevant files that includes deleted files, file slack and unallocated space * Directly transfer evidence files to law enforcement or legal representatives as necessary * Include review options that allow non-investigators to review evidence easily * Include report options that enable quick report preparation Features of Access Datas Forensic Toolkit * Provides integrated solution that is no need to purchase multiple tools to complete a case. * Provides integrated database that avoid application crashes, lost work and product instability. * Identify encrypted files automatically from more than 80 applications and crack those files. * Supports international language that allows us easily search and view foreign-language data in our native format * Include email analysis that can recover and analyze a wide range of email and web mail formats * Can generate different industry-standard report formats quickly and concisely * Collect key information from the registry that include user information, date of application installed, hardware, time zone and recently used information * While processing takes place, we can view and analyze data Features of ProDiscover * To keep original evidence safe, it create bit-stream copy of disk for analyzing that includes hidden HPA section * For complete disk forensic analysis, it search files or entire disk including slack space, HPA section and Windows NT/2000/XP alternate data streams * Without alter data on the disk, it can preview all files including metadata and hidden or deleted files * Support for VMware to run a captured image. * In order to ensure nothing is hidden, it examine data at the file or cluster level * To prove data integrity, it can generate and record MD5, SHA1 and SHA256 hashes automatically. * Examine FAT12, FAT16, FAT 32 and all NTFS file systems including Dynamic Disk and Software RAID for maximum flexibility. * Examine Sun Solaris UFS file system and Linux ext2 / ext3 file systems. * Integrated thumbnail graphics, internet history, event log file, and registry viewers to facilitate investigation process. * Integrated viewer to examine .pst /.ost and .dbx e-mail files. * Utilize Perl scripts to automate investigation tasks. * Extracts EXIF information from JPEG files to identify file creators. * Automated report generation in XML format saves time, improves accuracy and compatibility. * GUI interface and integrated help function assure quick start and ease of use. * Designed to NIST Disk Imaging Tool Specification 3.1.6 to insure high quality. AccessData FTK v2.0 Guidance EnCase Forensic 6.0 ProDiscover Forensic Report for Choosing Access Datas Forensic Toolkit I think Access Datas Forensic Toolkit is the most beneficial for our lab as it provides more forensic examination features than Encase and ProDiscover. In the evidence aspects, Access Data can acquire files and folders than others. So, it can be a powerful tool when we analyze files for evidence. Moreover, it uses database to support large volume of data that can avoid application crashes, lost work and product instability for our lab. As Access Data is a GUI-based utility that can run in Windows XP, 2000, Me, or 9x operating system and it demo version has most of the same features as full-licensed version, use multi-threading to optimize CPU usage, has task scheduler to optimize time and can view and analyze data while processing takes place, it meets the requirements of our lab. What is more, it supports international language so we can retrieve data no matter which languages they are using. On top of that, it is powerful in searching, recovery, email and graphic analysis. Because of these reasons and by viewing the above forensic tools comparison chart, I can conclude that Access Datas Forensic Toolkit is the most beneficial for our lab. b) Forensic Analysis Report for â€Å"Analyzing FAT32, NTFS and CDFS file system Using Access Datas FTK† Task 4 a) MD5 hash values of bmp, doc, xls files All hash values generated by the MD5 before modification is not the same with the hash value generated after modification. b) Why hash values are same or different A hash value is a numeric value of a fixed length that uniquely identifies data. Data can be compared to a hash value to determine its integrity. Data is hashed and the hash value is stored. At a later time or after the data has been received from mail, the data is hashed again and compared to the stored hash or the hash value it was sent to determine whether the data was altered. In order to compare the hash values, the original hashed data must be encrypted or kept secret from all untrusted parties. When it compared, if the compared hashed values are the same, then the data has not been altered. If the file has been modified or corrupted, the MD5 produces different hash values. In task 4 (a), first we created a doc file with data in this file, then we generated hash values of doc file with MD5. The hash value of info.doc file is da5fd802f47c9b5bbdced35b9a1202e6. After that, we made a modification to that info.doc file and regenerate the hash values. The hash value after modifying is 01f8badd9846f32a79a5055bfe98adeb. The hash value is completely different after modifying. Then we created a cv.xls file and generated the hash value. Before modifying, the hash value is ef9bbfeec4d8e455b749447377a5e84f. After that we add one record to cv.xls file and regenerated hash values. After modifying, ccfee18e1e713cdd2fcf565298928673 hash value is produced. The hash value changed in cv.xls file after data altered. Furthermore, we created fruit.bmp file to compare the hash value before and after modification. The hash value before modifying is 8d06bdfe03df83bb3942ce71daca3888 and after modifying is 667d82f0545f0d187dfa0227ea2c7ff6. So, the hash values comparison of bmp files is completely different after data has been modified. When we encrypted the text file into each image file, the text file is not visible in the image viewing utility and each image file is like its original image file. However, the comparison of the hash values of each image file before and after inserting short messages is completely different. As each image file has been altered by inserting short message, the regenerated hash value is totally different from the original hash values. On top of that, the original image file size has been changed after inserting short messages. The raster image file has slightly increased its file size after it has been modified. The raster image file size is increased from 50.5 KB to 50.7 KB. However, of the remaining three, two image files vector and metafile have decreased its file size a little sharply. The original file size of vector is 266 KB and has been decreased to 200 KB after modified. The metafile also decreased from 313 KB to 156 KB. Only the bitmap is remains stable as its file size does not increase or decrease. In a nut shell, we can conclude that the hash value would change if the file has been modified. However, depending on the file format, the file size can increase, decrease or remain stable. d) Report for â€Å"differences of bitmap, raster, vector and metafile† A bitmap image is a computer file and it is collected with dots or pixels that form an image. The pixel of bitmap is stored like a grid, tiny square. When we use the paint program, we can see the bitmap pixel is like a block and it is draw or clear block by block. A raster image is also a collection of pixels but the image stored pixels in rows to make it easy to print. And raster image is resolution dependent. It cannot scale up to an arbitrary resolution without loss of apparent quality. This is overcome by the vector image. Vector image is made up of many individual, scalable objects. These objects are defined by mathematical equations rather than pixels, so it always render at the highest quality. There are many attributes in vector like color, fill and outline. The attributes can be changed without destroying the basic object. Metafile is a combination of raster and vector graphics, and can have the characteristics of both image types. However, if you create a metafile with raster and vector and enlarge it, the area of raster format will lose some resolution while the vector formatted area remains sharp and clear. If we have lost an image file, before doing anything, we should be familiar with the data patterns of known image file types. Then the recovery process starts. The first step in recovery is to recover fragments file from slack space and free space. The fragment file can locate the header data that is partially overwritten. So, we use Drivespy to identify possible unallocated data sets that contain the full or partial image header values. To locate and recover the image header, we need to know the absolute starting cluster and ending cluster. If not, we could collect the wrong data. Using Drivespy, we can know started cluster number and file size of image that we want to recover. To know the exact ending cluster, add the total number of clusters assigned to the starting cluster position. As we have known the size of image file, we can calculate the total number of clusters. Then, we can locate the image file and retrieve image header. After we get the header value, open the file with Microsoft Photo Viewer. If the file has been opened successfully, then recovery of image file has been completed. If not, we need to use the Hex Workshop to examine the header of the file. Task 5 Report for â€Å"Investigation that prove Naomis innocence† Before we begin tracing an email, we should know which email is illegal and what constitutes an email crime. Illegal email includes selling narcotics, extortion, sexual harassment, stalking, fraud, child abductions, and child pornography. As Jazebel has received an offensive email, so we need to access the victim computer and copy and print the offensive email to recover the evidence contained in the email. Microsoft Outlook, Outlook Express or any other GUI email programs supports for copying the email from inbox to the place that we want to by dragging the message to the storage place. When copying email, the header of the email must be included as it contains unique identifying numbers, such as IP address of the server that sent the message. This helps us when tracing the email. After copy and printing the message, we should retrieve the email header to get the sender IP address. Right click on the message and choose message options to retrieve the email header. The following shows the header information that retrieved from the mail of the victim computer. At line 1(10.140.200.11) shows the IP address of the server sending the e-mail, and provides a date and time that the offending e-mails was sent. Although when we see at line 5, the victim is seemed to be Jezebel, however, line 1 identifies that the e-mail that is sent from the IP address (10.140.200.11) is the same as the victims computer IP address. So, we can conclude that Naomi does not include in sending offensive e-mail. She is innocence and the victim, Jezebel himself, is the one who send the offensive e-mails. References: Computer Forensics Textbook http://www.computerforensicsworld.com/index.php http://www.crime-research.org/library/Forensics.htm http://ixbtlabs.com/articles/ntfs/ www.wikipedia.com Computer Forensics Investigation and Techniques Computer Forensics Investigation and Techniques Introduction I am the student of International Advanced Diploma in Computer Studies (IADCS). In this course, I have to do Compute Forensic assignment. The assignment title is â€Å"Didsbury Mobile Entertainments LTD†. This assignment helps me understanding computer forensics investigation and techniques Before this assignment, although I am interested in computer forensic, I am hardly used computer forensics toolkit or done any investigation. Because of this assignment, I have learnt many techniques how to investigate computer and done it practically. So, by doing this assignment, I have gained in practical and much valuable knowledge in Computer Forensics.nd a heartfelt thanks to all the people in Myanma Computer Company Ltd. for their warmly welcome during the period of the IADCS course and this assignment developed. Task 1 i) Report DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 10, 2010 Introduction Computer forensics involves obtaining and analyzing digital information for figuring out what happened, when it happened, how it happened and who was involved. What is more, it is use as evidence in civil, criminal, or administrative cases. Reasons for a need for computer forensic investigation Computer forensics investigation can recover thousands of deleted mails, can know when the user log into the system and what he does, can determine the motivation and intent of the user, can search keywords in a hard drive in different languages and can gain evidence against an employee that an organization wished to terminate. For these reasons, in order to know whether Jalitha has been spending her time on her friend business or not, we need a computer forensic investigation. Steps to pursue the investigation In order to pursue the investigation, I would take the following steps: 1) Secure the computer system to ensure that the equipment and data are safe 2) Find every file on the computer system, including files that are encrypted, protected by passwords, hidden or deleted, but not yet overwritten. 3) Copy all files and work on this copy files as accessing a file can alter its original value 4) Start a detailed journal with the date and time and date/information discovered 5) Collect email, DNS, and other network service logs 6) Analyze with various computer forensics tools and software 7) Print out an overall analysis 8) Evaluating the information/data recovered to determine the case Conclusion After we know the reasons and steps for investigation, then we should move on to conduct the investigation. However, we should note that the first step of investigation is critical as if the system is not secure, then the evidence or data we found may not be admissible. ii a) Report for â€Å"The procedures to make sure the evidence holds up in court† DIDSBURY MOBILE ENTERTAINMENTS LTD No(5), Duku place, Singapore Jan 12, 2010 Introduction Evidence is any physical or electronic information (such as computer log files, data, reports, hardware, disk image, etc) that is collected during a computer forensic investigation. The purpose of gathering evidence is to help determine the source of the attack, and to introduce the evidence as testimony in a court of law. Procedures to make sure the evidence holds up in court In order to make the evidence admissible in court, we need to follow the following steps: 1) Before any evidence can be gathered, a warrant must be issued so that forensic specialist has the legal authority to seize, copy and examine the data 2) Have the responsibility to ensure that the law and the principles we used are met 3) Evidence must be obtained in a manner which ensures the authenticity and validity and that no tampering had taken place 4) Tracking the chain of custody is essential for preparing evidence as it shows the evidence was collected from the system in question, and was stored and managed without alteration. 5) Extracted/ relevant evidence is properly handled and protected from later mechanical or electromagnetic damage 6) Preventing viruses from being introduced to a computer during the analysis process 7) To ensure that original evidence must be described in complete details to present reliable evidence on the court 8) Must arrange to answer reliability questions relating to the software we have used Conclusion In gathering evidence, authenticity, reliability and chain of custody are important aspects to be considered. By following the above steps, we are proper in handling the evidence holds up in court. ii b) Evidence form Didsbury Mobile Entertainments Ltd IT Department Computer Investigation Case No.: 005 Investigation Organization: Gold Star Investigator: Win Pa Pa Aye Nature of Case: Companys policy violation case Location where evidence was obtained: On suspects office desk Description of evidence: Vendor Name Model No./ Serial No. Item #1 One CD Sony Item #2 A 4GB flash memory device Kingston 05360-374.A00LF Item #3 Evidence Recovered by: Win Pa Pa Aye Date Time: 10.12.2009 10:00 AM Evidence Placed in Locker: E2419 Date Time: 15.12.2009 11:00 AM Item # Evidence Processed by Description of Evidence Date/ Time 1 Win Pa Pa Aye Fully recovered deleted email on the drive which is sent to Radasas company, including data exchange between the businesses. 13.12.2009 3:00 PM 2 Win Pa Pa Aye Encrypted document hidden inside a bitmap file. Decrypted and saved on another media. 18.12.2009 9:00 AM 3 Win Pa Pa Aye Password-protected document covering the exchange of information with her friend. Password cracked and file saved on another media. 22.12.2009 2:00 PM Task 2 Report for â€Å"the way the data is stored, boot tasks and start up tasks for Windows and Linux systems† To effectively investigate computer evidence, we must understand how the most popular operating systems work in general and how they store files in particular. The type of file system an operating system uses determines how data is stored on the disk. The file system is the general name given to the logical structures and software routines used to control access to the storage on a hard disk system and it is usually related to an operating system. To know the way the data is stored in Windows XP and Linux, we need to get into file systems of Windows and Linux. The way the data is stored in Windows XP In Windows XP, although it supports several different file systems, NTFS is the primary file system for Windows XP. So, we will have a look in NTFS as the NTFS system offers better performance and features than a FAT16 and FAT 32 system. NTFS divides all useful places into clusters and supports almost all sizes of clusters from 512 bytes up to 64 Kbytes. And NTFS disk is symbolically divided into two parts MFT (Master File Table) area and files storage area. The MFT consumes about 12% of the disk and contains information about all files located on the disk. This includes the system file used by the operating system. MFT is divided into records of the fixed size (usually 1 Kbytes), and each record corresponds to some file. Records within the MFT are referred to as meta-data and the first 16 records are reserved for system files. For reliability, the first three records of MFT file is copied and stored exactly in the middle of the disk and the remaining can be stored anyplace of the disk. The remaining 88% of disk space is for file storage. Below is the partition structure of NTFS system. After we know the file system of Windows XP, then we will move on to the file system of Linux. The way the data is stored in Linux When it comes to Linux file system, ext2 has been the default file system as it main advantages is its speed and extremely robust. However, there is a risk of data loss when sudden crashes occur and take long time to recover. Sometimes the recovery may also end up with corrupt files. By using the advantage of ext2 and add some data loss protection and recovery speed led to the development of journaling file system ext3 and ReiserFs. Though ext2, ext3 and ReiserFs are the most popular file system, there are also some other file system used in the Linux world such as JSF and XFS. As Linux views all file systems from the perspective of a common set of objects, there are four objects superblock, inode, dentry and file. The superblock is a structure that represents a file system which includes vital information about the system. Moreover, it includes the file system name (such as ext2), the size of the file system and its state, a reference to the block device, and meta-data information. It also keeps track of all the nodes. Linux keeps multiple copies of the superblock in various locations on the disk to prevent losing such vital information. Every object that is managed within a file system (file or directory) is represented in Linux as an inode. The inode contains all the meta-data to manage objects in the file system. Another set of structures, called dentries, is used to translate between names and inodes, for which a directory cache exists to keep the most-recently used around. The dentry also maintains relationships between directories and files for traversing file systems. Finally, a VFS (Virtual file system) file represents an open file (keeps state for the open file such as the write offset, and so on). While the majority of the file system code exists in the kernel (except for user-space file systems), (2.3) shows the Linux file system from the point of view of high-level architecture and the relationships between the major file system-related components in both user space and the kernel. The boot task and start up task of Windows XP A good understanding of what happens to disk data at startup is also an important aspect as accessing to a computer system after it was used for illicit reasons can alter the disk evidence. First, we will discuss about the Windows XP startup and boot process, and then shift into the startup and boot process of Linux. Like any other PC system, Windows XP startup by running the POST test, performing an initialization of its intelligent system devices, and performing a system boot process. The boot process begins when the BIOS starts looking through the system for a master boot record (MBR). This record can reside on drive C: or at any other location in the system. When the BIOS execute the master boot record on the hard drive, the MBR examines the disks partition table to locate the active partition. The boot process then moves to the boot sector of that partition located in the first sector of the active partition. There, it finds the code to begin loading the Secondary Bootstrap Loader from the root directory of the boot drive. In NTFS partition, the bootstrap loader is named NTLDR and is responsible for loading XP operation system into memory. When the system is powered on, NTLDR reads the Boot.ini file. If boot.ini contains more than one operating system entry, a boot menu is displayed to the user, allowing the user to choose which operating system is to be loaded. Fig (2.4) shows Boot.ini contains two operating systems and allows user to choose. After the user has selected the desired mode to boot to, NTLDR runs Ntoskrnl.exe and reads Bootvid.dll, Hal.dll and the startup device drivers. After the file system driver has loaded, control is then passed from NTLDR to the kernel. At this time, Windows XP display Windows logo. Virtually, all applications we installed using the default installation decide that they should start up when windows starts. Under â€Å"Startup† tab in the system configuration utility, a list of programs that run when our system boots is listed. Fig (2.6) shows the listed program when our system boots. The boot task and start up task of Linux After we have get into the start up process of Windows XP, we will then shift into the startup process of Linux. In Linux, the flow of control during a boot is also from BIOS, to boot loader, to kernel. When you turn on the power, the BIOS perform hardware-platform specific startup tasks. Once the hardware is recognized and started correctly, the BIOS loads and executes the partition boot code from the designated boot device, which contains Linux boot loader. Linux Loader (LILO) is the Linux utility that initiates the boot process, which usually runs from the disks MBR. LILO is a boot manager that allows you to start Linux or other operating systems, including Windows. If a system has two or more operating systems, LILO gives a prompt asking which operating system the user wishes to initialize. When the user chooses the boot option, it then loads the choosing operating system into memory. The boot program, in turn, reads the kernel into memory. When the kernel is loaded, the boot program transfers control of the boot process to the kernel. The kernel then performs the majority of system setup (memory management, device initialization) before spawning separately, the idle process and scheduler and the init process which is executed in user space. The scheduler takes control of the system management. The init process executes scripts as needed that set up all non-operating system services and structures in order to allow a user environment to be created, and then presents the user with a login screen. We have described about the way the data stored, the boot task and startup task of Windows XP and Linux. After a thorough study of these areas, we can acquire or handle the evidence properly. Task 3 a) Features comparison of â€Å"EnCase, Access Datas Forensic and ProDiscover† Features of Guidance EnCase Forensic * In courts worldwide, forensically acquire data in a sound manner using software with an unparallel record * Using a single tool and investigate and analyze multiple platforms * With prebuilt EnScript ® modules such as initialized Case and Event Log analysis, it can automate complex and routine tasks, so it save time in analyzing * Find information despite efforts to hide, cloak or delete * Can easily handle large volumes of computer evidence, view all relevant files that includes deleted files, file slack and unallocated space * Directly transfer evidence files to law enforcement or legal representatives as necessary * Include review options that allow non-investigators to review evidence easily * Include report options that enable quick report preparation Features of Access Datas Forensic Toolkit * Provides integrated solution that is no need to purchase multiple tools to complete a case. * Provides integrated database that avoid application crashes, lost work and product instability. * Identify encrypted files automatically from more than 80 applications and crack those files. * Supports international language that allows us easily search and view foreign-language data in our native format * Include email analysis that can recover and analyze a wide range of email and web mail formats * Can generate different industry-standard report formats quickly and concisely * Collect key information from the registry that include user information, date of application installed, hardware, time zone and recently used information * While processing takes place, we can view and analyze data Features of ProDiscover * To keep original evidence safe, it create bit-stream copy of disk for analyzing that includes hidden HPA section * For complete disk forensic analysis, it search files or entire disk including slack space, HPA section and Windows NT/2000/XP alternate data streams * Without alter data on the disk, it can preview all files including metadata and hidden or deleted files * Support for VMware to run a captured image. * In order to ensure nothing is hidden, it examine data at the file or cluster level * To prove data integrity, it can generate and record MD5, SHA1 and SHA256 hashes automatically. * Examine FAT12, FAT16, FAT 32 and all NTFS file systems including Dynamic Disk and Software RAID for maximum flexibility. * Examine Sun Solaris UFS file system and Linux ext2 / ext3 file systems. * Integrated thumbnail graphics, internet history, event log file, and registry viewers to facilitate investigation process. * Integrated viewer to examine .pst /.ost and .dbx e-mail files. * Utilize Perl scripts to automate investigation tasks. * Extracts EXIF information from JPEG files to identify file creators. * Automated report generation in XML format saves time, improves accuracy and compatibility. * GUI interface and integrated help function assure quick start and ease of use. * Designed to NIST Disk Imaging Tool Specification 3.1.6 to insure high quality. AccessData FTK v2.0 Guidance EnCase Forensic 6.0 ProDiscover Forensic Report for Choosing Access Datas Forensic Toolkit I think Access Datas Forensic Toolkit is the most beneficial for our lab as it provides more forensic examination features than Encase and ProDiscover. In the evidence aspects, Access Data can acquire files and folders than others. So, it can be a powerful tool when we analyze files for evidence. Moreover, it uses database to support large volume of data that can avoid application crashes, lost work and product instability for our lab. As Access Data is a GUI-based utility that can run in Windows XP, 2000, Me, or 9x operating system and it demo version has most of the same features as full-licensed version, use multi-threading to optimize CPU usage, has task scheduler to optimize time and can view and analyze data while processing takes place, it meets the requirements of our lab. What is more, it supports international language so we can retrieve data no matter which languages they are using. On top of that, it is powerful in searching, recovery, email and graphic analysis. Because of these reasons and by viewing the above forensic tools comparison chart, I can conclude that Access Datas Forensic Toolkit is the most beneficial for our lab. b) Forensic Analysis Report for â€Å"Analyzing FAT32, NTFS and CDFS file system Using Access Datas FTK† Task 4 a) MD5 hash values of bmp, doc, xls files All hash values generated by the MD5 before modification is not the same with the hash value generated after modification. b) Why hash values are same or different A hash value is a numeric value of a fixed length that uniquely identifies data. Data can be compared to a hash value to determine its integrity. Data is hashed and the hash value is stored. At a later time or after the data has been received from mail, the data is hashed again and compared to the stored hash or the hash value it was sent to determine whether the data was altered. In order to compare the hash values, the original hashed data must be encrypted or kept secret from all untrusted parties. When it compared, if the compared hashed values are the same, then the data has not been altered. If the file has been modified or corrupted, the MD5 produces different hash values. In task 4 (a), first we created a doc file with data in this file, then we generated hash values of doc file with MD5. The hash value of info.doc file is da5fd802f47c9b5bbdced35b9a1202e6. After that, we made a modification to that info.doc file and regenerate the hash values. The hash value after modifying is 01f8badd9846f32a79a5055bfe98adeb. The hash value is completely different after modifying. Then we created a cv.xls file and generated the hash value. Before modifying, the hash value is ef9bbfeec4d8e455b749447377a5e84f. After that we add one record to cv.xls file and regenerated hash values. After modifying, ccfee18e1e713cdd2fcf565298928673 hash value is produced. The hash value changed in cv.xls file after data altered. Furthermore, we created fruit.bmp file to compare the hash value before and after modification. The hash value before modifying is 8d06bdfe03df83bb3942ce71daca3888 and after modifying is 667d82f0545f0d187dfa0227ea2c7ff6. So, the hash values comparison of bmp files is completely different after data has been modified. When we encrypted the text file into each image file, the text file is not visible in the image viewing utility and each image file is like its original image file. However, the comparison of the hash values of each image file before and after inserting short messages is completely different. As each image file has been altered by inserting short message, the regenerated hash value is totally different from the original hash values. On top of that, the original image file size has been changed after inserting short messages. The raster image file has slightly increased its file size after it has been modified. The raster image file size is increased from 50.5 KB to 50.7 KB. However, of the remaining three, two image files vector and metafile have decreased its file size a little sharply. The original file size of vector is 266 KB and has been decreased to 200 KB after modified. The metafile also decreased from 313 KB to 156 KB. Only the bitmap is remains stable as its file size does not increase or decrease. In a nut shell, we can conclude that the hash value would change if the file has been modified. However, depending on the file format, the file size can increase, decrease or remain stable. d) Report for â€Å"differences of bitmap, raster, vector and metafile† A bitmap image is a computer file and it is collected with dots or pixels that form an image. The pixel of bitmap is stored like a grid, tiny square. When we use the paint program, we can see the bitmap pixel is like a block and it is draw or clear block by block. A raster image is also a collection of pixels but the image stored pixels in rows to make it easy to print. And raster image is resolution dependent. It cannot scale up to an arbitrary resolution without loss of apparent quality. This is overcome by the vector image. Vector image is made up of many individual, scalable objects. These objects are defined by mathematical equations rather than pixels, so it always render at the highest quality. There are many attributes in vector like color, fill and outline. The attributes can be changed without destroying the basic object. Metafile is a combination of raster and vector graphics, and can have the characteristics of both image types. However, if you create a metafile with raster and vector and enlarge it, the area of raster format will lose some resolution while the vector formatted area remains sharp and clear. If we have lost an image file, before doing anything, we should be familiar with the data patterns of known image file types. Then the recovery process starts. The first step in recovery is to recover fragments file from slack space and free space. The fragment file can locate the header data that is partially overwritten. So, we use Drivespy to identify possible unallocated data sets that contain the full or partial image header values. To locate and recover the image header, we need to know the absolute starting cluster and ending cluster. If not, we could collect the wrong data. Using Drivespy, we can know started cluster number and file size of image that we want to recover. To know the exact ending cluster, add the total number of clusters assigned to the starting cluster position. As we have known the size of image file, we can calculate the total number of clusters. Then, we can locate the image file and retrieve image header. After we get the header value, open the file with Microsoft Photo Viewer. If the file has been opened successfully, then recovery of image file has been completed. If not, we need to use the Hex Workshop to examine the header of the file. Task 5 Report for â€Å"Investigation that prove Naomis innocence† Before we begin tracing an email, we should know which email is illegal and what constitutes an email crime. Illegal email includes selling narcotics, extortion, sexual harassment, stalking, fraud, child abductions, and child pornography. As Jazebel has received an offensive email, so we need to access the victim computer and copy and print the offensive email to recover the evidence contained in the email. Microsoft Outlook, Outlook Express or any other GUI email programs supports for copying the email from inbox to the place that we want to by dragging the message to the storage place. When copying email, the header of the email must be included as it contains unique identifying numbers, such as IP address of the server that sent the message. This helps us when tracing the email. After copy and printing the message, we should retrieve the email header to get the sender IP address. Right click on the message and choose message options to retrieve the email header. The following shows the header information that retrieved from the mail of the victim computer. At line 1(10.140.200.11) shows the IP address of the server sending the e-mail, and provides a date and time that the offending e-mails was sent. Although when we see at line 5, the victim is seemed to be Jezebel, however, line 1 identifies that the e-mail that is sent from the IP address (10.140.200.11) is the same as the victims computer IP address. So, we can conclude that Naomi does not include in sending offensive e-mail. She is innocence and the victim, Jezebel himself, is the one who send the offensive e-mails. References: Computer Forensics Textbook http://www.computerforensicsworld.com/index.php http://www.crime-research.org/library/Forensics.htm http://ixbtlabs.com/articles/ntfs/ www.wikipedia.com