Chapter 17 ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Forensic Examination...

Chapter 17

Forensic Examination of Windows Systems

Figure 1.1

FIGURE 17.1 Root directory (skyways-getafix.doc, starts in cluster 184) ® FAT ® data in clusters 184-225 (42 clusters × 512 bytes/clusters = 21,504 bytes).

Figure 1.1

FIGURE 17.2 Root directory of floppy diskette viewed using X-Ways Forensics.

Figure 1.1

FIGURE 17.3 Example of SleuthKit viewing MFT entry with full details.

Figure 1.1

FIGURE 17.4 Diagram of file with a logical size that is larger than its valid data length, leaving uninitialized space..

Figure 1.1

FIGURE 17.5 MFT entry with logical size and valid data length viewed using X-Ways Forensics..

Figure 1.1

FIGURE 17.6 Folder entries with 32-bit MS-DOS date-time stamps viewed in X-Ways.file shares.

Figure 1.1

FIGURE 17.7 DCode used to convert 64-bit FILETIME date-time stamps from their hexadecimal representation..

Figure 1.1

FIGURE 17.8 The Sleuth Kit and Autopsy Forensic Browser being used to examine a FAT file system (checkmarks indicate files are deleted).

Figure 1.1

FIGURE 17.9 DataLifter being used to carve files from two blobs of unallocated space and one blob of file slack from a system.

Figure 1.1

FIGURE 17.10 File slack of a recovered file viewed using EnCase.

Figure 1.1

FIGURE 17.11 Internet Account Manager.

Figure 1.1

FIGURE 17.12 A cookie created by MS Internet Explorer showing recent Mapquest searches viewed using CookieView (http://www.digitaldetective.co.uk).

Figure 1.1

FIGURE 17.13 FTK showing Word document as e-mail attachments (base 64 encoded).

Figure 1.1

FIGURE 17.14 Registry showing remote systems recently accessed using Telnet.

Figure 1.1

FIGURE 17.15 Network Neighborhood on a Windows XP computer connected to a home network.

Figure 1.1

FIGURE 17.16 Active network file shares.

Chapter 17 ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Forensic Examination...

Documents

Harlan Carvey Eoghan Casey Technical EditorFr… · Elsevier, Inc., the author(s), and any person or ﬁ rm involved in the writing, editing, or production (collectively “Makers”)

Chapter 21 Network Basics for Digital Investigators ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved

Chapter 20 ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Forensic Examination of Mobile Devices (online only)

Gregory Casey

Pedigree Chart - Alto Casey Family Pagealtocasey.com/alto casey photo album/Alto Casey Pedigree Chart.pdf · Alto Lee CASEY Alto Lee CASEY b: May 27. 1881 in Alabama m: Mar in Aigbarna

Forensic Network Analysis Tools Strengths, Weaknesses, and ... · Forensic Network Analysis Tools: Strengths, Weaknesses, and Future Needs By Eoghan Casey Presented At The Digital

ISSUE PAPER 27 PROJECT 126: REVIEW OF THE …E Casey Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet (2 nd edn Elsevier Academic Press CA 2004). LH

Casey, City of Casey Dra˝ Sport and more active, Physical

Eduardo Mogrovejo ELSEVIER S&T - LA South e.Mogrovejo@elsevier

Eoghan McDermott Show Sponsorship...ABOUT RTÉ’s Eoghan Mc Dermott hosts 2FM’s fast-paced weekday afternoon show. Kicking off at 4:00pm, this three hour show is a mix of big celebrity

Casey O’Brien

Forensic Network Analysis Toolsold.dfrws.org/2003/presentations/Brief-Casey.pdf · Forensic Network Analysis Tools Strengths, Weaknesses, and Future Needs Eoghan Casey |Author, Digital

Dominic Casey affidavits on Casey Anthony

Creative Sydney's Changing Sydney - Presentation by Eoghan Lewis

Mobile Device Forensics Essentials - SANS - Eoghan Casey... · Mobile Device Forensics Essentials Everything you need to know but were afraid to ask! Eoghan Casey. ... Mobile Misuse

Cyber Forensics Dr. John Abraham Professor Based on Eoghan Casey’s Textbook

Chapter 13 ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.. Investigating Computer Intrusions

Leveraging CybOX to Standardize Representation and ... · Leveraging CybOX to Standardize Representation and Exchange of Digital Forensic Information By Eoghan Casey, Greg Back, and

PLACES WATCH - Santa Clara County, CaliforniaAnnie E. Casey Foundation, including Casey Family Services, Casey Family Programs, the Jim Casey Youth Opportunities Initiative, the Marguerite

Casey Anthony - Casey Anthony 7-16-08 Transcript