EnCase Computer Forensics -- The Official EnCE

Introduction xxi Assessment Test xxvii Chapter 1 Computer Hardware 1 Computer Hardware Components 2 The Boot Process 14 Partitions 20 File Systems 25 Summary 27 Exam Essentials 27 Review Questions 28 Chapter 2 File Systems 33 FAT Basics 34 The Physical Layout of FAT 36 Viewing Directory Entries Using EnCase 52 The Function of FAT 58 NTFS Basics 73 CD File Systems 77 exFAT 79 Summary 83 Exam Essentials 84 Review Questions 85 Chapter 3 First Response 89 Planning and Preparation 90 The Physical Location 91 Personnel 91 Computer Systems 92 What to Take with You Before You Leave 94 Search Authority 97 Handling Evidence at the Scene 98 Securing the Scene 98 Recording and Photographing the Scene 99 Seizing Computer Evidence 99 Bagging and Tagging 110 Summary 113 Exam Essentials 113 Review Questions 115 Chapter 4 Acquiring Digital Evidence 119 Creating EnCase Forensic Boot Disks 121 Booting a Computer Using the EnCase Boot Disk 124 Seeing Invisible HPA and DCO Data 125 Other Reasons for Using a DOS Boot 126 Steps for Using a DOS Boot 126 Drive-to-Drive DOS Acquisition 128 Steps for Drive-to-Drive DOS Acquisition 128 Supplemental Information About Drive-to-Drive DOS Acquisition 132 Network Acquisitions 135 Reasons to Use Network Acquisitions 135 Understanding Network Cables 136 Preparing an EnCase Network Boot Disk 137 Preparing an EnCase Network Boot CD 138 Steps for Network Acquisition 138 FastBloc/Tableau Acquisitions 151 Available FastBloc Models 151 FastBloc 2 Features 152 Steps for Tableau (FastBloc) Acquisition 154 FastBloc SE Acquisitions 163 About FastBloc SE 163 Steps for FastBloc SE Acquisitions 164 LinEn Acquisitions 168 Mounting a File System as Read-Only 168 Updating a Linux Boot CD with the Latest Version of LinEn 169 Running LinEn 171 Steps for LinEn Acquisition 173 Enterprise and FIM Acquisitions 176 EnCase Portable 180 Helpful Hints 188 Summary 189 Exam Essentials 192 Review Questions 194 Chapter 5 EnCase Concepts 199 EnCase Evidence File Format 200 CRC, MD5, and SHA-1 201 Evidence File Components and Function 202 New Evidence File Format 206 Evidence File Verification 207 Hashing Disks and Volumes 215 EnCase Case Files 217 EnCase Backup Utility 220 EnCase Configuration Files 227 Evidence Cache Folder 231 Summary 233 Exam Essentials 235 Review Questions 236 Chapter 6 EnCase Environment 241 Home Screen 242 EnCase Layout 246 Creating a Case 249 Tree Pane Navigation 255 Table Pane Navigation 266 Table View 266 Gallery View 275 Timeline View 277 Disk View 280 View Pane Navigation 284 Text View 284 Hex View 287 Picture View 288 Report View 289 Doc View 289 Transcript View 290 File Extents View 291 Permissions View 291 Decode View 292 Field View 294 Lock Option 294 Dixon Box 294 Navigation Data (GPS) 295 Find Feature 297 Other Views and Tools 298 Conditions and Filters 298 EnScript 299 Text Styles 299 Adjusting Panes 300 Other Views 306 Global Views and Settings 306 EnCase Options 310 Summary 318 Exam Essentials 320 Review Questions 321 Chapter 7 Understanding, Searching For, and Bookmarking Data 325 Understanding Data 327 Binary Numbers 327 Hexadecimal 333 Characters 336 ASCII 337 Unicode 338 EnCase Evidence Processor 340 Searching for Data 352 Creating Keywords 353 GREP Keywords 364 Starting a Search 373 Viewing Search Hits and Bookmarking Your Findings 376 Bookmarking 377 Summary 426 Exam Essentials 428 Review Questions 430 Chapter 8 File Signature Analysis and Hash Analysis 435 File Signature Analysis 436 Understanding Application Binding 437 Creating a New File Signature 438 Conducting a File Signature Analysis 442 Hash Analysis 449 MD5 Hash 449 Hash Sets and Hash Libraries 449 Hash Analysis 462 Summary 466 Exam Essentials 468 Review Questions 469 Chapter 9 Windows Operating System Artifacts 473 Dates and Times 475 Time Zones 475 Windows 64-Bit Time Stamp 476 Adjusting for Time Zone Offsets 481 Recycle Bin 487 Details of Recycle Bin Operation 488 The INFO2 File 488 Determining the Owner of Files in the Recycle Bin 493 Files Restored or Deleted from the Recycle Bin 494 Using an EnCase Evidence Processor to Determine the Status of Recycle Bin Files 496 Recycle Bin Bypass 498 Windows Vista/Windows 7 Recycle Bin 500 Link Files 504 Changing the Properties of a Shortcut 504 Forensic Importance of Link Files 505 Using the Link File Parser 509 Windows Folders 511 Recent Folder 515 Desktop Folder 516 My Documents/Documents 518 Send To Folder 518 Temp Folder 519 Favorites Folder 520 Windows Vista Low Folders 521 Cookies Folder 523 History Folder 526 Temporary Internet Files 532 Swap File 535 Hibernation File 536 Print Spooling 537 Legacy Operating System Artifacts 543 Windows Volume Shadow Copy 544 Windows Event Logs 549 Kinds of Information Available in Event Logs 549 Determining Levels of Auditing 552 Windows Vista/7 Event Logs 554 Using the Windows Event Log Parser 555 For More Information 558 Summary 559 Exam Essentials 564 Review Questions 566 Chapter 10 Advanced EnCase 571 Locating and Mounting Partitions 573 Mounting Files 588 Registry 595 Registry History 595 Registry Organization and Terminology 596 Using EnCase to Mount and View the Registry 601 Registry Research Techniques 605 EnScript and Filters 608 Running EnScripts 609 Filters and Conditions 611 Email 614 Base64 Encoding 619 EnCase Decryption Suite 622 Virtual File System (VFS) 629 Restoration 633 Physical Disk Emulator (PDE) 636 Putting It All Together 641 Summary 645 Exam Essentials 648 Review Questions 649 Appendix A Answers to Review Questions 653 Chapter 1: Computer Hardware 654 Chapter 2: File Systems 655 Chapter 3: First Response 657 Chapter 4: Acquiring Digital Evidence 658 Chapter 5: EnCase Concepts 659 Chapter 6: EnCase Environment 661 Chapter 7: Understanding, Searching For, and Bookmarking Data 662 Chapter 8: File Signature Analysis and Hash Analysis 663 Chapter 9: Windows Operating System Artifacts 664 Chapter 10: Advanced EnCase 665 Appendix B Creating Paperless Reports 667 Exporting the Web Page Report 669 Creating Your Container Report 671 Bookmarks and Hyperlinks 675 Burning the Report to CD or DVD 678 Appendix C About the Additional Study Tools 681 Additional Study Tools 682 Sybex Test Engine 682 Electronic Flashcards 682 PDF of Glossary of Terms 682 Adobe Reader 682 Additional Author Files 683 System Requirements 683 Using the Study Tools 683 Troubleshooting 683 Customer Care 684 Index 685