ENCASE COMPUTER FORENSICS
CONTENTS CHAPTER COMPUTER HARDWARE COMPUTER HARDWARE COMPONENTS THE BOOT PROCESS PARTITIONS FILE SYSTEMS SUMMARY EXAM ESSENTIALS REVIEW QUESTIONS ANSWERS TO REVIEW QUESTIONS CHAPTER FAT BASICS THE PHYSICAL LAYOUT OF FAT VIEWING FAT ENTRIES USING ENCASE THE FUNCTION OF FAT HOW A FILE IS STORED THE EFFECTS OF DELETING AND UNDELETING FILES SLACK SPACE DIRECTORY ENTRY STATUS BYTE NTFS (NEW TECHNOLOGY FILE SYSTEM) CD FILE SYSTEMS FIRST RESPONSE PLANNING AND PREPARATION THE PHYSICAL LOCATION PERSONNEL COMPUTER SYSTEMS WHAT TO TAKE WITH YOU BEFORE YOU LEAVE? SEARCH AUTHORITY HANDLING EVIDENCE AT THE SCENE SECURING THE SCENE RECORDING AND PHOTOGRAPHING THE SCENE XIV CONTENTS SEIZING COMPUTER EVIDENCE BAGGING AND TAGGING ACQUIRING DIGITAL EVIDENCE CREATING ENCASE FORENSIC BOOT DISKS BOOTING A COMPUTER USING THE ENCASE BOOT DISK SEEING INVISIBLE HPA AND DCO DATA OTHER REASONS FOR USING A DOS BOOT STEPS FOR USING A DOS BOOT DRIVE-TO-DRIVE DOS ACQUISITION STEPS FOR DRIVE-TO-DRIVE DOS ACQUISITION SUPPLEMENTAL INFORMATION ABOUT DRIVE-TO-DRIVE DOS ACQUISITION NETWORK ACQUISITIONS REASONS TO USE NETWORK ACQUISITIONS UNDERSTANDING NETWORK CABLES PREPARING AN ENCASE NETWORK BOOT DISK PREPARING AN ENCASE NETWORK BOOT CD STEPS FOR NETWORK ACQUISITION FASTBLOC ACQUISITIONS AVAILABLE FASTBLOC MODELS FASTBLOC 2 FEATURES STEPS FOR FASTBLOC ACQUISITION FASTBLOC SE ACQUISITIONS ABOUT FASTBLOC SE STEPS FOR FASTBLOC SE ACQUISITIONS LINEN ACQUISITIONS MOUNTING A FILE SYSTEM AS READ-ONLY UPDATING A LINUX BOOT CD WITH THE LATEST VERSION OF LINEN RUNNING LINEN STEPS FOR LINEN ACQUISITION ENTERPRISE AND FIM ACQUISITIONS HELPFUL HINTS CONTENTS XV CHAPTER ENCASE CONCEPTS ENCASE EVIDENCE FILE FORMAT EVIDENCE FILE COMPONENTS AND FUNCTION EVIDENCE FILE VERIFICATION HASHING DISKS AND VOLUMES ENCASE CASE FILES ENCASE BACKUP FILE ( CBAK) ENCASE CONFIGURATION FILES ENCASE RECORD CACHE FOLDER ENCASE ENVIRONMENT ENCASE LAYOUT CREATING A CASE TREE PANE NAVIGATION TABLE PANE NAVIGATION TABLE VIEW REPORT VIEW GALLERY VIEW DISK VIEW TIMELINE VIEW CODE VIEW VIEW PANE NAVIGATION TEXT VIEW HEX VIEW PICTURE VIEW CONSOLE VIEW DOC VIEW TRANSCRIPT VIEW DETAILS VIEW OUTPUT VIEW LOCK OPTION DIXON BOX NAVIGATION DATA (GPS) FIND FEATURE OTHER VIEWS ADJUSTING PANES OTHER CASE-LEVEL VIEWS GLOBAL VIEWS ENCASE OPTIONS XVI CONTENTS SUMMARY UNDERSTANDING, SEARCHING FOR, AND BOOKMARKING DATA UNDERSTANDING DATA BINARY NUMBERS HEXADECIMAL CHARACTERS ASCII UNICODE SEARCHING FOR DATA CREATING AND MANAGING KEYWORDS GREP KEYWORDS STARTING A SEARCH VIEWING SEARCH HITS AND BOOKMARKING YOUR FINDINGS BOOKMARKING FILE SIGNATURE ANALYSIS AND HASH ANALYSIS FILE SIGNATURE ANALYSIS UNDERSTANDING APPLICATION BINDING CREATING A NEW FILE SIGNATURE CONDUCTING A FILE SIGNATURE ANALYSIS HASH ANALYSIS MD5 HASH HASH SETS AND HASH LIBRARIES WINDOWS OPERATING SYSTEM ARTIFACTS DATES AND TIMES TIME ZONES WINDOWS 64-BIT TIME STAMP ADJUSTING FOR TIME ZONE OFFSETS CONTENTS XVII RECYCLE BIN DETAILS OF RECYCLE BIN OPERATION THE INFO2 FILE DETERMINING THE OWNER OF FILES IN THE RECYCLE BIN FILES RESTORED OR DELETED FROM THE RECYCLE BIN USING AN ENSCRIPT TO DETERMINE THE STATUS OF RECYCLE BIN FILES RECYCLE BIN BYPASS WINDOWS VISTA RECYCLE BIN LINK FILES CHANGING THE PROPERTIES OF A SHORTCUT FORENSIC IMPORTANCE OF LINK FILES USING THE LINK FILE PARSER ENSCRIPT WINDOWS 2000, XP, AND VISTA FOLDERS RECENT FOLDER DESKTOP FOLDER MY DOCUMENTS/DOCUMENTS SEND TO FOLDER TEMP FOLDER FAVORITES FOLDER WINDOWS VISTA LOW FOLDERS COOKIES FOLDER HISTORY FOLDER TEMPORARY INTERNET FILES SWAP FILE HIBERNATION FILE PRINT SPOOLING LEGACY OPERATING SYSTEM ARTIFACTS WINDOWS VISTA VOLUME SHADOW COPY WINDOWS EVENT LOGS KINDS OF INFORMATION AVAILABLE IN EVENT LOGS DETERMINING LEVELS OF AUDITING WINDOWS VISTA EVENT LOGS USING THE WINDOWS EVENT LOG PARSER FOR MORE INFORMATION ANSEWERS TO REVIEW QUESTIONS ADVANCED ENCASE LOCATING AND MOUNTING PARTITIONS MOUNTING FILES XVIII CONTENTS REGISTRY REGISTRY HISTORY REGISTRY ORGANIZATION AND TERMINOLOGY USING ENCASE TO MOUNT AND VIEW THE REGISTRY REGISTRY RESEARCH TECHNIQUES ENSCRIPT AND FILTERS ENSCRIPT NAVIGATION AND PATHS EDITING, COPYING, MOVING, AND DELETING ENSCRIPTS RUNNING ENSCRIPTS FILTERS, CONDITIONS, AND QUERIES EMAIL BASE64 ENCODING ENCASE DECRYPTION SUITE (EDS) VIRTUAL FILE SYSTEM (VFS) EXPORTING APPLICATIONS RESTORATION PHYSICAL DISK EMULATOR (PDE) PUTTING IT ALL TOGETHER