EVID DigestsCompilation SET01

Embed Size (px)

Citation preview

  • 8/12/2019 EVID DigestsCompilation SET01

    1/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 ;

    /$3#11#,#4#25 -. !"#$!%&! 6

    =;> ? 255-)+ @ A B-+B5- 8 =9> B-+B5- @ A ' %3-+ C =8> @-0% @A &+.*%5 &-.2)*3" &"&3-' D =C> @*3%)*.1 . +)B+)%3*+, @ A 5+&*, E = 5-- @ A F!. ! %,F ,A@A G =H> 5-B%,3+ . +,&+5*/%3-/ ' *,*,0 . +A @A / 2'%B*& ;;

    78/2 %!!$ %-2 ,! 9:-"!$ ;<

    /= )*$#/4 %-2#&! ;<

    =;> @-)&+4% ( 6) A @A . %)%02% ;9 =9> 62/0- %,0-5-& @ A 1 +, A 0 23*-))-4 ;C =8> %&*%,3 -)'*,%5& @ A ' %5%"%, *,&2)%,.- ;< =C> &+.*%5 62&3*.- &+.*-3" @ A %3*-,4% ;H = 5%,/ ! %,F +? 31- B1*5*BB*,-& @A &B&A ) +F%"% %,/ ! +,% ;E =H> 5%,/ ! %,F +? 31- B1*5*BB*,-& @A 1 +,-".+'! ? %)'& . +)B A ;G =D> / - . %&3)+ @A 5*!-)3" ! )+%/.%&3*,0 , -3I+)F ( *,. A 9;

    ,= )*$#/4 / $3#11#-% &%, ' *02-5 . +)B A @A F%5%5+ 98 =9> B-+B5- +? 31- B1*5*BB*,-& @A 6%,6%5%,* 98 =8> B1*5*BB*,-& @A / - 0 24'%, 9C =C> ' %5%"%, *,&2)%,.- @ A B1*5*BB*,- ? *)&3 *,&2)%,.- 9H = ) -B2!5*. @ A &%,/*0%,!%"%, 9D =H> 3 -.&+, @ A .+'-5-. 8:

    :!/4 /%$ $!3-%12:/2#"! !"#$!%&! 6;

    =;> 3 *6*,0 @A . +2)3 +? %BB-%5& 8; =9> %02&3*, @A 1 +, A . +2)3 +? %BB-%5& 8C =8> B-+B5- @ A 5%))%,%,0% 8H

    =C> . )24 J%)-@%5+ @A K2-)2!*, J5%"+&% 8D = - &3%3- +? " 262*.+ @A ) -B2!5*. +? 31- B1*5*BB*,-& L .% 8E =H> ' %5*5*, @A B-+B5- +? 31- B1*5*BB*,-& C:

    ,!12 !"#$!%&! >;

    =;> %).-+ @ A B-+B5- C; =9> &B+2&-& %5?%)+ @A .% L ! %0%,+ C9 =8> !B* @A &'B C8 =C> 5-6%,+ @ A B-+B5- CC = ) -B2!5*. @ A ' %).+& J' %,+3+. CD =H> ! %,0*& @A 1 -*)& +? %/+5?+ &B+2&-& &%5*'!%,0+, @ A &B+2&-& 3 %, 1 -*)& +? B%.)-& @A 1 -*)& +? " 0+,% 5-*013+, . +,3)%.3+)& B1*5*BB*,-& ( *,. A @A .,B *,/2&3)*-& ( *,. A - &3%3- +? . %!%,0.2,0%, @ A 5%*0+ H: = %55*-/ ! %,F*,0 @ A . 1-,0 " +,0 H;

    #%2!:9:!2/2#-% -. $-&*3!%21 A<

    =;> ' %)K2-4 %,/ / -5% . )24 @ A - &B-6+ H9 =9> / ) A &%,3+& @A / ) A @*!%) H< =8> . %32,0%5 @ A ) +/)*02-4 HH

  • 8/12/2019 EVID DigestsCompilation SET01

    2/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 9

    =C> ! %,F +? . +''-).- @ A 0 ++/'%, ? *-5/-) *,3-),%3*+,%5B1*5*BB*,-&( *,. A HE

    B*/4#.#&/2#-% -. 7#2%!11 AC

    =;> B-+B5- @ A 0 %!%I% " ! %,00%" HG =9> 3 %, @A ) +/*5 - ,3-)B)*&-& D: =8> B%+ @A 3 *,0 D9 =C> B-+B5- @ A B%,&-,&+" D8 = B-+B5- +? 31- B1*5*BB*,-& @A B%5-) DC =H> B-+B5- @ A . %&3*55+ D<

    9:#"#4!+!$ &-33*%#&/2#-% @@

    =;> 5-- @ A .% DD =9> B-,% @ A %B%)*.*+ DE =8> B-,3%0+, &3--5 . +)B A @A .% DG =C> ! 52- . )+&& @A + 5*@%)-& E: = %*) B1*5*BB*,-& . +)B A @A B-,,&I-55 ( *,. A E9 =H> 1 %/625% @A ' %/5%,/% E8

    /$3#11#-%1 /%$ &-%.!11#-%1 D?

    =;> &%, ' *02-5 . +)B A @A F%5%5+ E< =9> B-+B5- +? 31- B1*5*BB*,-& @A 6%,6%5%,* EH =8> 1 + I %*B%,0 @A B-+B5- ED =C> B-+B5- @ A 1 *B+,% EE

    &-%$*&2 E &8/:/&2!: !"#$!%&! DC

    =;> B-+B5- @ A . +,.+)*+ EG =9> B-+B5- +? 31- B1*5*BB*,-& @A 5-- G; =8> .&. @A ! -5%0%, G9

    8!/:1/5 !"#$!%&! C6

    =;> ! %"%,* @A B-+B5- G8 =9> B%325% @A B-+B5- GC =8> ' %5%"%, *,&2)%,.- . +A *,. A @A %5!-)3+ G< =C> B-+B5- +? 31- B1*5*BB*,-& @A + '*.3*, GH

    -9#%#-% :*4! C@

    =;> ? 255-)+ @ A B-+B5- GD =9> 1 -),%,/-4 @ A &%, 62%, J&%,3+& GG =8> B)+0)-&&*@- 3 )%/- L &-)@*.- - ,3-)B)*&-& @ A %,3+,*+ ;:: =C> B-)-4 @ A B-+B5- ;:9 = B-+B5- @ A . %&3*55+ ;:8

  • 8/12/2019 EVID DigestsCompilation SET01

    3/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 8

    / $3#11#,#4#25 -. ! "#$!%&!

    F;G . *44!:- " = 9 !-94!

    ?MNOP#

    BQORORSTQU VMP QWXYSZQ[ MP M OQYQ\UMX] SXQUMOSU MO O]Q !^UQM^ S_3QYQNSWW^TRNMORSTP +__RNQ RT *UR\M .ROZ =!3+( *UR\M .ROZ>A *T ;GE9( ]Q`QNMWQ O]Q %NORT\ .]RQ_ +XQUMOSU S_ O]Q PMWQ S__RNQ ^TORY ;GGCA %BQUPSTMY /MOM &]QQO =B/&> a.RbRY &QUbRNQ ?SUW 9;9c [MOQ[ E 6MT^MUZ;GEE( X^UXSUOQ[YZ MNNSWXYRP]Q[ MT[ PR\TQ[ `Z XQORORSTQU( POMOQP O]MO]Q XMPPQ[ O]Q .RbRY -T\RTQQURT\ !SMU[ -dMWRTMORST \RbQT ST 8:J8; 'MZ;GE< RT 'MTRYM VRO] M UMORT\ S_ D

  • 8/12/2019 EVID DigestsCompilation SET01

    4/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 C

    `QQT XUQPQTOQ[ `Z O]Q XUSPQN^ORSTA .RUN^WPOMTORMY QbR[QTNQ RPP^__RNRQTO R_#

    =M> 3]QUQ RP WSUQ O]MT STQ NRUN^WPOMTNQk

    =`> 3]Q _MNOP _USW V]RN] O]Q RT_QUQTNQP MUQ [QURbQ[ MUQ XUSbQTkMT[

    =N> 3]Q NSW`RTMORST S_ MYY O]Q NRUN^WPOMTNQP RP P^N] MP OSXUS[^NQ M NSTbRNORST `QZST[ UQMPSTM`YQ [S^`OA

    %YO]S^\] TSTQ S_ O]Q XUSPQN^ORST VROTQPPQP MNO^MYYZ PMV O]Q XQORORSTQU_MYPR_ZRT\ O]Q B/&( O]QZ( TSTQO]QYQPP( OQPOR_RQ[ O]MO O]MO O]QZ MUQ bQUZ_MWRYRMU VRO] O]Q XQORORSTQUhP ]MT[VURORT\ MT[ PR\TMO^UQA 'M\RPOUM[SOQPOR_RQ[ O]MO( `QRT\ M P^`SU[RTMOQ S_ XQORORSTQU( P]Q RP bQUZ _MWRYRMU VRO]XQORORSTQUhP PR\TMO^UQ MT[ MNO^MYYZ VROTQPPQ[ XQORORSTQU M__RdRT\ ]RPPR\TMO^UQ ST ]QU [MRYZ ORWQ UQNSU[P _SU &QXOQW`QU ;GED OS 'MZ ;GEEA!URfS OQPOR_RQ[ O]MO ]Q RP MYPS _MWRYRMU VRO] XQORORSTQUhP PR\TMO^UQ`QNM^PQ ]Q XQUPSTMYYZ iTSVP XQORORSTQU MT[ O]MO ]Q UQ\^YMUYZ UQNQRbQ[XQORORSTQUhP [MRYZ ORWQ UQNSU[P MT[ SO]QU [SN^WQTOP `QMURT\XQORORSTQUhP PR\TMO^UQA !SO] 'M\RPOUM[S MT[ !URfS SXRTQ[ O]MO O]QPR\TMO^UQ RT O]Q B/& `QYST\P OS XQORORSTQUA

    3]Q _SUQ\SRT\ OQPORWSTRQP MUQ NSTPRPOQTO VRO] O]Q [SN^WQTOMUZQbR[QTNQ P^`WROOQ[ `Z O]Q XUSPQN^ORSTA 3]Q )3. MT[ O]Q .S^UO S_%XXQMYP _S^T[ O]Q OQPORWSTRQP S_ 'M\RPOUM[S MT[ !URfS MP OU^POVSUO]ZMT[ `QYRQbM`YQA

    'SUQ PR\TR_RNMTO MUQ O]Q [SN^WQTOMUZ QbR[QTNQ NSTPRPORT\ S_XQORORSTQUhP PR\TMO^UQ RT NQUOMRT M^O]QTORN RTPOU^WQTOP V]RNMXXMUQTOYZ PRWRYMU OS O]Q PR\TMO^UQ RT O]Q B/&A

    *T M`PSY^OQ [RPXMUROZ( O]Q QbR[QTNQ _SU O]Q [Q_QTPQ RP NSWXURPQ[ S[QTRMYPA BQORORSTQU [QTRQ[ ]MbRT\ MNNSWXYRP]Q[ MT[ PR\TQ[ O]Q B/&A 1QOURQ[ OS RWXMUO O]MO PSWQSTQ QYPQ ]M[ _RYYQ[ RO ^XA 1SVQbQU( MPR[Q O]RP PQY_JPQUbRT\ MT[ TQ\MORbQ NYMRW( ]Q [R[ TSO M[[^NQ MTZ NSTbRTNRT\XUSS_ OS Q__QNORbQYZ UQ_^OQ O]Q QbR[QTNQ _SU O]Q XUSPQN^ORSTA

    *O RP M ]SUT`SSi [SNOURTQ O]MO MP `QOVQQT `MUQ [QTRMYP MT[ XSPRORbOQPORWSTZ ST M__RUWMORbQ WMOOQUP( O]Q YMOOQU RP MNNSU[Q[ \

    QbR[QTORMUZ VQR\]OA

    F

  • 8/12/2019 EVID DigestsCompilation SET01

    5/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 3]Q MXXUQ]QT[RT\ OQMW ]MbRT\ RTRORMY N^POS[Z MT[ NSTOUSY S_O]Q [U^\P P]MYY( RWWQ[RMOQYZ M_OQU PQRf^UQ MT[ NST_RPNMORST( X]ZPRNMYYZRTbQTOSUZ MT[ X]SOS\UMX] O]Q PMWQ RT O]Q XUQPQTNQ S_ O]Q MNN^PQ[ SUO]Q XQUPSTnP _USW V]SW P^N] ROQWP VQUQ NST_RPNMOQ[ MT[nSU PQRfQ[( SU]RPn]QU UQXUQPQTOMORbQ SU NS^TPQY( M UQXUQPQTOMORbQ _USW O]Q WQ[RM MT[O]Q /QXMUOWQTO S_ 6^PORNQ =/+6>( MT[ MTZ QYQNOQ[ X^`YRN S__RNRMY V]SP]MYY `Q UQg^RUQ[ OS PR\T O]Q NSXRQP S_ O]Q RTbQTOSUZ MT[ `Q \RbQT M NSXZO]QUQS_A

    ,STJNSWXYRMTNQ `Z O]Q MXXUQ]QT[RT\n`^ZJ`^PO OQMW VRO] &QNORST 9; RPTSO _MOMY MP YST\ MP O]QUQ RP j^POR_RM`YQ \US^T[ O]QUQ_SU( MT[ MP YST\ MPO]Q RTOQ\UROZ MT[ O]Q QbR[QTORMUZ bMY^Q S_ O]Q NST_RPNMOQ[nPQRfQ[ ROQWP(MUQ XUSXQUYZ XUQPQUbQ[ `Z O]Q MXXUQ]QT[RT\ S__RNQUnOQMWA *OP TSTJNSWXYRMTNQ VRYY TSO UQT[QU MT MNN^PQ[hP MUUQPO RYYQ\MY SU O]Q ROQWP

    PQRfQ[nNST_RPNMOQ[ _USW ]RW RTM[WRPPR`YQA I]MO RP S_ ^OWSPORWXSUOMTNQ RP O]Q XUQPQUbMORST S_ O]Q RTOQ\UROZ MT[ O]Q QbR[QTObMY^Q S_ O]Q PQRfQ[ ROQWP( MP O]Q PMWQ VS^Y[ `Q ^ORYRfQ[ RT O]Q[QOQUWRTMORST S_ O]Q \^RYO SU RTTSNQTNQ S_ O]Q MNN^PQ[A

    *T O]Q NMPQ MO `MU( O]Q UQNSU[P MUQ ^TNYS^[Q[ O]MO O]Q RTOQ\UROZ MT[ OQbR[QTORMUZ bMY^Q S_ O]Q [U^\ ROQWP PQRfQ[ _USW [Q_QT[MTOJMXXQYYM[^URT\ O]Q `^ZJ`^PO SXQUMORST VQUQ XUSXQUYZ XUQPQUbQ[ MT[PM_Q\^MU[Q[A 3]Q PXQNRWQT VMP M[Qg^MOQYZ WMUiQ[( MT[ O]QT[RPXMON]Q[ OS O]Q .URWQ 5M`SUMOSUZ _SU O]Q UQg^RPROQ .]QWRPOUZ )QXSUNST[^NOQ[ `Z ?SUQTPRN .]QWRPO -T\UA 5QSTMU[ 6M`STRYYSA I]MO RP QbQTWSUQ OQYYRT\ RP O]Q _MNO O]MO MNN^PQ[JMXXQYYMTO VMP TSO P]SVT OS N]MYYQT\Q[ O]Q N^POS[Z SU O]Q RPP^Q S_ [RPXSPRORST MT[ XUQPQUbMORST SO]Q P^`jQNO [U^\ `Q_SUQ O]Q )3.A %T[ TQRO]QU [R[ ]Q UMRPQ S`jQNORSTP`Q_SUQ O]Q .S^UO S_ %XXQMYPA %NN^PQ[JMXXQYYMTO NMTTSO `Q MYYSVQ[ YMOQ RT O]Q [MZ OS g^QPORST O]Q RTOQ\UROZ MT[ QbR[QTORMUZ bMY^Q S_ PQRfQ[ ROQWPA

    *T O]RP NMPQ( RO W^PO `Q POUQPPQ[ O]MO [Q_QT[MTOJMXXQYYMTO QPORX^YMOQ[ O]MO M g^MYROMORbQ QdMWRTMORST WM[Q `Z O]Q B]RYR,MORSTMY BSYRNQ .URWQ 5M`SUMOSUZ( .QTOUMY BSYRNQ /RPOURNO .U5M`SUMOSUZ +__RNQ ST O]Q P^`jQNO PXQNRWQT( V]RN] VMP PQMYQ[ RT MOUMTPXMUQTO XYMPORN PMN]QO WMUiQ[ VRO] O]Q RTRORMYP S_ B+9 +UORf( ZXSPRORbQ _SU WQO]ZYMWX]QOMWRTQ ]Z[USN]YSUR[Q( M [MT\QUS^P [U^\A 3]Q

    g^QPORST( O]QUQ_SUQ( S_ O]Q RTOQ\UROZ MT[ O]Q QbR[QTORMUZ bMY^Q S_ ROQWP OMiQT _USW O]Q [Q_QT[MTOJMXXQYYMTO ]MP `QQT YMR[ OS UQPOA

    *T O]Q RTPOMTO NMPQ( VQ _RT[ TS NSWXQYYRT\ UQMPST OS UQbQUPQ O]Q _RT[RS_ O]Q )3.( MP M__RUWQ[ `Z O]Q .S^UO S_ %XXQMYPA IQ [S PS _SU O]Q_SYYSVRT\ NURORNMY XSRTOP#

  • 8/12/2019 EVID DigestsCompilation SET01

    7/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 D

    ?RUPO( MYY O]Q TQNQPPMUZ QYQWQTOP _SU O]Q XUSPQN^ORST S_ O]Q RYYQ\MY PMYQ S_[U^\P VQUQ QPOM`YRP]Q[A 3]Q QYQWQTOP MUQ O]Q _SYYSVRT\# =;> O]QR[QTORORQP S_ O]Q `^ZQU MT[ O]Q PQYYQU( O]Q S`jQNO( MT[ NSTPR[QUMORSTk MT[=9> O]Q [QYRbQUZ S_ O]Q O]RT\ PSY[ MT[ O]Q XMZWQTO O]QUQ_SUA *O RP `QZST[UQMPSTM`YQ [S^`O O]MO O]Q OUMTPMNORST MNO^MYYZ OSSi XYMNQ

    &QNST[( O]Q XUQP^WXORST O]MO O]Q X^`YRN S__RNQUP XQU_SUWQ[ O]QRU [^ORQPUQ\^YMUYZ [^URT\ O]Q `^ZJ`^PO SXQUMORST VMP TSO SbQUO^UTQ[A 3]RPXUQP^WXORST NMT `Q SbQUO^UTQ[ R_ NYQMU MT[ NSTbRTNRT\ QbR[QTNQ RPXUQPQTOQ[ OS XUSbQ QRO]QU S_ OVS O]RT\P# =;> O]MO O]QZ VQUQ TSO XUSXQUYZXQU_SUWRT\ O]QRU [^OZ( SU =9> O]MO O]QZ VQUQ RTPXRUQ[ `Z MTZ RWXUSXQUWSORbQA *T O]RP NMPQ( MXXQYYMTO _MRYQ[ OS XUQPQTO PMR[ QbR[QTNQA6^URPXU^[QTNQ ]MP QPOM`YRP]Q[ O]MO M `^ZJ`^PO SXQUMORST RP M _SUW S_QTOUMXWQTO( RT V]RN] O]Q bRSYMOSU RP NM^\]O RT _YM\UMTOQ [QYRNOS MT[ O]QXSYRNQ S__RNQUP NST[^NORT\ O]Q SXQUMORST MUQ TSO STYZ M^O]SURfQ[ `^O[^OZJ`S^T[ OS MXXUQ]QT[ O]Q bRSYMOSU MT[ OS PQMUN] ]RW _SU MTZO]RT\O]MO WMZ ]MbQ `QQT XMUO S_ SU ^PQ[ RT O]Q NSWWRPPRST S_ O]Q NURWQA

    3]Q MUUQPORT\ S__RNQUP VQUQ TSO P]SVT TSO OS ]MbQ XUSXQUYZ XQU_SUWQ[O]QRU [^OZA ,QRO]QU VMP RO QPOM`YRP]Q[ O]MO O]QZ ]M[ `QQT RWXQYYQ[ `ZMTZ RWXUSXQU WSORbQA IQ MUQ RT MNNSU[ VRO] O]Q .S^UO S_ %XXQMYP O]MOTSV]QUQ VMP RO P]SVT SU QbQT RWX^OQ[ O]MO O]Q MUUQPO S_ [Q_QT[MTOJMXXQYYMTO VMP WM[Q RT MT Q__SUO OS QdOSUO _USW ]RWA

    F6G " !+/ " = 1-/4 1!&*:#25 1512!3

    @Q\M b &SNRMY &QN^UROZ &ZPOQW

    'M\[MYQTM @A )QZQP =)QZQP> SVTQ[ M XRQNQ S_ OROYQ[ YMT[A &]Q \SO M]S^PRT\ YSMT _USW UQPXST[QTO &SNRMY &QN^UROZ &ZPOQW =&&&> _SU V]RN]

    P]Q WSUO\M\Q[ ]QU YMT[A &^`PQg^QTOYZ( ]SVQbQU( P]Q MPiQ[ O]QXQORORSTQU PXS^PQP %TOSTRS MT[ 5QORNRM @Q\M =O]Q @Q\MP> OS MPP^WQYSMT MT[ `^Z ]QU ]S^PQ MT[ YSO PRTNQ P]Q VMTOQ[ OS QWR\UMOQA

    2XST RTg^RUZ VRO] O]Q &&&( MT QWXYSZQQ O]QUQ OSY[ O]Q @Q\MP O]MO O&&& [R[ TSO MXXUSbQ S_ WQW`QUP OUMTP_QUURT\ O]QRU WSUO\M\Q[ ]SWQPA3]Q @Q\MP NS^Y[( ]SVQbQU( PRWXYZ WMiQ M XURbMOQ MUUMT\QWQTO VRO)QZQP XUSbR[Q[ O]QZ XMR[ O]Q WSTO]YZ MWSUORfMORSTP ST ORWQA 3]RPXUMNORNQ( PMR[ O]Q &&& QWXYSZQQ( VMP NSWWSTXYMNQA %UWQ[ VRO]RT_SUWMORST( O]Q @Q\MP M\UQQ[ _SU )QZQP OS QdQN^OQ RT O]QRU _MbSU M [QS_ MPPR\TWQTO S_ UQMY XUSXQUOZ VRO] MPP^WXORST S_ WSUO\M\Q MT[ XM)QZQP B9:(:::A:: M_OQU P]Q ^T[QUOSSi OS ^X[MOQ O]Q MWSUORfMORSTP`Q_SUQ YQMbRT\ O]Q NS^TOUZA 3]Q @Q\MP O]QT OSSi XSPPQPPRST S_ O]Q]S^PQA

    !^O )QZQP [R[ TSO UQM[RYZ QdQN^OQ O]Q [QQ[ S_ MPPR\TWQTOA &]Q YQ_O O]QNS^TOUZ MT[ \MbQ ]QU PRPOQU( +_RYM[M( M PXQNRMY XSVQU S_ MOOSUTQNSTbQZ SVTQUP]RX S_ O]Q XUSXQUOZA +_RYM[M _RTMYYZ QdQN^OQ[ O]Q [QXUSWRPQ[ `Z ]QU PRPOQU OS O]Q @Q\MPA +_RYM[M iQXO O]Q SUR\RTMY MT[ \MO]Q @Q\MP OVS NSXRQPA 3]Q YMOOQU \MbQ STQ NSXZ OS O]Q 1SWQ/QbQYSXWQTO 'SUO\M\Q ?^T[ MT[ iQXO O]Q SO]QUA 2T_SUO^TMOQYZ( M POSUWUQP^YOQ[ RT M _YSS[ O]MO [QPOUSZQ[ O]Q NSXZ YQ_O VRO] O]QWA

    @Q\MP YQMUTQ[ O]MO )QZQP [R[ TSO ^X[MOQ O]Q MWSUORfMORSTP _SU O]Q

    UQNQRbQ[ M TSORNQ OS )QZQP _USW O]Q &&& NSTNQUTRT\ ROA 3]QZ OSY[ O]Q O]MO O]QZ MYUQM[Z \MbQ O]Q XMZWQTO OS )QZQP `^O( PRTNQ RO MXXQMURT[R__QUQTO( ST O]Q @Q\MP ^X[MOQ[ O]Q MWSUORfMORST O]QWPQYbQP MT[ XMOS O]Q &&&( O]US^\] @Q\MhP XQUPSTMY N]QNiA @Q\MP UQg^QPOQ[ O]Q &&& OMNiTSVYQ[\Q O]QRU POMO^P MP P^`US\QQP MT[ OS \RbQ O]QW MT ^X[MOQ S_O]Q MNNS^TO PS O]QZ NS^Y[ PQOOYQ RO RT _^YYA 3]Q &&& [R[ TSO UQX'QMTORWQ( O]Q )3. P]QUR__ X^`YRP]Q[ M TSORNQ _SU O]Q M^NORST PMYQ S_ O]QXUSXQUOZA

  • 8/12/2019 EVID DigestsCompilation SET01

    8/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 E

    @Q\MP _RYQ[ MT MNORST _SU NSTPR\TMORST( [MWM\QP( MT[ RTj^TNORST VRO]MXXYRNMORST _SU XUQYRWRTMUZ RTj^TNORST MT[ OQWXSUMUZ UQPOUMRTRT\ SU[QUM\MRTPO O]Q &&&

    )3. [QNR[Q[ .RbRY .MPQ RT _MbSU S_ O]Q @Q\MP MT[ O]QZ VQUQ P^`US\MOQ[

    OS O]Q UR\]OP S_ )QZQP MT[ P^`PORO^OQ[ ]QU RT O]Q &&& ]S^PRT\ YSMT MT[WSUO\M\Q NSTOUMNOA 1SVQbQU( O]RP VMP UQbQUPQ[ `Z O]Q .% V]RN] U^YQ[O]MO @Q\MP VQUQ ^TM`YQ OS XUS[^NQ O]Q [QQ[ S_ MPPR\TWQTO S_ O]QXUSXQUOZ RT O]QRU _MbSU

    *PP^Q#

    I]QO]QU SU TSO O]Q @Q\MP XUQPQTOQ[ M[Qg^MOQ XUSS_ S_ )QZQPh PMYQ S_O]Q P^`jQNO XUSXQUOZ OS O]QW

    1QY[#

    "QPA

    +TQA 3]Q .% U^YQ[ O]MO O]Q @Q\MP VQUQ ^TM`YQ OS XUSbQ O]MO )QZQPMPPR\TQ[ O]Q P^`jQNO XUSXQUOZ OS O]QW( \RbQT O]MO O]QZ _MRYQ[ OS XUQPQTOO]Q [QQ[ S_ MPPR\TWQTO RT O]QRU _MbSU ^XST M NYMRW O]MO O]QZ YSPO ROA !^OO]Q U^YQ UQg^RURT\ O]Q XUQPQTOMORST S_ O]Q SUR\RTMY S_ O]MO [QQ[ S_MPPR\TWQTO RP TSO M`PSY^OQA &QNST[MUZ QbR[QTNQ S_ O]Q NSTOQTOP S_ O]QSUR\RTMY NMT `Q M[[^NQ[( MP RT O]RP NMPQ( V]QT O]Q SUR\RTMY ]MP `QQT YSPOVRO]S^O `M[ _MRO] ST O]Q XMUO S_ O]Q XMUOZ S__QURT\ ROA

    1QUQ( TSO STYZ [R[ O]Q @Q\MP XUSbQ O]Q YSPP S_ O]Q [QQ[ S_ MPPR\TWQTO RTO]QRU _MbSU MT[ V]MO O]Q PMWQ NSTOMRTQ[( O]QZ S__QUQ[ POUST\NSUUS`SUMORST S_ O]Q _MNO S_ )QZQPh PMYQ S_ O]Q XUSXQUOZ OS O]QWA 3]QZOSSi XSPPQPPRST S_ O]Q ]S^PQ MT[ YSO M_OQU O]QZ `S^\]O ROA *T[QQ[( O]QZYRbQ[ ST RO MT[ ]QY[ RO RT O]Q NSTNQXO S_ MT SVTQU _SU ;8 ZQMUP `Q_SUQB/. NMWQ RTOS O]Q XRNO^UQA 3]QZ MYPS XMR[ MYY O]Q MWSUORfMORSTP OS O]Q&&& VRO] %TOSTRS @Q\MhP XQUPSTMY N]QNi( QbQT O]SPQ O]MO )QZQPXUSWRPQ[ OS PQOOYQ `^O [R[ TSOA %T[ V]QT O]Q &&& VMTOQ[ OS _SUQNYSPQO]Q XUSXQUOZ( O]Q @Q\MP PQTO M WMTM\QUhP N]QNi OS RO _SU O]Q `MYMTNQ S_

    O]Q YSMTA ,QRO]QU )QZQP TSU MTZ S_ ]QU UQYMORbQP NMWQ _SUVMU[ OS NYO]Q XUSXQUOZA 3]Q @Q\MP MWXYZ XUSbQ[ O]Q PMYQ OS O]QWA

    F>G " #2/:#&8 &-:9-:/2#-% " = 4 -1#%

    @ROMURN] .SUXSUMORST b .]STM 5SPRT

    ?MNOP#

    )QPXST[QTO .]STM 5SPRT VMP RT O]Q _MPO_SS[ MT[ NMOQURT\ PQUbRNQP`^PRTQPP TMWQ[ 0YMWS^UP .]RNiQT 1S^PQA @ROMURN] ]M[ `QQT ]QUP^XXYRQU S_ XS^YOUZ WQMOA

    *T O]Q WSTO]P S_ 6^YZ OS ,SbQW`QU ;GGH( 5SPRThP SU[QUP S_ [UQPPQ[N]RNiQT MT[ SO]QU WQMO XUS[^NOP MYYQ\Q[YZ MWS^TOQ[ OS BG9;(:E8A;:A/^URT\ O]RP PMR[ XQURS[( 5SPRThP XS^YOUZ WQMO TQQ[P _SU ]QU `^PRTQPPVQUQ PQUbRNQ[ `Z )S[UR\S /RUQNOS MT[ %YYMT )SPM( `SO] PMYQPWQT MT[M^O]SURfQ[ NSYYQNOSUP S_ @ROMURN]( MT[ %UTSY[ !MZ`MZ( M P^XQUbRPSUPMR[ NSUXSUMORSTA 2T_SUO^TMOQYZ( RO VMP MYPS [^URT\ O]Q PMWQ XQURS]QU MNNS^TO POMUOQ[ OS QdXQURQTNQ XUS`YQWP `QNM^PQ S_ O]Q _MNO /RUQNOS [QYRbQUQ[ POSNiP OS ]QU QbQT VRO]S^O XURSU `SSiRT\ V]RN] RP O]Q

    N^POSWMUZ XUSNQPP S_ [SRT\ `^PRTQPP VRO] ]QUA

    /RUQNOShP PQUbRNQP VQUQ OQUWRTMOQ[ `Z @ROMURN] VRO]S^O 5SPRiTSVYQ[\QA 1Q YQ_O VRO]S^O O^UTRT\ SbQU PSWQ P^XXSUORT\ RTbSRNQPNSbQURT\ O]Q SU[QUP S_ 5SPRTA )SPM MT[ !MZ`MZ( ST O]Q SO]QU ]MT[(UQPR\TQ[ P^`PQg^QTOYZA 6^PO YRiQ /RUQNOS( O]QZ [R[ TSO MYPS O^UT SbQUXQUORTQTO RTbSRNQP NSbQURT\ 5SPRThP MNNS^TOA

    /QWMT[ YQOOQUP VQUQ PQTO OS 5SPRT NSbQURT\ ]QU MYYQ\Q[ ^TXMR[ MNNS^TMWS^TORT\ OS BG9;(:E8A;:A !QNM^PQ S_ PMR[ [QWMT[P( P]Q N]QNiQ[ ]QU

  • 8/12/2019 EVID DigestsCompilation SET01

    9/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 G

    UQNSU[P MT[ [RPNSbQUQ[ O]MO P]Q ]M[ MT SbQUXMZWQTO OS @ROMURN] RT O]QMWS^TO S_ B N]QNiP MWS^TORT\ OSB9EE(CH8A8: V]RN] VQUQ [RP]STSUQ[ QRO]QU _SU UQMPSTP J /UMVT %\MRTPO*TP^__RNRQTO ?^T[P =/%*?> SU &OSX BMZWQTOA

    @ROMURN] _RYQ[ M NSWXYMRTO _SU P^W S_ WSTQZ M\MRTPO 5SPRTA

    *PP^Q#

    I]QO]QU SU TSO 5SPRT ]MP XUSbQT XMZWQTO OS @ROMURN]A

    1QY[#

    ,SA

    %P M \QTQUMY U^YQ( STQ V]S XYQM[P XMZWQTO ]MP O]Q `^U[QT S_ XUSbRT\ ROA*T 6RWQTQf bA ,5).( O]Q .S^UO U^YQ[ O]MO O]Q `^U[QT UQPOP ST O]Q [Q`OSU

    OS XUSbQ XMZWQTO( UMO]QU O]MT ST O]Q NUQ[ROSU OS XUSbQ TSTJXMZWQTOA3]Q [Q`OSU ]MP O]Q `^U[QT S_ P]SVRT\ VRO] YQ\MY NQUOMRTOZ O]MO O]QS`YR\MORST ]MP `QQT [RPN]MU\Q[ `Z XMZWQTOA

    %_OQU QdMWRTMORST S_ O]Q QbR[QTNQ XUQPQTOQ[( O]RP .S^UO RP S_ O]QSXRTRST O]MO 5SPRT _MRYQ[ OS XUQPQTO M PRT\YQ S__RNRMY UQNQRXO OS XUSbQXMZWQTOA 3]RP RP NSTOUMUZ OS O]Q VQYYJPQOOYQ[ U^YQ O]MO M UQNQRXO( V]RN] RPM VUROOQT MT[ PR\TQ[ MNiTSVYQ[\WQTO O]MO WSTQZ MT[ \SS[P ]MbQ `QQT[QYRbQUQ[( RP O]Q `QPO QbR[QTNQ S_ O]Q _MNO S_ XMZWQTO MYO]S^\] TSOQdNY^PRbQA %YY P]Q XUQPQTOQ[ VQUQ NSXRQP S_ O]Q YRPO S_ N]QNiP MYYQ\Q[YZ

    RPP^Q[ OS @ROMURN] O]US^\] ROP M\QTO /RUQNOS( M &OMOQWQTO S_ BMZW'M[Q OS @ROMURN]( MT[ MXXMUQTOYZ NSXRQP S_ O]Q XQUORTQTO ]RPOSUZ SN]QNiRT\ MNNS^TO VRO] )RfMY .SWWQUNRMY !MTiRT\ .SUXSUMORST =).!.>A%O `QPO( O]QPQ WMZ STYZ PQUbQ MP [SN^WQTOMUZ UQNSU[P S_ ]QU `^PRTQPP[QMYRT\P VRO] @ROMURN] OS iQQX OUMNi S_ O]Q XMZWQTOP WM[Q `^O O]QPQ M

    TSO QTS^\] OS XUSbQ XMZWQTOA

    %UORNYQ ;9CG( XMUM\UMX] 9 S_ O]Q .RbRY .S[Q XUSbR[QP# 3]Q [QYRbQUZ S_XUSWRPPSUZ TSOQP XMZM`YQ OS SU[QU( SU `RYYP S_ QdN]MT\Q SU SO]QUWQUNMTORYQ [SN^WQTOP P]MYY XUS[^NQ O]Q Q__QNO S_ XMZWQTO STYZ V]O]QZ ]MbQ `QQT NMP]Q[( SU V]QT O]US^\] O]Q _M^YO S_ O]Q NUQ[ROSU O]QZ]MbQ `QQT RWXMRUQ[A a-WX]MPRP P^XXYRQ[c

    *T O]Q NMPQ MO `MU( TS NMP] XMZWQTO VMP XUSbQ[A *O VMP TQRO]QNST_RUWQ[ O]MO O]Q N]QNiP RPP^Q[ `Z 5SPRT VQUQ MNO^MYYZ QTNMP]Q[ `Z@ROMURN]A 3]^P( O]Q .S^UO NMTTSO NSTPR[QU O]MO XMZWQTO( W^N] YQPSbQUXMZWQTO( WM[Q `Z 5SPRTA

    F?G 4 !! " = H,& , /%H %="=

    ?MNOP#

    'R[MP /RbQUPR_RQ[ -dXSUO .SUXSUMORST ='/-.> S`OMRTQ[ M p;(C::(:::YSMT _USW F!. !MTi ,A@A =F!. !MTi>A F!. !MTi RP M !QY\RMTNSUXSUMORST YRNQTPQ[ OS [S `^PRTQPP RT O]Q B]RYRXXRTQPA +T ;9 %^\^PO;GGD( &MW^QY 2A 5QQ =5QQ>( MPPRPOMTO OUQMP^UQU MT[ [RUQNOSU S_ '/-.QdQN^OQ[ M XUSWRPPSUZ TSOQ RT _MbSU S_ F!. !MTi MT[ M [QQ[ S_MPPR\TWQTO OUMTP_QUURT\ MYY S_ '/-.hP UR\]OP SbQU .ST_RUWQ[ B^UN]MPQ+U[QU ,SA '3.J

  • 8/12/2019 EVID DigestsCompilation SET01

    10/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 ;:

    '/-. S`OMRTQ[ MTSO]QU YSMT( MWS^TORT\ OS pH

  • 8/12/2019 EVID DigestsCompilation SET01

    11/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 ;;

    FAG 4 !9/%2- &-%1-4#$/2!$ 3 #%#%+&- = " = $ *3/9#1

    ?MNOP#

    5QXMTOS .STPSYR[MOQ[ 'RTRT\ .SUXSUMORST =XQORORSTQU>( M [SWQPORNj^UR[RNMY QTOROZ QT\M\Q[ RT WRTRT\( QWXYSZQ[ 'SUQTS /^WMXRP MT[-YWS 3^T[M\^R MP YQM[ WRTQUPk MT[ ?UMTNRP 5RM\MS( MP YSM[( ]M^Y MT[[^WX =51/> WMN]RTQ SXQUMOSU =UQPXST[QTOP>A %YY O]UQQ VQUQ MPPR\TQ[MO O]Q E

  • 8/12/2019 EVID DigestsCompilation SET01

    12/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 ;9

    1SVQbQU( O]Q M[WRPPR`RYROZ S_ QbR[QTNQ P]S^Y[ TSO `Q NST_^PQ[ VRO] ROPXUS`MORbQ bMY^QA %[WRPPR`RYROZ UQ_QUP OS O]Q g^QPORST S_ V]QO]QU NQUOMRTXRQNQP S_ QbR[QTNQ MUQ OS `Q NSTPR[QUQ[ MO MYY( V]RYQ XUS`MORbQ bMY^Q

    UQ_QUP OS O]Q g^QPORST S_ V]QO]QU O]Q M[WROOQ[ QbR[QTNQ XUSbQP MTRPP^QA 3]^P( M XMUORN^YMU ROQW S_ QbR[QTNQ WMZ `Q M[WRPPR`YQ( `^O ROPQbR[QTORMUZ VQR\]O [QXQT[P ST j^[RNRMY QbMY^MORST VRO]RT O]Q \^R[QYRTQPXUSbR[Q[ `Z O]Q U^YQP S_ QbR[QTNQA

    I]RYQ RO RP OU^Q O]MO M[WRTRPOUMORbQ SU g^MPRJj^[RNRMY `S[RQP YRiQ O]Q,5). MUQ TSO `S^T[ `Z O]Q OQN]TRNMY U^YQP S_ XUSNQ[^UQ RT O]QM[j^[RNMORST S_ NMPQP( O]RP XUSNQ[^UMY U^YQ P]S^Y[ TSO `Q NSTPOU^Q[ MP MYRNQTPQ OS [RPUQ\MU[ NQUOMRT _^T[MWQTOMY QbR[QTORMUZ U^YQPA 3]QQbR[QTNQ XUQPQTOQ[ W^PO MO YQMPO ]MbQ M WS[RN^W S_ M[WRPPR`RYROZ _SU ROOS ]MbQ XUS`MORbQ bMY^QA9H ,SO STYZ W^PO O]QUQ `Q PSWQ QbR[QTNQ OSP^XXSUO M _RT[RT\ SU NSTNY^PRST( `^O O]Q QbR[QTNQ W^PO `Q P^`POMTORMYA&^`POMTORMY QbR[QTNQ RP WSUQ O]MT M WQUQ PNRTORYYMA *O WQMTP P^N]UQYQbMTO QbR[QTNQ MP M UQMPSTM`YQ WRT[ WR\]O MNNQXO MP M[Qg^MOQ OSP^XXSUO M NSTNY^PRSTA9E 3]^P( QbQT O]S^\] OQN]TRNMY U^YQP S_ QbR[QTNQMUQ TSO POURNOYZ NSWXYRQ[ VRO] `Q_SUQ O]Q 5% MT[ O]Q ,5).( O]QRU[QNRPRST W^PO `Q `MPQ[ ST QbR[QTNQ O]MO W^PO( MO O]Q bQUZ YQMPO( `QP^`POMTORMYA

    3]Q .S^UO RP NSTbRTNQ[ O]MO O]Q 6SRTO %__R[MbRO( `QRT\ PS^UNQ[ _USW.]MW`QUP( /MWSPYS\( /M\^RS MT[ 'M[MS( ]MP TS XUS`MORbQ bMY^Q OSP^XXSUO QbR[QTNQ OS VMUUMTO O]Q [RPWRPPMY S_ O]Q UQPXST[QTOPA.]MW`QUP MT[ /M\^RS [R[ TSO R[QTOR_Z O]Q WRTQUP RTbSYbQ[ RT O]Q MNO S_]R\]\UM[RT\A *T M[[RORST( /MWSPYS\hP _RUPO MT[ PQNST[ PVSUT POMOQWQTOP[R[ TSO RWXYRNMOQ UQPXST[QTOP( MT[ 'M[MS UQNMTOQ[ ]RP POMOQWQTORWXYRNMORT\ UQPXST[QTO 5RM\MSA %P QMUYRQU [RPN^PPQ[( O]Q PVSUTPOMOQWQTOP MT[ jSRTO M__R[MbROP S_ O]Q PS^UNQP [S TSO NSUUS`SUMOQ `^O

    MNO^MYYZ NMPO [S^`O MP OS O]Q bQUMNROZ S_ O]Q POMOQWQTOP RT O]Q%__R[MbROA

    7 8/2 %!!$ %-2 , ! 9 :-"!$

    /= )*$#/4 %-2#&!

    F;G " !:1-I/ J ): = " = & /:/+*/

    .MT[QYMURS @QUPSfM 6U b 0^RYYQUWS .MUM\^Q QO MYA

    ?MNOP#

    3]Q ./% NST[^NOQ[ M X^`YRN `R[[RT\ _SU O]Q P^XXYZ OS O]Q ./% S_NSWX^OQU Qg^RXWQTO MT[ XQURX]QUMYPA 3]Q O]UQQ QTORORQP O]MO OSSi

    VQUQ 3QOUM .SUXSUMORSTJ3UR\QW .SWX^OQUP =3QOUM>( 'RNUSNRUN^ROP ='RNUSNRUN^ROP>( MT[ .SY^W`RM .SWX^OQUP =.SY^W`RM>A

    ?SYYSVRT\ O]Q `R[[RT\( O]Q QbMY^MORST =V]RN] MYPS RTNY^[Q[ M OQN]TRNMYQbMY^MORST WM[Q `Z O]Q /QbQYSXWQTO %NM[QWZ S_ O]Q B]RYRXXRTQP =/%B>MO O]Q UQg^QPO S_ O]Q ./% MT[ O]Q QTP^RT\ MXXUSbMY \RbQT `Z .MT[QYMURS5A @QUPSfM( 6UA MP O]Q ./%hP -dQN^ORbQ /RUQNOSUA 3QOUM VMP MVMU[Q[ OP^XXYZ NSTOUMNO _SU O]Q OSOMY MWS^TO S_ B9(9E

  • 8/12/2019 EVID DigestsCompilation SET01

    13/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 ;8

    )QPR[QTO %^[ROSU O]^P RPP^Q[ M ,SORNQ S_ /RPMYYSVMTNQ RT ,SbQW`QU;GG8( _SU O]Q MWS^TO S_ BEE;(E;GA

    3]Q ./% PS^\]O M UQNSTPR[QUMORST MT[ XUSbR[Q[ ROP `MPRP MP OS V]Z( STO]Q V]SYQ( O]Q X^UN]MPQ _USW 3QOUM VMP j^POR_RQ[A

    2TNSTbRTNQ[( O]Q .+% RPP^Q[ ROP [QNRPRST M__RUWRT\ O]Q [RPMYYSVMTNQO]QUQ`Z ^X]SY[RT\ O]Q NSWXMURPST XUSNQPP ^T[QUOMiQT `Z O]Q )QPR[QTO%^[ROSU MT[ O]Q 3&+A 3]Q .S% ]QY[ O]MO ./% P]S^Y[ TSO ]MbQ MVMU[Q[O]Q NSTOUMNO OS 3QOUM `^O OS O]Q SO]QU NSWXQORT\ `R[[QU( V]SPQ `R[ RPWSUQ M[bMTOM\QS^P OS O]Q \SbQUTWQTOA *T M[[RORST( O]Q .+% ]QY[@QUfSPM XQUPSTMYYZ MT[ PSYR[MURYZ YRM`YQ _SU O]Q [RPMYYSVQ[ MWS^TO S_BEE;(E;G ST MNNS^TO S_ ]RP ]MbRT\ MNOQ[ RT `M[ _MRO]A

    3]Q ./% O]QUQ_SUQ XQORORSTQ[ O]Q 1R\] .S^UO OS UQbQUPQ O]Q .+%hPU^YRT\PA

    *PP^Q#

    I]QO]QU SU TSO O]Q SbQUXURNRT\ S_ O]Q NSWX^OQU ^TROP VMP XUSbQ[A

    1QY[#

    "QPA 3]Q .S^UO M_RUWQ[ O]Q _RT[RT\P S_ .+%A

    3]Q XSTQTOQ TSOQ[ MO O]Q S^OPQO O]MO MNORT\ ST ROP NSTPORO^ORSTMYWMT[MOQ OS rXUSW^Y\MOQ MNNS^TORT\ MT[ M^[RORT\ U^YQP( MT[ UQ\^YMORSTPRTNY^[RT\ O]SPQ _SU O]Q XUQbQTORST MT[ [RPMYYSVMTNQ S_ RUUQ\^YMU(^TTQNQPPMUZ( QdNQPPRbQ( QdOUMbM\MTO SU ^TNSTPNRSTM`YQ QdXQT[RO^UQP( SU^PQP S_ \SbQUTWQTO _^T[P MT[ XUSXQUORQP(s O]Q .+% XUSW^Y\MOQ[NQUOMRT MWQT[Q[ U^YQP V]RN] RTNY^[Q[ XUSbRPRSTP UQYMORT\ OS QdNQPPRbQQdXQT[RO^UQP V]RN] P]MYY `Q [QOQUWRTQ[ `Z XYMNQ MT[ SUR\RT S_ \SS[P(bSY^WQ SU g^MTOROZ S_ X^UN]MPQ( PQUbRNQ VMUUMTORQP( g^MYROZ( PXQNRMY_QMO^UQP S_ ^TROP X^UN]MPQ[ MT[ O]Q YRiQA 2T[QU O]SPQ U^YQP( XURNQ RPNSTPR[QUQ[ rQdNQPPRbQs R_ RO RP WSUQ O]MT O]Q ;:e MYYSVM`YQ XURNQbMURMTNQ `QOVQQT O]Q XURNQ XMR[ _SU O]Q ROQW `S^\]O MT[ O]Q XURNQ S_ O]QPMWQ ROQW XQU NMTbMPP S_ O]Q M^[ROSUA %T[ RT [QOQUWRTRT\ V]QO]QU SU

    TSO O]Q XURNQ RP QdNQPPRbQ( PQbQUMY POMOQ[ _MNOSUP WMZ `Q NSTPR[QUO]Q .+%A

    3]Q WMjSUROZ S`PQUbQ[ O]MO O]Q UQNSU[P P]SVQ[ O]MO V]RYQ O]Q .+%_S^T[ TSO]RT\ VUST\ XQU PQ VRO] O]Q NUROQURM M[SXOQ[ `Z O]Q ./% RT O]Q

    SbQUMYY QbMY^MORST S_ O]Q `R[P( O]Q NST[^NO S_ O]Q OQN]TRNMY MPXQNOPQURS^PYZ [S^`O_^YA *T XMUORN^YMU( O]Q _RTMY OQN]TRNMY QbMY^MORSVMP MXXMUQTOYZ WMTRX^YMOQ[ OS _MbSU 3QOUM( V]RN] S__QUQ[ M FSUQWM[Q `UMT[ MP M\MRTPO 'RNUSNRUN^ROP V]RN] S__QUQ[ M 2&JWM[Q `UMT[PMR[ OS `Q WSUQ [^UM`YQ( MO M YSVQU XURNQA

    %YO]S^\] O]Q /%B( RT M YQOOQU( NST_RUWQ[ OS O]Q ./% O]MO `MPQ[ ST O]QRUQbMY^MORST RT NSWXYRMTNQ VRO] O]Q r\UM[RT\ PZPOQWs PXQNR_RQ[ `Z ./%O]Q ^TROP S_ 3QOUM VQUQ `QPO P^ROQ[ OS O]Q TQQ[P S_ ./%A 1SVQbQU(6^PORNQ @RYYMUMWM OSSi TSOQ O]MO ^XST RTbQPOR\MORST( RO VMP [RPNO]MO O]QUQ VMP MT QMUYRQU UQXSUO _USW O]Q /%B V]RN] MNO^MYYZ POMNSTOUMUZ _RT[RT\ `^O O]MO M UQXUQPQTOMORbQ _USW ./% \MbQ _^UO]QURTPOU^NORSTP OS O]Q /%B UQ\MU[RT\ rXQTMYOZ XSRTOPs O]MO P]S^Y[ `QMXXYRQ[ _SU [QbRMORST RT ]MU[VMUQ PXQNR_RNMORSTP( O]^P UQP^YORT\ RM__RUWMORbQ YQOOQU WQTORSTQ[ QMUYRQU O]MO \MbQ 3QOUM O]Q ]R\]QPO

    3]Q WMRT [QNRPRST O]QUQ_SUQ ]QY[ O]MO RO VMP NYQMU O]MO rO]Q NST[^NOX^`YRN `R[[RT\ RT O]RP NMPQ VMP TSO WM[Q S`jQNORbQYZ VRO] O]Q QT[ RTbRQV S_ X^UN]MPRT\ g^MYROZ Qg^RXWQTO MO O]Q YQMPO NSPO OS O\SbQUTWQTOA 3]Q XURNQ [R__QUQTNQ _MU QdNQQ[Q[ O]Q ;:e MYYSVM`YQbMURMTNQ RT O]Q ^TRO `S^\]O MT[ O]Q PMWQ ROQWhP XURNQtsA

    3]Q .S^UO M__RUWQ[ O]MO rO]Q _RT[RT\P S_ g^MPRJj^[RNRMY M\QTNRQP( P^N] MP

    O]Q .+%( V]RN] ]MbQ MNg^RUQ[ QdXQUORPQ `QNM^PQ O]QRU j^URP[RNORST RNST_RTQ[ OS PXQNR_RN WMOOQUP MUQ \QTQUMYYZ MNNSU[Q[ TSO STYZ UQPXMO ORWQP QbQT _RTMYROZ R_ P^N] _RT[RT\P MUQ P^XXSUOQ[ `Z P^`POMTOQbR[QTNQA *O RP STYZ ^XST M NYQMU P]SVRT\ O]MO O]Q .+% MNOQ[ VRO]S^O SRT QdNQPP S_ j^URP[RNORST SU VRO] \UMbQ M`^PQ S_ [RPNUQORST MWS^TORT\ OYMNi SU QdNQPP S_ j^URP[RNORST O]MO O]RP .S^UO VRYY PQO MPR[Q ROP [QNRSU _RTMY SU[QUPA 3]Q .S^UO _RT[P TS P^N] MU`ROUMURTQPP SU \UMbQ M`^PQ STO]Q XMUO S_ O]Q .+% V]QT RO [RPMYYSVQ[ RT M^[RO O]Q MWS^TOUQXUQPQTORT\ O]Q SbQUXURNQ RT O]Q XMZWQTO `Z ./% _SU O]Q X^UN]MPQ[NSWX^OQU ^TROP MT[ XQURX]QUMYP( ROP _RT[RT\P MUQ VQYYJP^XXSUOQ[ `Z QbR[QTNQ ST UQNSU[As

  • 8/12/2019 EVID DigestsCompilation SET01

    14/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 ;C

    F

  • 8/12/2019 EVID DigestsCompilation SET01

    15/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 ; 5!,* ]M[ bMYR[ YQ\MY \US^T[P OS OQUWRTMOQ [Q .MPOUShP QWXYSZWQTO_SU YSPP S_ OU^PO MT[ NST_R[QTNQk

    =9> O]Q M__R[MbROP S_ 5!,*hP VROTQPPQP P]S^Y[ TSO ]MbQ `QQT OSOMYYZ[RPUQ\MU[Q[k MT[

    =8> 5!,* RP N^UUQTOYZ ^T[QU UQ]M`RYROMORST( ]QTNQ( O]Q XUSNQQ[RT\P RTO]RP NMPQ W^PO `Q P^PXQT[Q[A 5!,* XSRTOP S^O O]MO RO _RYQ[( VRO] O]Q)3. S_ 'MiMOR( M XQORORST _SU .SUXSUMOQ )Q]M`RYROMORST VRO] BUMZQ_SU &^PXQTPRST S_ BMZWQTOP( MT[ ST %^\^PO ;G( 9::#

    I]QO]QU SU TSO O]Q .S^UO P]S^Y[hbQ OMiQT j^[RNRMY TSORNQ S_ O]QUQ]M`RYROMORST XUSNQQ[RT\P =MT[ O]^P P^PXQT[RT\ O]Q XUSNQQ[RT\P RTO]RP NMPQ>A

    )25*,0#

    ,+A ,QbQUO]QYQPP( VRO] 5!,*hP WMTR_QPOMORST O]MO RO RP PORYY ^T[QU\SRUQ]M`RYROMORST( O]Q .S^UO UQPSYbQP OS P^PXQT[ O]Q QdQN^ORST S_ S^U&QXOQW`QU 98( 9::E /QNRPRSTA 3]Q P^PXQTPRST P]MYY YMPO ^X OS O]QOQUWRTMORST S_ O]Q UQ]M`RYROMORST XUSNQQ[RT\P( MP XUSbR[Q[

    )%3*+#

    3]Q _RYRT\ S_ M WQWSUMT[^W `Q_SUQ O]Q .S^UO RP TSO MT QWXOZUQg^RUQWQTO( [QbSR[ S_ YQ\MY PR\TR_RNMTNQA *T %A'A ,SA GGJ9J:CJ&.( O]Q

  • 8/12/2019 EVID DigestsCompilation SET01

    23/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 98

    .S^UO [QNYMUQ[ O]MOSNN`PN ZKSNPR SV _ZPaST`N _QPKRSVXN ^`M VTMSVLQ`RPR SV MWP \P\TZKVR`\ NWKQQ ^P RPP\PR YKSaPR TZK^KVRTVPR= !QRT\ M P^WWMORST S_ O]Q XMUORQPh XUQbRS^P XYQM[RT\P( O]QWQWSUMT[M MYSTQ WMZ `Q NSTPR[QUQ[ `Z O]Q .S^UO RT [QNR[RT\ SUUQPSYbRT\ O]Q XQORORSTA 3]^P( ST MNNS^TO S_ 5!,*hP SWRPPRST( STYZ O]QRPP^QP UMRPQ[ RT O]Q XMUORQPh WQWSUMT[M o XURTNRXMYYZ( O]Q bMYR[ROZ S_ [Q.MPOUShP [RPWRPPMY _USW 5!,* o VQUQ NSTPR[QUQ[ `Z O]Q .S^UO RTUQPSYbRT\ O]Q NMPQA

    r3]Q .S^UO [SQP TSO OMiQ j^[RNRMY TSORNQ S_ XUSNQQ[RT\P RT O]Q bMURS^PNS^UOP S_ j^PORNQ RT O]Q B]RYRXXRTQPAs %O O]Q ORWQ O]Q .S^UO [QNR[Q[ O]QXUQPQTO NMPQ( RO VMP TSO `S^T[ OS OMiQ TSOQ S_ MT[ NSTPR[QU O]QXQT[QTNZ S_ O]Q UQ]M`RYROMORST XUSNQQ[RT\P( MP O]Q WMOOQU ]M[ TSO `QQTXUSXQUYZ `US^\]O OS O]Q .S^UOhP MOOQTORSTA *T$3@4/> SA714@- $3@4-1< FE M14-2T/( VQ PMR[ O]MO#

    *T UQPSYbRT\ NSTOUSbQUPRQP( NS^UOP NMTSTYZ NSTPR[QU _MNOP MT[ RPP^QP XYQM[Q[ `Z O]QXMUORQPA .S^UOP( MP VQYY MP WM\RPOUMOQP XUQPR[RT\SbQU O]QW MUQ TSO SWTRPNRQTOA 3]QZ NMT STYZ MNOST O]Q _MNOP MT[ RPP^QP XUQPQTOQ[ `Q_SUQ O]QW RTMXXUSXURMOQ XYQM[RT\PA 3]QZ WMZ TSO QbQTP^`PORO^OQ O]QRU SVT XQUPSTMY iTSVYQ[\Q _SUQbR[QTNQA ,SU WMZ O]QZ OMiQ TSORNQ S_ WMOOQUPQdNQXO O]SPQ QdXUQPPYZ XUSbR[Q[ MP P^`jQNOP S_WMT[MOSUZ j^[RNRMY TSORNQA

    d d d d

    3]Q XMUOZ MPiRT\ O]Q NS^UO OS OMiQj^[RNRMY TSORNQ RP S`YR\MOQ[ OS P^XXYZ O]Q NS^UOVRO] O]Q _^YY OQdO S_ O]Q U^YQP O]Q XMUOZ [QPRUQP ROOS ]MbQ TSORNQ S_A

    IRO] O]Q _MRY^UQ S_ 5!,* OS UMRPQ UQ]M`RYROMORST XUSNQQ[RT\P RT ROPWQWSUMT[^W( O]Q .S^UO ]M[ P^__RNRQTO \US^T[P OS P^XXSPQ O]MO O]QUQ]M`RYROMORST XQORORST ]M[ `QQT [RPWRPPQ[ `Z O]Q ORWQ O]Q NMPQ VMPP^`WROOQ[ _SU [QNRPRSTA

    ,= )*$#/4 / $3#11#-%

    F;G 1 /% 3 #+*!4 &-:9 = " = H /4/4-

    F

  • 8/12/2019 EVID DigestsCompilation SET01

    24/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 9C

    %P PORX^YMOQ[ [^URT\ XUQOURMY( MNN^PQ[ 3URTR[M[ \MbQ %!&J.!, ,QVP,QOVSUi MT QdNY^PRbQ RTOQUbRQV PSWQ ORWQ M_OQU O]Q RTNR[QTO(NST_QPPRT\ ]RP XMUORNRXMORST RT O]Q @MYQTORTQhP /MZ `SW`RT\ RTNR[QTOA *TMTSO]QU QdNY^PRbQ RTOQUbRQV ST O]Q TQOVSUi( MNN^PQ[ !M]MUMT YRiQVRPQM[WROOQ[ ]RP USYQ RT O]Q `SW`RT\ RTNR[QTOA ?RTMYYZ( MNN^PQ[ %PMYR \MbQ MOQYQbRPRST RTOQUbRQV( NST_QPPRT\ O]MO ]Q ]M[ P^XXYRQ[ O]Q QdXYSPRbQ[QbRNQP _SU O]Q `SW`RT\A

    +T O]QRU MUUMR\TWQTO _SU O]Q W^YORXYQ W^U[QU N]MU\Q( !M]MUMT(3URTR[M[( MT[ %PMYR MYY QTOQUQ[ M XYQM S_ \^RYOZA +T O]Q SO]QU ]MT[( ^XSTMUUMR\TWQTO _SU O]Q W^YORXYQ _U^POUMOQ[ W^U[QU N]MU\Q =[R__QUQTO NMPQ>(MNN^PQ[ %PMYR XYQ[ \^RYOZA %NN^PQ[ 3URTR[M[ MT[ !M]MUMT XYQ[ TSO \^RYOZA3URTR[M[ MT[ !M]MUMT ]SVQbQU P^`PQg^QTOYZ N]MT\Q[ O]QRU XYQMP OS\^RYOZ RT YR\]O S_ O]QRU XUQ OURMY PORX^YMORSTPA

    'QMTV]RYQ( M_OQU `QRT\ [RPN]MU\Q[ MP POMOQ VROTQPP( MNN^PQ[ %PMYROQPOR_RQ[ M\MRTPO O]Q SO]QU WQW`QUP S_ O]Q %`^ &MZZM_A

    *PP^QP#

    ;A I]QO]QU SU TSO MNNQXORT\ MNN^PQ[JMXXQYYMTOPh XYQM S_ \^RYO [QPXROQRTP^__RNRQTNZ S_ PQMUN]RT\ RTg^RUZ RTOS O]Q bSY^TOMURTQPP MT[ _^YYNSWXUQ]QTPRST S_ O]Q NSTPQg^QTNQP S_ O]Q PMR[ XYQM RP XUSXQUA

    9A I]QO]QU SU TSO P^N] OQPORWSTZ S_ %PMYR RP M[WRPPR`YQ M\MRTPO ]RP NSJNSTPXRUMOSUPA

    1QY[#

    ;A "QPA %NN^PQ[ !M]MUMT MT[ 3URTR[M[ XUQbRS^PYZ XYQ[ \^RYOZ OS MTSO]QUN]MU\Q o W^YORXYQ W^U[QU o `MPQ[ ST O]Q PMWQ MNO UQYRQ[ ^XST RT O]Q

    W^YORXYQ _U^POUMOQ[ W^U[QU N]MU\QA 3]Q .S^UO _^UO]QU TSOQP O]MO XUOS O]Q N]MT\Q S_ XYQM OS STQ S_ \^RYO( MNN^PQ[ !M]MUMT MT[ 3URTR[M[WM[Q OVS SO]QU NST_QPPRSTP S_ \^RYO o STQ O]US^\] MT QdOUMj^[RNRMYNST_QPPRST =QdNY^PRbQ OQYQbRPRST RTOQUbRQVP( MP PORX^YMOQ[ `Z MNN^PQ[ [^URT\ XUQOURMY>( MT[ O]Q SO]QU bRM j^[RNRMY M[WRPPRST =XUQPORX^YMORST>A .STPR[QURT\ O]Q _SUQ\SRT\ NRUN^WPOMTNQP( O]Q .S^UO [QQWRO ^TTQNQPPMUZ OS U^YQ ST O]Q P^__RNRQTNZ S_ O]Q lPQMUN]RT\ RTg^RUZl O]RP RTPOMTNQ

    9A "QPA %NN^PQ[ NSTOQT[P O]MO O]Q OQPORWSTZ S_ %PMYR RP RTM[WRPPRX^UP^MTO OS &QNA 8:( )^YQ ;8: S_ O]Q )^YQP S_ .S^UOA *O RP OU^Q O]MO ^T[QUO]Q U^YQ( POMOQWQTOP WM[Q `Z M NSTPXRUMOSU M\MRTPO M NSJNSTPXRUMOM[WRPPR`YQ STYZ V]QT WM[Q [^URT\ O]Q QdRPOQTNQ S_ O]Q NSTPXRUMNZA1SVQbQU( MP O]Q .S^UO U^YQ[ RT BQSXYQ bA !^TOM\( R_ O]Q [QNYMUMTO UQXQMO]Q POMOQWQTO RT NS^UO( ]RP QdOUMj^[RNRMY NST_QPPRST `QNSWQP M j^[RM[WRPPRST( WMiRT\ O]Q OQPORWSTZ M[WRPPR`YQ MP OS `SO] NSTPXRUMOSU3]^P( RT BQSXYQ bA BMYRjST( O]Q .S^UO ]QY[ O]Q _SYYSVRT\#

    t aIcQ W^PO WMiQ M [RPORTNORST `QOVQQT QdOUMj^[RNRMY MT[ j^[RNRMYNST_QPPRSTPA %T QdOUMj^[RNRMY NST_QPPRST WMZ `Q \RbQT RT QbR[QTNM\MRTPO O]Q NST_QPPMTO `^O TSO M\MRTPO ]RP NSJMNN^PQ[ MP O]QZ MU[QXURbQ[ S_ O]Q SXXSUO^TROZ OS NUSPPJQdMWRTQ ]RWA % j^[RNRMY NST_QPPRRP M[WRPPR`YQ M\MRTPO O]Q [QNYMUMTOhP NSJMNN^PQ[ PRTNQ O]Q YMOOM__SU[Q[ SXXSUO^TROZ OS NUSPPJQdMWRTQ O]Q _SUWQUA &QNORST 8:( )^YQ ;8S_ O]Q )^YQP S_ .S^UO MXXYRQP STYZ OS QdOUMj^[RNRMY MNOP SU M[WRPPMT[ TSO OS OQPORWSTZ MO OURMY V]QUQ O]Q XMUOZ M[bQUPQYZ M__QNOQ[ ]SXXSUO^TROZ OS NUSPPJQdMWRTQ O]Q [QNYMUMTOA 'QUNQTQhP M[WRPPRWXYRNMORT\ ]RP NSJMNN^PQ[ VMP \RbQT ST O]Q VROTQPP POMT[A *O M[WRPPR`YQ RT QbR[QTNQ M\MRTPO MXXQYYMTO BMYRjSTA 'SUQSbQU( V]PQbQUMY MNN^PQ[ MUQ OURQ[ OS\QO]QU _SU O]Q PMWQ S__QTPQ( O]Q OQPORS_ M NSJMNN^PQ[ RWXYRNMORT\ ]RP NSJMNN^PQ[ RP NSWXQOQTO QbR[QTM\MRTPO O]Q YMOOQUA

    F6G 9 8#4#99#%!1 " = $ ! + *I3/%

    B]RYRXXRTQP b /Q 0^fWMT

  • 8/12/2019 EVID DigestsCompilation SET01

    25/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 9( M NSTOUMNOSU MNNUQ[ROQ[ `Z O]Q B,B _SU O]Q P^XXYZS_ S__RNQ MT[ NSTPOU^NORST WMOQURMYP MT[ Qg^RXWQTO( MT[ _SU O]Q [QYRbQUZS_ bMURS^P PQUbRNQP P^N] MP XURTORT\ MT[ UQTOMY( UQXMRU S_ bMURS^PQg^RXWQTO( MT[ UQTSbMORST S_ `^RY[RT\P( _MNRYRORQP( bQ]RNYQP( ORUQP( MT[PXMUQ XMUOPA

    3]Q B,B -T\RTQQURT\ &QUbRNQP =B,B-&>( UQYQMPQ[ M )Qg^RPRORST MT[*PP^Q @S^N]QU _SU O]Q MNg^RPRORST S_ bMURS^P `^RY[RT\ WMOQURMYPMWS^TORT\ OS B9(9EE(

  • 8/12/2019 EVID DigestsCompilation SET01

    26/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 9H

    F>G 3 /4/5/% #%1*:/%&! " = 9 8#4#99#%! . #:12 #%1*:/%&!

    'MYMZMT *TP^UMTNQ b B]RYRXXRTQ ?RUPO *TP^UMTNQ

    &RTNQ ;GEG( IZQO] B]RYRXXRTQP( *TNA =IZQO]> MT[ UQPXST[QTO )QX^OM`YQ

    ?SUVMU[QU &QUbRNQP( *TNA =)QX^OM`YQ> ]M[ `QQT MTT^MYYZ QdQN^ORT\ MNSTOUMNO S_ NMUURM\Q( V]QUQ`Z O]Q YMOOQU ^T[QUOSSi OS OUMTPXSUO MT[[QYRbQU O]Q _SUWQUhP XUS[^NOP OS ROP N^POSWQUP( [QMYQUP SU PMYQPWQTA

    *T ;GG8( IZQO] XUSN^UQ[ 'MURTQ BSYRNZ _USW UQPXST[QTO B]RYRXXRTQP?RUPO *TP^UMTNQ .SA( *TNA =B]RYRXXRTQP ?RUPO> OS PQN^UQ ROP RTOQUQPO SbQU ROPSVT XUS[^NOPA IZQO] QdQN^OQ[ ROP MTT^MY NSTOUMNO S_ NMUURM\Q VRO])QX^OM`YQA 3]Q NSTOUMNO MYPS UQg^RUQ[ )QX^OM`YQ OS PQN^UQ MT RTP^UMTNQXSYRNZ ST IZQO]hP \SS[PA 3]^P( RT ;GGC( )QX^OM`YQ PR\TQ[ M &XQNRMY )RPi*TP^UMTNQ BSYRNZ =&) BSYRNZ> VRO] XQORORSTQU 'MYMZMTA

    /^URT\ O]Q Q__QNORbROZ S_ O]Q 'MURTQ BSYRNZ MT[ &) BSYRNZ( )QX^OM`YQUQNQRbQ[ _USW IZQO] ;(::: `SdQP S_ BUSWRY RT_MTO _SUW^YM VSUO]B9(8

  • 8/12/2019 EVID DigestsCompilation SET01

    27/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 9D

    W^N] WSUQ M [Q_RTRORbQ XUSTS^TNQWQTO( MP OS O]Q TMO^UQ S_ )QX^OM`YQhP`^PRTQPP MT[ O]QUQ MXXQMUP TS SO]QU NSTTQNORST `QOVQQT B]RYRXXRTQP?RUPO MT[ )QX^OM`YQ V]RN] P^\\QPOP W^O^MY _MWRYRMUROZ `QOVQQT O]QWA

    'SUQSbQU( UQNSU[P P]SV O]MO O]Q MYYQ\Q[ j^[RNRMY M[WRPPRST S_

    B]RYRXXRTQP ?RUPO VMP QPPQTORMYYZ [RPX^OQ[ `Z )QX^OM`YQ V]QT RO POMOQ[RT XMUM\UMX]P 9( C( MT[ ;; S_ ROP MTPVQU O]MO RO RP MNO^MYYZ M XURbMOQ SUPXQNRMY NMUURQUA *T M[[RORST( )QX^OM`YQ POMOQ[ RT XMUM\UMX] 9 S_ ROP O]RU[JXMUOZ NSWXYMRTO O]MO RO RP rM XURbMOQ NMUURQU QT\M\Q[ RT O]Q NMUURM\Q S_\SS[PAs &^N] MYYQ\MORST VMP( RT O^UT( M[WROOQ[ `Z 'MYMZMT RT XMUM\UMX]9 S_ ROP MTPVQU OS O]Q O]RU[JXMUOZ NSWXYMRTOA 3]QUQ RP MYPS TSO]RT\ RT O]QUQNSU[P V]RN] P]SV O]MO B]RYRXXRTQP ?RUPO XQUPRPOQTOYZ WMRTOMRTQ[ ROPPOMTNQ O]MO )QX^OM`YQ RP M NSWWST NMUURQU SU O]MO RO QbQT NSTOQPOQ[ SUXUSbQ[ SO]QUVRPQ )QX^OM`YQhP XSPRORST O]MO RO RP M XURbMOQ SU PXQNRMYNMUURQUA

    1QTNQ( RT O]Q _MNQ S_ )QX^OM`YQhP NSTOUMUZ M[WRPPRST MP OS O]Q TMO^UQ S_

    ROP SVT `^PRTQPP( V]MO VMP POMOQ[ `Z B]RYRXXRTQP ?RUPO RT ROP NSWXYMRTORP UQ[^NQ[ OS TSO]RT\ WSUQ O]MT WQUQ MYYQ\MORST( V]RN] W^PO `Q XUSbQ[_SU RO OS `Q \RbQT MTZ VQR\]O SU bMY^QA 3]Q PQOOYQ[ U^YQ RP O]MO WQUQMYYQ\MORST RP TSO XUSS_A

    F?G : !9*,4#& " = 1 /%$#+/%,/5/%

    )-B2!5*. bA &%,/*0%,!%"%,

    0A)A ,SA ;D:

  • 8/12/2019 EVID DigestsCompilation SET01

    28/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 9E

    S_ O]Q MNORST OQT[QUP TS \QT^RTQ RPP^Q SU NSTOUSbQUPZ MP OS MTZ WMOQURMY_MNOA &MT[R\MT`MZMT \UMTOQ[ O]RP WSORSTA &^`PQg^QTOYZ( XQORORSTQU _RYQ[ROP SXXSPRORST MT[ &MT[R\MT`MZMT UQbQUPQ[ ROP [QNRPRST( O]^P [QTZRT\)QX^`YRNhP WSORST _SU P^WWMUZ j^[\WQTOA

    *PP^Q# I]QO]QU SU TSO O]Q M[WRPPRSTP WM[Q `Z O]Q UQPXST[QTOP RT O]QRUXYQM[RT\P MT[ RT O]Q M\UQQWQTO NSTPORO^OQ j^[RNRMY M[WRPPRSTP O]MOj^POR_Z P^WWMUZ j^[\WQTOv

    1QY[# "QPA

    )MORS#

    &^WWMUZ j^[\WQTO VMP [QPNUR`Q[ MP M j^[\WQTO V]RN] M NS^UO WMZUQT[QU `Q_SUQ OURMY `^O M_OQU `SO] XMUORQP ]MbQ XYQM[Q[A *O RP PMTNORSTQ[RT O]RP j^URP[RNORST `Z &QNORST ;( )^YQ 8< S_ O]Q ;GGD )^YQP S_ .RbRYBUSNQ[^UQA &^WWMUZ j^[\WQTO RP XUSXQU V]QT O]QUQ RP NYQMUYZ TS\QT^RTQ RPP^Q MP OS MTZ WMOQURMY _MNO RT O]Q MNORSTA 3]Q O]QSUZ S_P^WWMUZ j^[\WQTO RP O]MO( MYO]S^\] MT MTPVQU WMZ ST ROP _MNQ MXXQMUOS OQT[QU RPP^QP UQg^RURT\ OURMY( R_ RO RP [QWSTPOUMOQ[ `Z M__R[MbROP([QXSPRORSTP SU M[WRPPRSTP O]MO O]SPQ RPP^QP MUQ TSO \QT^RTQ `^O P]MWSU _RNORORS^P( O]Q .S^UO RP j^POR_RQ[ RT [RPXQTPRT\ VRO] O]Q OURMY MT[UQT[QURT\ P^WWMUZ j^[\WQTO _SU XQORORSTQU )QX^`YRNA

    *T O]Q RTPOMTO NMPQ( O]Q WMOQURMY MYYQ\MORSTP RT O]Q XQORORST VQUQ TSOPXQNR_RNMYYZ [QTRQ[ `Z UQPXST[QTOP RT O]QRU MTPVQUA 3]Q [QTRMYNSTOMRTQ[ RT XMUM\UMX] 99 S_ O]Q MTPVQU VMP _SN^PQ[ ST O]Q MbQUWQTORT O]Q XQORORST _SU _SU_QRO^UQ O]MO r)QPXST[QTOP NYMT[QPORTQYZ POMP]Q[O]Q NS^TOUZhP VQMYO] RT &VROfQUYMT[ MT[ ]R[ O]Q PMWQ ^T[QU YMZQUP MT[YMZQUP S_ _S^T[MORSTP MT[ NSUXSUMOQ QTORORQPAs )QPXST[QTOPh MTPVQU VMP

    O]^P M [QTRMY XUQ\TMTO VRO] M[WRPPRSTP S_ O]Q _SYYSVRT\ P^`POMTORM_MNOP#

    =;> O]Q &VRPP `MTi [QXSPROP QdRPOQ[ MT[

    =9> O]MO O]Q QPORWMOQ[ P^W O]QUQS_ VMP 2&p8

  • 8/12/2019 EVID DigestsCompilation SET01

    29/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 9G

    MWS^TO S_ O]MO WSTQZ SU XUSXQUOZ QdNQQ[P( RA QA( RP \USPPYZ[RPXUSXSUORSTMOQ OS( O]QRU YQ\RORWMOQ RTNSWQA

    3]MO PXS^PQP ?QU[RTMT[ MT[ *WQY[M 'MUNSP VQUQ X^`YRN S__RNRMYP [^URT\O]Q ORWQ WMOQURMY OS O]Q RTPOMTO NMPQ VMP TQbQU RT [RPX^OQA )QPXST[QTO'UPA 'MUNSP MYPS M[WROOQ[ O]Q MYYQ\MORSTP S_ O]Q XQORORST _SU _SU_QRO^UQV]RN] UQ_QUUQ[ OS O]Q MNN^W^YMOQ[ PMYMURQP S_ UQPXST[QTOP ?QU[RTMT[ -A'MUNSP MT[ *WQY[M )A 'MUNSPA 3]Q NSW`RTQ[ MNN^W^YMOQ[ PMYMURQP S_O]Q 'MUNSP NS^XYQ VQUQ UQ_YQNOQ[ RT O]Q .QUOR_RNMORST RPP^Q[ `Z O]QT'RTRPOQU S_ !^[\QO MT[ 'MTM\QWQTOA

    BUQPNRT[RT\ _USW O]Q M_SUQPMR[ M[WRPPRSTP( &QNORST C( )^YQ ;9G S_ O]Q)^YQP S_ .S^UO XUSbR[QP O]MO# %T M[WRPPRST( bQU`MY SU VUROOQT( WM[Q `ZM XMUOZ RT O]Q NS^UPQ S_ O]Q XUSNQQ[RT\P RT O]Q PMWQ NMPQ [SQP TSOUQg^RUQ XUSS_A 3]Q M[WRPPRST WMZ `Q NSTOUM[RNOQ[ STYZ `Z P]SVRT\O]MO RO VMP WM[Q O]US^\] XMYXM`YQ WRPOMiQ SU O]MO TS P^N] M[WRPPRSTVMP WM[QA

    *O RP PQOOYQ[ O]MO j^[RNRMY M[WRPPRSTP WMZ `Q WM[Q# =M> RT O]Q XYQM[RT\P_RYQ[ `Z O]Q XMUORQPk =`> RT O]Q NS^UPQ S_ O]Q OURMY QRO]QU `Z bQU`MY SUVUROOQT WMTR_QPOMORSTP SU PORX^YMORSTPk SU =N> RT SO]QU POM\QP S_ j^[RNRMYXUSNQQ[RT\P( MP RT O]Q XUQJOURMY S_ O]Q NMPQA 3]^P( _MNOP XYQM[Q[ RT O]Q

    XQORORST MT[ MTPVQU( MP RT O]Q NMPQ MO `MU( MUQ [QQWQ[ M[WRPPRSTP S_XQORORSTQU MT[ UQPXST[QTOP( V]S MUQ TSO XQUWROOQ[ OS NSTOUM[RNO O]QWSU P^`PQg^QTOYZ OMiQ M XSPRORST NSTOUMUZ OS SU RTNSTPRPOQTO VRO] P^N]M[WRPPRSTPA

    3]Q PORX^YMORSTP PQO _SUO] RT O]Q %\UQQWQTOP ^T[QTRM`YZ RT[RNMOQ[ O]QWMTR_QPO RTOQTO S_ UQPXST[QTOP OS QTOQU RTOS M NSWXUSWRPQ VRO]XQORORSTQUA )QPXST[QTOPh VRYYRT\TQPP OS M\UQQ OS MT MWRNM`YQ PQOOYQWQTO

    VRO] O]Q )QX^`YRN STYZ M__RUWQ[ O]QRU SVTQUP]RX S_ O]Q &VRPP [QXSPRO_SU O]Q PRWXYQ UQMPST O]MO TS XQUPST VS^Y[ MNg^RQPNQ OS MTZ NSTNQPPRSbQU P^N] ]^\Q [SYYMU [QXSPROP R_ ]Q [R[ TSO RT _MNO SVT O]QWA

    )QPXST[QTOP WMiQ W^N] NMXROMY S_ O]Q XUSTS^TNQWQTO O]MO O]Q%\UQQWQTOP VQUQ T^YY MT[ bSR[( MT[ RTPRPO O]MO TSO]RT\ RT O]SPQM\UQQWQTOP NS^Y[ O]^P `Q M[WROOQ[ RT QbR[QTNQ M\MRTPO O]QW `QNM^PQO]QZ POSS[ ST O]Q PMWQ \US^T[ MP MT MNNQXOQ[ S__QU ^T[QU &QNORST 9D()^YQ ;8:aG:c S_ O]Q ;GGD )^YQP S_ .RbRY BUSNQ[^UQ( XUSbR[RT\ O]MO rRTNRbRY NMPQP( MT S__QU S_ NSWXUSWRPQ RP TSO MT M[WRPPRST S_ MTZ YRMMT[ RP TSO M[WRPPR`YQ RT QbR[QTNQ M\MRTPO O]Q S__QUSUAs

    3]Q [QNYMUMORST S_ T^YYROZ S_ PMR[ M\UQQWQTOP VMP XUQWRPQ[ ST NQUNSTPORO^ORSTMY MT[ POMO^OSUZ RT_RUWRORQPA 3]Q UQMPSTP UQYRQ[ ^O]Q .S^UO TQbQU RT O]Q YQMPO `RO QbQT OS^N]Q[ ST O]Q bQUMNROZ MT[OU^O]_^YTQPP S_ UQPXST[QTOPh M[WRPPRST VRO] UQPXQNO OS O]QRU SVTQUPS_ O]Q &VRPP _^T[PA !QPR[QP( ]MbRT\ WM[Q NQUOMRT M[WRPPRSTP RT O]SPQM\UQQWQTOP( UQPXST[QTOP NMTTSO TSV [QTZ O]MO O]QZ bSY^TOMURYZM[WROOQ[ SVTRT\ O]Q P^`jQNO &VRPP _^T[P( TSOVRO]POMT[RT\ O]Q _MNO O]MOO]Q M\UQQWQTOP O]QWPQYbQP VQUQ YMOQU [QNYMUQ[ T^YY MT[ bSR[A 3OQPORWSTZ S_ UQPXST[QTO ?QU[RTMT[ 'MUNSP( 6UA [^URT\ O]Q ]QMURT\ STO]Q WSORST _SU O]Q MXXUSbMY S_ O]Q .SWXUSWRPQ %\UQQWQTO MYPS YQNUQ[QTNQ OS O]Q MYYQ\MORSTP S_ XQORORSTQU )QX^`YRN O]MO UQPXST[M[WROOQ[ SVTQUP]RX S_ O]Q &VRPP `MTi MNNS^TOPA %[WRPPRSTP S_ M XMUORT ]RP OQPORWSTZ MUQ UQNQRbM`YQ M\MRTPO ]RWA *_ M XMUOZ( MP M V[QYR`QUMOQYZ NSTNQ[QP M _MNO( P^N] NSTNQPPRST ]MP O]Q _SUNQ S_ M j^[RNM[WRPPRSTA *O RP MXXMUQTO _USW ?QU[RTMT[ 6UAhP OQPORWSTZ O]MO'MUNSP _MWRYZ M\UQQ[ OS TQ\SORMOQ VRO] O]Q B]RYRXXRTQ \SbQUTWQTO O]Q ]SXQ S_ _RTMYYZ X^OORT\ MT QT[ OS O]Q XUS`YQWP `QPQOORT\ O]Q 'MUNSP_MWRYZ UQ\MU[RT\ O]Q &VRPP MNNS^TOPA 3]RP VMP [S^`OYQPPYZ MTMNiTSVYQ[\WQTO S_ SVTQUP]RX ST O]QRU XMUOA 3]Q U^YQ RP O]MO O]QOQPORWSTZ ST O]Q VROTQPP POMT[ XMUOMiQP S_ O]Q TMO^UQ S_ M _SUWj^[RNRMY M[WRPPRST V]QT M XMUOZ OQPOR_RQP NYQMUYZ MT[ ^TQg^RbSNMY_MNO V]RN] RP XQN^YRMUYZ VRO]RT ]RP SVT iTSVYQ[\QA

  • 8/12/2019 EVID DigestsCompilation SET01

    30/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 8:

    FAG 2 !&1-% " = &-3!4!&

    3-.&+, @A .+'-5-.

    0A)A ,SPA ;H;C8C( ;H;H8C( MT[ ;H;E9CA 'MUN] 8( 9::CA

    'MURM 6QMTQOOQ .A 3QNPST MT[ ?QYRd !A /QPR[QURS( 6UA( XQORORSTQU bA O]Q.+'-5-.( )STMY[ %YYMT FQYYZ BSQ =MAiAMA ?QUTMT[S BSQ( 6UA> MT[@RNOSURTS uA ?SUTRQU( UQPXST[QTOPA

    4SRYS %TOSTRS @QYQf( XQORORSTQU( bA )STMY[ %YYMT FQYYZ BSQ( UQPXST[QTOA

    @RNOSURTS uA ?SUTRQU( XQORORSTQU( bA 1STA .+'-5-. MT[ )STMY[ %YYMTFQYYZ BSQ( UQPXST[QTOPA

    ?MNOP#

    ?B6 _RYQ[ ]RP NQUOR_RNMOQ S_ NMT[R[MNZ _SU O]Q XSPRORST S_ BUQPR[QTO S_ O]Q)QX^`YRN S_ O]Q B]RYRXXRTQPA *T ]RP NQUOR_RNMOQ S_ NMT[R[MNZ( ?B6(UQXUQPQTORT\ ]RWPQY_ OS `Q M TMO^UMYJ`SUT NRORfQT S_ O]Q B]RYRXXRTQP(POMOQ[ ]RP TMWQ OS `Q l?QUTMT[S 6UA(l SU l)STMY[ %YYMTl BSQ( ]RP [MOQ S_`RUO] OS `Q 9: %^\^PO ;G8G MT[ ]RP XYMNQ S_ `RUO] OS `Q 'MTRYMA

    @RNOSURTS uA ?SUTRQU RTRORMOQ[ M XQORORST `Q_SUQ O]Q .+'-5-. OS[RPg^MYR_Z ?B6 MT[ OS [QTZ [^Q NS^UPQ SU OS NMTNQY ]RP NQUOR_RNMOQ S_

    NMT[R[MNZ ^XST O]Q O]QPRP O]MO ?B6 WM[Q M WMOQURMY WRPUQXUQPQTORT ]RP NQUOR_RNMOQ S_ NMT[R[MNZ `Z NYMRWRT\ OS `Q M TMO^UMYJ`SUT ?RYNRORfQT V]QT RT OU^O]( MNNSU[RT\ OS ?SUTRQU( ]RP XMUQTOP VQUQ _SUQR\TQ]RP WSO]QU( !QPPRQ FQYYQZ BSQ( VMP MT %WQURNMT( MT[ ]RP _MO]QU( %YBSQ( VMP M &XMTRP] TMORSTMY( `QRT\ O]Q PST S_ 5SUQTfS BS^( M &XMTRP]P^`jQNOA 0UMTORT\( XQORORSTQU MPPQbQUMOQ[( O]MO %YYMT ?A BSQ V?RYRXRTS NRORfQT( ]Q NS^Y[ TSO ]MbQ OUMTPWROOQ[ ]RP ?RYRXRTS NRORfQTP?B6( O]Q YMOOQU `QRT\ MT RYYQ\RORWMOQ N]RY[ S_ MT MYRQT WSO]QUA BQ`MPQ[ O]Q MYYQ\MORST S_ O]Q RYYQ\RORWMOQ `RUO] S_ UQPXST[QTO ST OMPPQUORSTP J _RUPO( %YYMT ?A BSQ NSTOUMNOQ[ M XURSU WMUURM\Q OS BM^YROM 0SWQf `Q_SUQ ]RP WMUURM\Q OS !QPPRQ FQYYQZ MT[( PQNST[( QbQTTS P^N] XURSU WMUURM\Q ]M[ QdRPOQ[( %YYMT ?A BSQ( WMUURQ[ !QPPRQ FQSTYZ M ZQMU M_OQU O]Q `RUO] S_ UQPXST[QTOA

    ?B6 XUQPQTOQ[ OVQTOZJOVS [SN^WQTOMUZ XRQNQP S_ QbR[QTNQ( O]Q WSUQ

    PR\TR_RNMTO STQP `QRT\ O]Q WMUURM\Q NQUOR_RNMOQ S_ %YYMT ?A BSQ MTFQYYQZ( O]Q `RUO] NQUOR_RNMOQ S_ ?B6( O]Q [QMO] NQUOR_RNMOQ S_ 5SUQTMT[ [M ^YZ TSOMURfQ[ [QNYMUMORST WM[Q `Z )^`Z FQYYQZ 'MT\M]MP( PRPOQUS_ !QPPRQ FQYYQZ BSQA

    *PP^Q# I]QO]QU SU TSO O]Q [SN^WQTOP XUQPQTOQ[ VS^Y[ XUSbQ O]QUQYMORSTP]RX `QOVQQT ?B6( ]RP X^UXSUOQ[ _MO]QU MT[ \UMT[_MO]QUv

    1QY[# "QP

    )MORS#

    I]RYQ OVS S_ O]QPQ [SN^WQTOP VQUQ P^`WROOQ[ RT QbR[QTNQ _SUUQPXST[QTO( O]Q M[WRPPR`RYROZ O]QUQS_( XMUORN^YMUYZ RT UQ_QUQTNQ_MNOP V]RN] O]QZ X^UXSUOQ[ OS P]SV( RAQA( O]Q WMUURM\Q NQUOR_RNM

  • 8/12/2019 EVID DigestsCompilation SET01

    31/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    !"# %

    &%'%( !

    )*+,-&( .

    %)%,/%,0( .

    12%( .

    +,3)-)%&( .

    )24( /

    2'%( -

    &3*55-&( 0

    +,4%0%( 5

    %4%)+( 5

    *'( &

    -,%6+,( 3

    -,0.+( 2

    )!*,%7 8/

    9:; /,% %TMYZP5M`SUMOSUZ ]MP TSV O]Q NMXM`RYROZ OS NST[^NO /,% OZXRT\ ^PRT\ P]SUOOMT[QW UQXQMO =&3)> MTMYZPRPA 3]Q MTMYZPRP RP `MPQ[ ST O]Q _MNO O]M/,% S_ M N]RY[nXQUPST ]MP OVS =9> NSXRQP( STQ NSXZ _USW O]Q WSO]QUMT[ O]Q SO]QU _USW O]Q _MO]QUA 3]Q /,% _USW O]Q WSO]QU( O]Q MYYQ\Q[_MO]QU MT[ N]RY[ MUQ MTMYZfQ[ OS QPOM`YRP] XMUQTOM\QA +_ NS^UPQ( `QRTSbQY PNRQTOR_RN OQN]TRg^Q( O]Q ^PQ S_ /,% OQPO MP QbR[QTNQ RP PORYY SOS N]MYYQT\QA -bQTO^MYYZ( MP O]Q MXXUSXURMOQ NMPQ NSWQP( NS^UOP TSO ]QPROMOQ OS U^YQ ST O]Q M[WRPPR`RYROZ S_ /,% QbR[QTNQA ?SU RO VPMR[( O]MO NS^UOP P]S^Y[ MXXYZ O]Q UQP^YOP S_ PNRQTNQ V]QT NSWXQOQTS`OMRTQ[ RT MR[ S_ PRO^MORSTP XUQPQTOQ[( PRTNQ OS UQjQNO PMR[ UQP^YO[QTZ XUS\UQPPA 3]S^\] RO RP TSO TQNQPPMUZ RT O]RP NMPQ OS UQPSUO OS /,%OQPORT\( RT _^O^UQ RO VS^Y[ `Q ^PQ_^Y OS MYY NSTNQUTQ[ RT O]Q XUSWXUQPSY^ORST S_ XMUQTOM\Q MT[ R[QTOROZ RPP^QPA

    F

  • 8/12/2019 EVID DigestsCompilation SET01

    35/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 8 VMP MUUQPOQ[ RT ;GGD TSO `QNM^PQ S_ ]RPRTbSYbQWQTO RT O]RP NMPQ `^O `QNM^PQ ]Q ]M[ RT ]RP XSPPQPPRST M XMNi S_P]M`^ MT[ _RUQMUWPk MT[ =8> /MbR[ )^PRM RP TSO M NUQ[R`YQ VROTQPPA

    3]Q &SYRNROSU 0QTQUMY _RYQ[ M NSTPSYR[MOQ[ NSWWQTO XUMZRT\ O]MOWSORSTP _SU UQNSTPR[QUMORST `Q [QTRQ[ VRO] _RTMYROZ( O]QUQ `QRT\ TS TQMU\^WQTO UMRPQ[A

    %XXQYYMTOP bR\SUS^PYZ NSTOQT[ O]MO O]Q NS^UO P]S^Y[ TSO ]MbQ P^POMRTQ)^PRMhP OQPORWSTZ ]SSi( YRTQ MT[ PRTiQU( SVRT\ OS ]RP OMRTOQ[ UQNSU[ MT[UQX^OMORSTA

    *PP^Q# I]QO]QU SU TSO O]QUQ VMP QTS^\] QbR[QTNQ OS VMUUMTO O]QNSTbRNORST S_ O]Q MNN^PQ[JMXXQYYMTOPA

    1QY[# "QP

    )MORS#)^PRMhP OQPORWSTZ VMP TSO bRQVQ[ RT RPSYMORSTA *T \RbRT\ NUQ[QTNQ P^N] OQPORWSTZ( O]Q OURMY NS^UO OSSi RTOS NSTPR[QUMORST O]Q X]ZPRQbR[QTNQ MT[ O]Q NSUUS`SUMORbQ OQPORWSTRQP S_ SO]QU VROTQPPQPA I]MWM[Q )^PRMhP OQPORWSTZ VSUO]Z S_ `QYRQ_ RP ROP POURiRT\ NSWXMOR`RVRO] O]Q X]ZPRNMY QbR[QTNQA B]ZPRNMY QbR[QTNQ RP STQ S_ O]Q ]R\]QP[Q\UQQP S_ XUSS_A *O PXQMiP WSUQ QYSg^QTOYZ O]MT MYY VROTQPPQP XOS\QO]QUA 3]Q XUQPQTNQ S_ 'MURjSZhP UMbRP]Q[ `S[Z RT M [QQX UMbRTQ MO3MTJMVMT( .MUNMU VRO] OMXQ ST ]QU WS^O] MT[ ]MT[N^__P ST ]QU VURPOPNQUOMRTYZ `SYPOQUQ[ )^PRMhP OQPORWSTZ ST V]MO MNO^MYYZ OSSi XYMN%ZMYM .QTOQU OS 3MTJMVMTA *T[QQ[( O]Q [QOMRYP ]Q P^XXYRQ[ OS O]Q OUNS^UO MUQ S_ P^N] TMO^UQ MT[ g^MYROZ O]MO STYZ M VROTQPP V]S MNO^MPMV O]Q NSWWRPPRST S_ O]Q NURWQP NS^Y[ _^UTRP]A %YY O]Q MT[ XRQNQPPOSUZ _SUW XMUO S_ )^PRMhP TMUUMORSTA ,SV( VRO] P^N] POUST\ MTN]SUM\ST O]Q X]ZPRNMY QbR[QTNQ MT[ O]Q OQPORWSTRQP S_ [RPRTOQUQPOQ[ VROTQP

    V]Z P]S^Y[ VQ TSO MNNSU[ NUQ[QTNQ OS )^PRMhP OQPORWSTZv -bQTMPP^WRT\ O]MO ]RP OQPORWSTZ POMT[RT\ MYSTQ WR\]O RT[QQ[ `Q ^TVSUO]ZS_ `QYRQ_ RT bRQV S_ ]RP N]MUMNOQU( RO RP TSO PS V]QT NSTPR[QUQ[ VRO] OSO]QU QbR[QTNQ XUQPQTOQ[ `Z O]Q XUSPQN^ORSTA

    %XXQYYMTOP YRiQVRPQ NYMRWQ[ O]MO O]Q NS^UO P]S^Y[ ]MbQ TSO P^POMRO]Q OURMY NS^UOhP UQjQNORST S_ O]QRU MYR`RA &QOOYQ[ RP O]Q U^YQ[Q_QTPQ S_ MYR`R RP RT]QUQTOYZ VQMi MT[ NU^W`YQP RT O]Q YR\]O S_ XSPRO[QNYMUMORSTP S_ OU^O]_^Y VROTQPPQP V]S OQPOR_RQ[ ST M__RUWMORbQ W!QRT\ QbR[QTNQ O]MO RP TQ\MORbQ RT TMO^UQ MT[ PQY_JPQUbRT\( RO NMTT

  • 8/12/2019 EVID DigestsCompilation SET01

    37/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 8D

    MOOMRT WSUQ NUQ[R`RYROZ O]MT O]Q OQPORWSTRQP S_ XUSPQN^ORST VROTQPPQPV]S OQPOR_Z ST NYQMU MT[ XSPRORbQ QbR[QTNQ

    +T O]Q RPP^Q UMRPQ[ `Z MXXQYYMTOP 2Z `USO]QUP O]MO 6MWQP %T[UQV VMPSTYZ PQbQTOQQT =;D> ZQMUP MT[ OVS ]^T[UQ[ PRdOZ OVS =9H9> [MZP SY[ MOO]Q ORWQ O]Q NURWQP VQUQ NSWWROOQ[( O]Q UQNSU[P `QMU O]MO 6MWQP%T[UQVhP `RUO] NQUOR_RNMOQ VMP P^`WROOQ[ OS O]Q OURMY NS^UO MP XMUO S_ O]Q?SUWMY +__QU S_ %[[RORSTMY -bR[QTNQ( VRO] O]Q POMOQWQTO O]MO ]Q VMPQR\]OQQT =;E> ZQMUP SY[A +T 'MUN] ;E( ;GGG( MXXQYYMTOP _RYQ[ M'MTR_QPOMORST S_ -UUMO^W NSUUQNORT\ RT XMUO O]Q ?SUWMY +__QU S_%[[RORSTMY -bR[QTNQ `Z MYYQ\RT\ O]MO 6MWQP %T[UQV VMP STYZ PQbQTOQQT=;D> ZQMUP SY[A

    3]Q QTOUZ S_ 6MWQP %T[UQVhP `RUO] RT O]Q !RUO] .QUOR_RNMOQ RP TSO YQ\R`YQ(O]^P RO RP QdOUQWQYZ [R__RN^YO OS [QOQUWRTQ O]Q bQUMNROZ S_ ]RP NYMRWA1SVQbQU( NSTPR[QURT\ O]MO WRTSUROZ RP M PR\TR_RNMTO _MNOSU RT O]QRWXSPRORST S_ XQTMYOZ( O]Q .S^UO UQg^RUQ[ O]Q &SYRNROSU 0QTQUMY =M> OSPQN^UQ _USW O]Q 5SNMY .RbRY )Q\RPOUMU S_ .SOS`MOS .ROZ( MP VQYY MP O]Q,MORSTMY &OMORPORNP +__RNQ( M NYQMU MT[ YQ\R`YQ NSXZ S_ 6MWQP %T[UQVhP!RUO] .QUOR_RNMOQ( MT[ O]QUQM_OQU( =`> OS _RYQ MT QdOQTPRbQ NSWWQTO ST O]QWSORST _SU UQNSTPR[QUMORST _RYQ[ `Z 6MWQP %T[UQV MT[ 6MWQP %TO]STZ2Z( PSYQYZ ST 6MWQP %T[UQVPh NYMRW S_ WRTSUROZA

    *T UQPSYbRT\ O]Q RTPOMTO WSORSTP( O]Q .S^UO QW`MUiQ[ ST O]RPXMRTPOMiRT\ OMPi S_ QbMY^MORT\ QbQUZ XRQNQ MT[ PXQNRQ S_ QbR[QTNQXUQPQTOQ[ `Q_SUQ O]Q OURMY NS^UO RT UQPXSTPQ OS MXXQYYMTOPh XYQM _SU O]QUQbQUPMY S_ O]QRU NSTbRNORSTA !^O( QbQT O]Q QYQWQTO S_ UQMPSTM`YQ [S^`OPS PQURS^PYZ PS^\]O `Z MXXQYYMTOP RP MT R\TRP _MO^^P V]RN] ]MP QY^[Q[MTZ RTOQYYR\QTO UMORSNRTMORST S_ O]QRU P^`WRPPRSTPA

    F>G &:*I U/ :!"/4- " = B*!:*,#% U4 /5-1/

    .U^fJ%UQbMYS bP K^QU^`RTJ5MZSPM

    ?%.3 3]RP RP MT M[WRTRPOUMORbQ NSWXYMRTO _RYQ[ `Z 6SPQ_RTM .U^fJ%UQbMYS N]MU\RT\ 6^[\Q 5Z[RM K^QU^`RTJ5MZSPM VRO] WMTR_QPO `RMP MT[XMUORMYROZ MT[ R\TSUMTNQ S_ O]Q YMVA

    .U^fJ%UQbMYS TMUUMOQP O]MO .STUM[S .U^f QdQN^OQ[ MT M^O]SURfMORSTYQOOQU MT[ M PXQNRMY XSVQU S_ MOOSUTQZ =&B%> RT ]QU _MbSU OS UQX]RW RT M .RbRY .MPQ V]RYQ ]Q ^T[QU\SQP WQ[RNMY OUQMOWQTO RT O]Q 2&%%YYQ\Q[YZ( TSOVRO]POMT[RT\ O]Q XUQPQTOMORST S_ O]Q M^O]SURfMORST YQMT[ &B% [^URT\ O]Q XUQJOURMY( UQPXST[QTO j^[\Q [QNYMUQ[ .U^f TSTJP^ROQ[ [^Q OS ]RP M`PQTNQA

    .SWXYMRTMTO MYPS MPPMRYP O]Q SU[QU S_ UQPXST[QTO j^[\Q OS QdNY^[QPQbQUMY XMUM\UMX]P RT O]Q %__R[MbRO V]RN] VMP M[SXOQ[ MP O]Q [RUQOQPORWSTZ S_ ]QU VROTQPP VRO]S^O \RbRT\ ]QU NS^TPQY M N]MTNQ OSNSWWQTO ST O]Q S`jQNORSTP UMRPQ[ `Z O]Q [Q_QT[MTOPA 'SUQSbQU( P]QUQ_^PQ[ OS RPP^Q M VUROOQT SU[QU QdNY^[RT\ NQUOMRT XMUM\UMX]P O][QXURbRT\ NSWXYMRTMTO O]Q SXXSUO^TROZ OS _RYQ NQUORSUMUR XUSNQQ[R

    *&&2-# I+, NSWXYMRTMTOhP MNN^PMORSTP P]S^Y[ `Q [RPWRPPQ[ _SU YMNi S_WQUROA

    1-5/# "-&A 3]Q &. M\UQQP VRO] O]Q _RT[RT\P MT[ UQNSWWQT[MORSTP S_O]Q +__RNQ S_ O]Q .S^UO %[WRTRPOUMOSU =+.%> O]MO NSWXYMRTO P]S^Y[ `Q[RPWRPPQ[ NMPQ _SU YMNi S_ WQUROA

    .U^fh M^O]SURfMORST YQOOQU MT[ &B% VQUQ TSO UQPXQNORbQYZ M^O]QTORMT[ PXQNR_RN MP OS ROP X^UXSPQA IRO]S^O MTZ M^O]SURfQ[ UQXUQPQTOMOO]Q _MRY^UQ S_ .U^f OS MXXQMU MO O]Q XUQJOURMY WM[Q ]RW TSTJP^RO)QPXST[QTO j^[\Q O]^P NSUUQNOYZ [RPWRPPQ[ O]Q NSWXYMRTO RT PS _MU MP ]QRP NSTNQUTQ[A

    %P UQ\MU[P O]Q QdNY^PRST S_ NQUOMRT XMUM\UMX]P RT O]Q M__R[MbRO

    NSWXYMRTMTOhP VROTQPP( O]Q U^YQ RP O]MO QbR[QTNQ _SUWMYYZ S__QUQXMUOZ WMZ `Q M[WROOQ[ SU QdNY^[Q[ `Z O]Q NS^UOA *_ M XMUOZhP S__QU[SN^WQTOMUZ SU S`jQNO QbR[QTNQ RP QdNY^[Q[( ]Q WMZ WSbQ SU UQg^QPOO]MO RO `Q MOOMN]Q[ OS _SUW XMUO S_ O]Q UQNSU[ S_ O]Q NMPQA *_ O]Q QdNQbR[QTNQ RP SUMY( ]Q WMZ POMOQ _SU O]Q UQNSU[ O]Q TMWQ MT[ SO]QXQUPSTMY NRUN^WPOMTNQP S_ O]Q VROTQPP MT[ O]Q P^`POMTNQ S_ OXUSXSPQ[ OQPORWSTZA 3]QPQ XUSNQ[^UQP MUQ iTSVT MP S__QU S_ XUSS_ SUOQT[QU S_ QdNY^[Q[ QbR[QTNQ MT[ MUQ WM[Q _SU X^UXSPQP S_ MXXQMYA *_ MM[bQUPQ j^[\WQTO RP QbQTO^MYYZ UQT[QUQ[ M\MRTPO O]Q S__QUSU( ]Q WMZ R]RP MXXQMY MPPR\T MP QUUSU O]Q UQjQNORST S_ O]Q QdNY^[Q[ QbR[QTNQA

  • 8/12/2019 EVID DigestsCompilation SET01

    38/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 8E

    MXXQYYMOQ NS^UO VRYY `QOOQU ^T[QUPOMT[ MT[ MXXUQNRMOQ O]Q MPPR\TWQTO S_QUUSU R_ O]Q QbR[QTNQ RTbSYbQ[ RP RTNY^[Q[ RT O]Q UQNSU[ S_ O]Q NMPQA

    3]QUQ RP MYPS TSO]RT\ RUUQ\^YMU V]QT UQPXST[QTO aj^[\Qc [R[ TSO RPP^QMT SU[QU OS UQ_YQNO O]Q S`jQNORSTP S_ O]Q [Q_QTPQ NS^TPQY OS QMN] S_ O]QMYYQ\MORSTP RT O]Q PVSUT M__R[MbRO V]RN] VMP M[SXOQ[ MP O]Q [RUQNOOQPORWSTZ S_ NSWXYMRTMTOhP NS^TPQY MP O]Q NS^UOhP U^YRT\P O]QUQOS VQUQWM[Q [^URT\ O]Q OURMYA %P XSRTOQ[ S^O `Z UQPXST[QTO aj^[\Qc( O]QPQWMOOQUP MUQ MYUQM[Z UQ_YQNOQ[ RT O]Q OUMTPNURXO S_ POQTS\UMX]RN TSOQPMT[ MUQ TSO P^`jQNO OS VUROOQT SU[QUA +U[QUP UQPSYbRT\ WSORSTP _SUNSTORT^MTNQ WM[Q RT O]Q XUQPQTNQ S_ O]Q M[bQUPQ XMUOZ( SU O]SPQ WM[QRT O]Q NS^UPQ S_ M ]QMURT\ SU OURMY( WMZ XUSXQUYZ `Q WM[Q SUMYYZA

    ?RTMYYZ( NSWXYMRTMTO _MRYQ[ OS XUQPQTO QbR[QTNQ OS P]SV O]Q MYYQ\Q[ `RMPS_ UQPXST[QTO j^[\Qk WQUQ P^PXRNRST O]MO M j^[\Q VMP XMUORMY RP TSOQTS^\]A !MUQ MYYQ\MORSTP S_ XMUORMYROZ VRYY TSO P^__RNQ RT MT M`PQTNQ S_ MNYQMU P]SVRT\ O]MO VRYY SbQUNSWQ O]Q XUQP^WXORST O]MO O]Q j^[\Q

    [RPXQTPQ[ j^PORNQ VRO]S^O _QMU SU _MbSUA

    F?G ! 12/2! -. 5 *)*#&- " = : !9*,4#& -. 28! 9 8#4#99#%!1 b &/

    -&3%3- +? 31- 5%3- 6-&2& &A "262*.+ bPA )-B2!5*.

    ?%.3

    ;A*T ;GD8( ?QUWRTM .MPOUS _RYQ[ MT MXXYRNMORST _SU O]Q UQ\RPOUMORST MT[NST_RUWMORST S_ ]QU OROYQ SbQU M XMUNQY S_ YMT[ VRO] MTMUQM S_ ;D(8C8Pg^MUQ WQOQUP NSbQUQ[ `Z XYMT =5).> BP^JGHC YSNMOQ[ RT BMUMwMg^Q.ROZ( RT O]Q BMPR\J)RfMY .S^UO S_ ?RUPO *TPOMTNQ =.?*>A3]Q MXXYRNMORST VMPSXXSPQ[ `Z O]Q +__RNQ S_ O]Q &SYRNROSU 0QTQUMY =+&0> ST `Q]MY_ S_ O]Q/RUQNOSU S_ 5MT[P( MT[ `Z 'QUNQ[QP /RfST( M XURbMOQ XMUOZA 3URMY NS^UOU^YQ[ RT _MbSU S_ .MPOUSA

    9A 3]Q /RUQNOSU S_ 5MT[P MT[ 'QUNQ[QP /RfST [R[ TSO MXXQMY _USW O]QM[bQUPQ [QNRPRST S_ O]Q BMPR\J)RfMY .?*A 3]^P( O]Q SU[QU _SU O]Q RPP^MTNQS_ M [QNUQQ S_ UQ\RPOUMORST `QNMWQ _RTMY( MT[ M /QNUQQ VMP RPP^Q[ `Z O]Q

    5MT[ )Q\RPOUMORST .SWWRPPRST =5).>A%T +UR\RTMY .QUOR_RNMOQ S_ 3ROVMP RPP^Q[ RT O]Q TMWQ S_ ?QUWRTM .MPOUS `Z O]Q )Q\RPOQU S_ /QQ[PA

    8A 5MT[ VMP O]QT PSY[ OS 6QP^P "^j^RNSA 3]Q +.3 S_ .MPOUS VMP NMTNQYYQ[MT[ M 3.3 VMP RPP^Q[ RT "^j^RNShP TMWQ SbQU 5SO ; V]RYQ MTSO]QU 3.3VMP RPP^Q[ RT _MbSU S_ ]QUQRT NSJXQORORSTQU %^\^POS .MUXRSA

    CA 'QMTV]RYQ( B/ TSA ;:E< VMP RPP^Q[ MT[ MPPQUOP O]MO 5MT[ UQNYMRWQ[RT O]Q _SUQP]SUQ MT[ S__P]SUQ MUQMP S_ 'MTRYM !MZ `QNMWQ O]QXUSXQUORQP S_ O]Q B^`YRN -POMOQP %^O]SUROZ =B-%>( M \SbQUTWQTNSUXSUMORST O]MO ^T[QUOSSi O]Q UQNYMWMORST S_ YMT[P SU O]Q MNg^RPRS_ UQNYMRWQ[ YMT[PA 3]^P( MT +.3 VMP RPP^Q[ RT _MbSU S_ B-%A 3]Q B-%MYPS MNg^RUQ[ SVTQUP]RX S_ SO]QU XMUNQYP S_ YMT[ MYST\ O]Q 'MTRYM !MNSMPO V]RN] VQUQ P^`PQg^QTOYZ PSY[ OS O]Q 'MTRYM !MZ /QbQYSXWQTO.SUXSUMORST ='!/.>A

  • 8/12/2019 EVID DigestsCompilation SET01

    39/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 8G

    GA +T MXXQMY( UQbQUPQ[ O]Q [QNRPRST S_ O]Q YSVQU NS^UO MPPQUORT\ O]MOP]SUQP MUQ XUSXQUORQP S_ O]Q X^`YRN [SWMRT RTOQT[Q[ _SU X^`YRN ^PQ MT[(O]QUQ_SUQ( TSO UQ\RPOUM`YQ MT[ O]QRU RTNY^PRST RT M NQUOR_RNMOQ S_ OROYQ [SQPTSO NSTbQUO O]Q PMWQ RTOS XUSXQUORQP S_ XURbMOQ SVTQUP]RX SU NST_QUOROYQ ^XST O]Q UQ\RPOUMTOA ?^UO]QU( MNNSU[RT\ OS O]Q MXXQYYMOQ NS^UO( UQPj^[RNMOM [SQP TSO MXXYZ OS YMT[P S_ X^`YRN [SWMRT( TSU [SQP XSPPQPPRSTS_ O]Q YMT[ M^OSWMORNMYYZ [RbQPO O]Q YMT[ S_ ROP X^`YRN N]MUMNOQUA

    *&&2-#

    I]QO]QU SU TSO .%hP [QNRPRST VMP NSUUQNOA

    1-5/# "-&A BQORORST \UMTOQ[A

    I]RYQ RO WMZ `Q OU^Q O]MO QPOSXXQY [SQP TSO SXQUMOQ M\MRTPO O]Q POMOQ SUROP M\QTOP( ]SVQbQU( -g^ROM`YQ QPOSXXQY WMZ`Q RTbSiQ[ M\MRTPO X^`YRNM^O]SURORQP V]QT MP RT O]RP NMPQ( O]Q YSO VMP MYUQM[Z MYRQTMOQ[ OSRTTSNQTO `^ZQUP _SU bMY^Q MT[ O]Q \SbQUTWQTO [R[ TSO ^T[QUOMiQ MTZMNO OS NSTOQPO O]Q OROYQ _SU MT ^TUQMPSTM`YQ YQT\O] S_ ORWQA

    *T )QX^`YRN bA .S^UO S_ %XXQMYP( V]QUQ O]Q OROYQ S_ MT RTTSNQTO X^UN]MPQU_SU bMY^Q V]S UQYRQ[ ST O]Q NYQMT NQUOR_RNMOQP S_ O]Q OROYQ VMP PS^\]O OS`Q NMTNQYYQ[ MT[ O]Q QdNQPP YMT[ OS `Q UQbQUOQ[ OS O]Q 0SbQUTWQTO( VQU^YQ[ O]MO rRO RP STYZ _MRU MT[ UQMPSTM`YQ OS MXXYZ O]Q Qg^ROM`YQ XURTNRXYQS_ QPOSXXQY `Z YMN]QP M\MRTPO O]Q \SbQUTWQTO OS MbSR[ MT RTj^PORNQ OSRTTSNQTO X^UN]MPQUP _SU bMY^QA

    )QX^`YRN bA .S^UO S_ %XXQMYP RP UQRT_SUNQ[ `Z S^U U^YRT\ RT )QX^`YRN bA2WMYR( V]QUQ( RT M UQbQUPRST NMPQ( VQ ]QY[ O]MO QbQT R_ O]Q SUR\RTMY\UMTOQQ S_ M XMOQTO MT[ OROYQ ]MP S`OMRTQ[ O]Q PMWQ O]US^\] _UM^[(UQbQUPRST VRYY TS YST\QU XUSPXQU MP O]Q YMT[ ]M[ `QNSWQ XURbMOQ YMT[MT[ O]Q _UM^[^YQTO MNg^RPRORST NMTTSO M__QNO O]Q OROYQP S_ RTTSNQTOX^UN]MPQUP _SU bMY^QA

    .STPR[QURT\ O]MO RTTSNQTO X^UN]MPQU _SU bMY^Q "^j^RNS `S^\]O O]Q YSO RT;GDC( MT[ WSUQ O]MT 9D ZQMUP ]M[ QYMXPQ[ `Q_SUQ O]Q MNORST _SUUQbQUPRST VMP _RYQ[( O]QT PMR[ MNORST RP TSV `MUUQ[ `Z YMN]QPA

    I]RYQ O]Q \QTQUMY U^YQ RP O]MO MT MNORST OS UQNSbQU YMT[P S_ X^`Y[SWMRT RP RWXUQPNURXOR`YQ( PMR[ UR\]O NMT `Q `MUUQ[ `Z YMN]QP SQPOSXXQYA &QNORST 89 S_ B/ ;

  • 8/12/2019 EVID DigestsCompilation SET01

    40/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 C:

    *T O]RP XQORORST( O]Q 5)%( RPP^Q[ /QNUQQ ,SA ,J;

  • 8/12/2019 EVID DigestsCompilation SET01

    41/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 C;

    3]Q XUSPQN^ORSThP QbR[QTNQ RP RTNSWXYQOQ OS XUSbR[Q MT M__RUWMORbQMTPVQUA .STPR[QURT\ O]MO RO VMP 0MYYRTQUM V]S UQNSU[Q[ MT[ WMUiQ[ O]QPQRfQ[ ROQWP( ]RP OQPORWSTZ RT NS^UO RP NU^NRMY OS M__RUW V]QO]QU O]QQd]R`ROP VQUQ O]Q PMWQ ROQWP ]MT[Q[ SbQU OS ]RW `Z -POQUTST MO O]QXYMNQ S_ PQRf^UQ MT[ MNiTSVYQ[\Q O]Q RTRORMYP WMUiQ[ O]QUQST MP ]RPSVTA 3]Q PMWQ RP OU^Q S_ 0MUNRM V]S NS^Y[ ]MbQ( `^O TQbQUO]QYQPP_MRYQ[( OS OQPOR_Z ST O]Q NRUN^WPOMTNQP ^T[QU V]RN] P]Q UQNQRbQ[ O]QROQWP _USW -POQUTST( V]MO P]Q [R[ VRO] O]QW [^URT\ O]Q ORWQ O]QZ VQUQRT ]QU XSPPQPPRST ^TORY `Q_SUQ P]Q [QYRbQUQ[ O]Q PMWQ OS %UUSZS _SUMTMYZPRPA

    3]Q XUSPQN^ORST VMP O]^P ^TP^NNQPP_^Y RT [RPN]MU\RT\ ROP `^U[QT S_QPOM`YRP]RT\ O]Q R[QTOROZ S_ O]Q PQRfQ[ ROQWP `QNM^PQ RO _MRYQ[ OS S__QU TSOSTYZ O]Q OQPORWSTZ S_ 0MYYRTQUM MT[ 0MUNRM `^O MYPS MTZ P^__RNRQTOQdXYMTMORST _SU P^N] _MRY^UQA *T Q__QNO( O]QUQ RP TS UQMPSTM`YQ \^MUMTOZMP OS O]Q RTOQ\UROZ S_ O]Q Qd]R`ROP RTMPW^N] MP RO _MRYQ[ OS U^YQ S^O O]QXSPPR`RYROZ S_ P^`PORO^ORST S_ O]Q Qd]R`ROP( V]RN] NMTTSO `^O RT^UQ OS ROP

    SVT [QOURWQTOA 3]RP ]SY[P OU^Q TSO STYZ VRO] UQPXQNO OS O]Q OVS _RYYQ[PMN]QOP `^O MYPS OS O]Q _RbQ PMN]QOP MYYQ\Q[YZ NSTOMRTRT\ WSUPQYP S_P]M`^A

    &QNORST 9; S_ O]Q *WXYQWQTORT\ )^YQP MT[ )Q\^YMORSTP S_ )A%A ,SA G;H 99( SO]QUVRPQ iTSVT MP O]Q l!S^TNRT\ .]QNiP5MVAl %T[ NM^PRT\ RTj^UZ OS .QTRfMYA

    BQORORSTQU NYMRWP O]MO O]Q OURMY MT[ MXXQYYMOQ NS^UOP QUUQ[ RT ]RW [QPXROQ O]Q _MRY^UQ S_ O]Q XUSPQN^ORST OS XUQPQTO O]Q [RP]STSUQN]QNi [^URT\ O]Q OURMYA

    *&&2-# I+, BQORORSTQUhP RTPRPOQTNQ ST O]Q XUQPQTOMORST S_ O]Q N]QNi RQbR[QTNQ MP M NST[RORST PRTQ g^M TST _SU NSTbRNORST ^T[QU !B 99 RPNSUUQNOA

    1-5/# ,+A BQORORSTQUhP RTPRPOQTNQ ST O]Q XUQPQTOMORST S_ O]Q N]QNi RQbR[QTNQ MP M NST[RORST PRTQ g^M TST _SU NSTbRNORST ^T[QU !B 99 RPVUST\A BQORORSTQU MTN]SUP ]RP MU\^WQTO ST )^YQ ;8:( &QNORST 8( S_ O]Q)^YQP S_ .S^UO( SO]QUVRPQ iTSVT MP O]Q `QPO QbR[QTNQ U^YQA 1SVQbQU(O]Q U^YQ MXXYRQP STYZ V]QUQ O]Q NSTOQTO S_ O]Q [SN^WQTO RP O]Q P^`jQNS_ O]Q RTg^RUZA I]QUQ O]Q RPP^Q RP O]Q QdQN^ORST SU QdRPOQTNQ S_ O]Q

    [SN^WQTO SU O]Q NRUN^WPOMTNQP P^UUS^T[RT\ ROP QdQN^ORST( O]Q `QPOQbR[QTNQ U^YQ [SQP TSO MXXYZ MT[ OQPORWSTRMY QbR[QTNQ RP M[WRPPR`YQ

    3]Q \UMbMWQT S_ O]Q S__QTPQ RP O]Q MNO S_ [UMVRT\ MT[ RPP^RT\ MVSUO]YQPP N]QNiA 1QTNQ( O]Q P^`jQNO S_ O]Q RTg^RUZ RP O]Q _MNO S_ RPP^MTSU QdQN^ORST S_ O]Q N]QNi( TSO ROP NSTOQTOA

    1QUQ( O]Q [^Q QdQN^ORST MT[ QdRPOQTNQ S_ O]Q N]QNi VQUQ P^__RNRQTOYQPOM`YRP]Q[A .QTRfMY OQPOR_RQ[ O]MO ]Q XUQPQTOQ[ O]Q SUR\RTMYP S_N]QNi( O]Q UQO^UT PYRX MT[ SO]QU XQUORTQTO [SN^WQTOP `Q_SUQ O]Q +__RN

  • 8/12/2019 EVID DigestsCompilation SET01

    42/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 C9

    S_ O]Q .ROZ BUSPQN^OSU S_ K^QfST .ROZ V]QT ]Q QdQN^OQ[ ]RP NSWXYMRTOJM__R[MbRO [^URT\ O]Q XUQYRWRTMUZ RTbQPOR\MORSTA 3]Q .ROZ BUSPQN^OSU_S^T[ M XURWM _MNRQ NMPQ M\MRTPO XQORORSTQU _SU bRSYMORST S_ !B 99 MT[_RYQ[ O]Q NSUUQPXST[RT\ RT_SUWMORST `MPQ[ ST O]Q [SN^WQTOPA %YO]S^\]O]Q N]QNi MT[ O]Q UQO^UT PYRX VQUQ MWST\ O]Q [SN^WQTOP YSPO `Z.QTRfMY RT M _RUQ O]MO SNN^UUQ[ TQMU ]RP UQPR[QTNQ ST &QXOQW`QU ;H(;GG9( ]Q VMP TQbQUO]QYQPP M`YQ OS M[Qg^MOQYZ QPOM`YRP] O]Q [^QQdQN^ORST( QdRPOQTNQ MT[ YSPP S_ O]Q N]QNi MT[ O]Q UQO^UT PYRX RT MTM__R[MbRO S_ YSPP MP VQYY MP RT ]RP OQPORWSTZ [^URT\ O]Q OURMY S_ O]Q NMPQA

    'SUQSbQU( XQORORSTQU ]RWPQY_ M[WROQ[ O]MO ]Q RPP^Q[ O]Q N]QNiA 1QTQbQU [QTRQ[ O]MO O]Q N]QNi VMP XUQPQTOQ[ _SU XMZWQTO OS O]Q [UMVQQ`MTi MT[ VMP [RP]STSUQ[ _SU ]MbRT\ `QQT [UMVT M\MRTPO RTP^__RNRQTO_^T[PA

    F _RYQ[ M NSWXYMRTOM\MRTPO &XS^PQP BQ`YRM MT[ BUSPXQUS^P %Y_MUS =XQORORSTQUP> PQQiRT\ O]QT^YYR_RNMORST S_ O]Q [QQ[ S_ PMYQ S_ M XMUNQY S_ YMT[ ST O]Q \US^T[ O]MOO]QRU PR\TMO^UQP O]QUQST VQUQ _SU\Q[A

    *T O]QRU MTPVQU( XQORORSTQUP MP [Q_QT[MTOP [QTRQ[ O]Q MYYQ\Q[ _SU\QUZA3]QZ RTPRPOQ[ O]MO UQPXST[QTOP PSY[ O]Q PMR[ YSO RT NSTPR[QUMORST S_ O]QMWS^TO S_ B

  • 8/12/2019 EVID DigestsCompilation SET01

    43/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 C8

    )QbQT^Q RT NSTTQNORST VRO] O]Q XMZWQTO S_ O]Q NMXROMY \MRTP OMdA %YY O]QTSOMURfQ[ NSXRQP MUQ SUR\RTMYPA 3]QZ MUQ PSWQORWQP YSSPQYZ UQ_QUUQ[ OSMP rSUR\RTMY NSXRQPs SU r[^XYRNMOQ SUR\RTMYPAs

    *T O]Q NMPQ MO `MU( XUQPQTOQ[ RT QbR[QTNQ VQUQ OVS NSXRQP S_ STQ MT[ O]QPMWQ /QQ[ S_ %`PSY^OQ &MYQ [MOQ[ ;C 6^TQ ;GG

  • 8/12/2019 EVID DigestsCompilation SET01

    44/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 CC

    j^[\WQTO M\MRTPO .YSO]QPXMiA *O ]MP `QNSWQ _RTMY MT[ QdQN^OSUZ V]RN]YQ[ OS O]Q RWXYQWQTOMORST MT[ QT_SUNQWQTO S_ PMR[ [QNRPRST M\MRTPO.YSO]QPXMihP XUSXQUORQP RTNY^PRbQ S_ O]Q \SS[P QMUYRQU MOOMN]Q[A 1QTNQ(O]Q RTPOMTO NMPQ RP _RYQ[ `Z &'B( *TNA OS UQNSbQU _USW O]Q MOOMN]RT\ `MTiO]Q bMY^Q S_ O]Q \SS[P RO NYMRWP SVTQUP]RX MT[ _SU [MWM\QPA

    *PP^Q#I]QO]QU MO O]Q ORWQ S_ O]Q MOOMN]WQTO( XYMRTOR__ PORYY SVTQ[ O]Q \SS[PYQbRQ[ ^XST( SU SVTQUP]RX O]QUQS_ ]M[ MYUQM[Z XMPPQ[ OS .YSO]QPXMi'MT^_MNO^URT\A

    1QY[# O]Q RTPOMTO XQORORST RP /-,*-/ _SU YMNi S_ WQUROA

    )MORS#

    O]Q RTPOMTO NMPQ( SVTQUP]RX S_ O]Q \QTQUMY X^UXSPQ XSYZPOZUQTQXUS[^NOP VMP UQOMRTQ[ `Z &'B( *TNSUXSUMOQ[ =&'B> ^TORY M_OQU O]QN]QNiP \RbQT MP XMZWQTO `Z .YSO]QPXMi 'MT^_MNO^URT\ B]RYRXXRTQP=.YSO]QPXMi> NYQMUQ[A 3]RP VMP QbR[QTNQ[ `Z M XUSbRPRSTMY UQNQRXORPP^Q[ `Z &'B OS .YSO]QPXMiA 3]Q M\UQQWQTO `QOVQQT &'B MT[.YSO]QPXMi RTbSYbQ[ M NSTOUMNO OS PQYY [Q_RTQ[ ^T[QU %UORNYQ ;CDE S_ O]Q.RbRY .S[QA

    *T SU[QU OS [RPNUQ[RO O]Q NYMRW S_ SVTQUP]RX `Z &'B( XQORORSTQUg^QPORSTP O]Q M[WRPPR`RYROZ S_ O]Q UQNQRXO XUQPQTOQ[ `Z O]Q _SUWQU(V]QUQRT O]Q SVTQUP]RX VMP UQPQUbQ[ _SU O]Q `^ZQU ^TORY M_OQU _^YYXMZWQTO S_ O]Q X^UN]MPQ XURNQA BQORORSTQU NYMRWP O]MO O]Q PMWQ VMPRTM[WRPPR`YQ RT QbR[QTNQ MT[ VMP RT NSTOUMbQTORST S_ O]Q `QPO QbR[QTNQU^YQA IQ `Q\ OS [RPM\UQQA

    3]Q `QPO QbR[QTNQ U^YQ RP O]Q U^YQ V]RN] UQg^RUQP O]Q ]R\]QPO \UM[QS_ QbR[QTNQ S`OMRTM`YQ OS XUSbQ M [RPX^OQ[ _MNOA %YO]S^\] O]QUQ MUQNQUOMRT UQNS\TRfQ[ QdNQXORSTP V]QT O]Q P^`jQNO S_ RTg^RUZ RP O]QNSTOQTOP S_ M [SN^WQTO( TS QbR[QTNQ P]MYY `Q M[WRPPR`YQ SO]QU O]MT O]QSUR\RTMY [SN^WQTO ROPQY_A

    1SVQbQU( RT O]Q RTPOMTO NMPQ( NSTOUMUZ OS XQORORSTQUhP NSTOQTORST(O]Q UQNQRXO XUQPQTOQ[ `Z &'B RP [QQWQ[ MP MT SUR\RTMY( NSTPR[QURT\ O]MOO]Q OURXYRNMOQ NSXZ S_ O]Q XUSbRPRSTMY UQNQRXO VMP QdQN^OQ[ MO O]Q PMWQ

    ORWQ MP O]Q SO]QU NSXRQP S_ O]Q PMWQ UQNQRXO RTbSYbRT\ O]Q PMWOUMTPMNORSTA &QNORST C( )^YQ ;8: S_ O]Q )^YQP S_ .S^UO XUSbR[QP#

    &QNA CA +UR\RTMY S_ [SN^WQTOA q=M> 3]Q SUR\RTMY S_ O]Q [SN^WQTO RP STQ O]Q NSTOQTOP S_ V]RN] MUQ

    O]Q P^`jQNO S_ RTg^RUZA=`> I]QT M [SN^WQTO RP RT OVS SU WSUQ NSXRQP QdQN^OQ[ MO SU

    M`S^O O]Q PMWQ ORWQ( VRO] R[QTORNMY NSTOQTOP( MYY P^N] NSXRQP MUQ QUQ\MU[Q[ MP SUR\RTMYPA

    =N> I]QT MT QTOUZ RP UQXQMOQ[ RT O]Q UQ\^YMU NS^UPQ S_ `^PRTQPP(STQ `QRT\ NSXRQ[ _USW MTSO]QU MO SU TQMU O]Q ORWQ S_ O]Q OUMTPMNORSTO]Q QTOURQP MUQ YRiQVRPQ Qg^MYYZ UQ\MU[Q[ MP SUR\RTMYPA

    F>G 4 !)/%- " = 9 !-94!

    5QjMTS bA BQSXYQ( 0) TSA ;DH8EG( /QNQW`QU ;C( 9:;:

    ?MNOP#

    +T 6^TQ 8:( ;GG; -POUQYYROM @RfNST[Q MT[ ]QU [M^\]OQUP .MUWQYM(TRTQOQQT ZQMUP SY[( MT[ ddd( PQbQT( VQUQ `U^OMYYZ PYMRT MO O]QRU ]SWBMUMwMg^Q .ROZA ?SYYSVRT\ MT RTOQTPQ RTbQPOR\MORST( O]Q XSYRNQ MUUM \US^X S_ P^PXQNOP( PSWQ S_ V]SW \MbQ [QOMRYQ[ NST_QPPRSTPA !^O O]QOURMY NS^UO PWQYYQ[ M _UMWQJ^X MT[ QbQTO^MYYZ SU[QUQ[ O]QW [RPN]MU3]^P( O]Q R[QTORORQP S_ O]Q UQMY XQUXQOUMOSUP UQWMRTQ[ M WZPOQPXQNRMYYZ OS O]Q X^`YRN V]SPQ RTOQUQPOP VQUQ MUS^PQ[ `Z O]Q \URXX[QOMRYP S_ V]MO QbQUZ`S[Z UQ_QUUQ[ OS MP O]Q @RfNST[Q WMPPMNUQA

    ?S^U ZQMUP YMOQU RT ;GG

  • 8/12/2019 EVID DigestsCompilation SET01

    45/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 C O]QOUMbQY XUQXMUMORSTPk =`> O]Q OVS RWWR\UMORST N]QNiPk =N> [QOMRYP S_ 2&PSjS^UTk =[> O]Q PQNST[ RWWR\UMORST N]QNik MT[ =Q> MYR`R bQUP^P XSPRORbQR[QTOR_RNMORSTk MT[ =_> M [SN^WQTOQ[ MYR`RA

    3S QPOM`YRP] MYR`R( O]Q MNN^PQ[ W^PO XUSbQ `Z XSPRORbQ( NYQMU( MT[PMORP_MNOSUZ QbR[QTNQ O]MO =M> ]Q VMP XUQPQTO MO MTSO]QU XYMNQ MO O]QORWQ S_ O]Q XQUXQOUMORST S_ O]Q NURWQ( MT[ =`> O]MO RO VMP X]ZPRNMYYZRWXSPPR`YQ _SU ]RW OS `Q MO O]Q PNQTQ S_ O]Q NURWQA

    3]Q .S^UO S_ %XXQMYP UQjQNOQ[ O]Q QbR[QTNQ S_ IQ``hP XMPPXSUO PRTNQ ]Q[R[ TSO YQMbQ O]Q SUR\RTMY OS `Q MOOMN]Q[ OS O]Q UQNSU[A !^O( V]RYQ O]Q`QPO QbR[QTNQ S_ M [SN^WQTO RP O]Q SUR\RTMY( O]RP WQMTP O]MO O]Q PMWQ RPQd]R`ROQ[ RT NS^UO _SU O]Q M[bQUPQ XMUOZ OS QdMWRTQ MT[ _SU O]Q j^[\Q OSPQQA %P .S^UO S_ %XXQMYP 6^PORNQ 3M\YQ PMR[ RT ]RP [RPPQTO( O]Q XUMNORNQV]QT M XMUOZ [SQP TSO VMTO OS YQMbQ MT RWXSUOMTO [SN^WQTO VRO] O]QOURMY NS^UO RP OS ]MbQ M X]SOSNSXZ S_ RO WMUiQ[ MP Qd]R`RO MT[ PORX^YMOQ[MWST\ O]Q XMUORQP MP M _MRO]_^Y UQXUS[^NORST S_ O]Q SUR\RTMYA&ORX^YMORSTP RT O]Q NS^UPQ S_ OURMY MUQ `RT[RT\ ST O]Q XMUORQP MT[ ST O]QNS^UOA

    3]Q 2A&A *WWR\UMORST NQUOR_RNMORST MT[ O]Q NSWX^OQU XURTOJS^O S_IQ``hP MUURbMY RT MT[ [QXMUO^UQ _USW O]MO NS^TOUZ VQUQ M^O]QTORNMOQ[`Z TS YQPP O]MT O]Q +__RNQ S_ O]Q 2A&A %OOSUTQZ 0QTQUMY MT[ O]Q &OMOQ/QXMUOWQTOA &ORYY O]Q .S^UO S_ %XXQMYP UQ_^PQ[ OS MNNQXO O]QPQ[SN^WQTOP _SU O]Q UQMPST O]MO IQ`` _MRYQ[ OS XUQPQTO RT NS^UO O]QRWWR\UMORST S__RNRMY V]S XUQXMUQ[ O]Q PMWQA !^O O]RP VMP ^TTQNQPPMUZAIQ``hP XMPPXSUO RP M [SN^WQTO RPP^Q[ `Z O]Q B]RYRXXRTQ \SbQUTWQTO(

    V]RN] ^T[QU RTOQUTMORSTMY XUMNORNQ( RP O]Q S__RNRMY UQNSU[ S_ OUMbQNRORfQT OS V]SW RO RP RPP^Q[A 3]Q QTOURQP RT O]MO XMPPXSUO MUQ XUQPOU^QA

    3]Q 2A&A *WWR\UMORST NQUOR_RNMORST MT[ NSWX^OQU XURTOJS^O( O]Q SNQUOR_RNMORSTP S_ V]RN] ]MbQ `QQT M^O]QTORNMOQ[ `Z O]Q B]RYRXXR/QXMUOWQTO S_ ?SUQR\T %__MRUP( WQUQYZ bMYR[MOQ[ O]Q MUURbMY[QXMUO^UQ POMWXP S_ O]Q 2A&A *WWR\UMORST S__RNQ ST IQ``hP XMPPXSU3]QZ ]MbQ O]Q PMWQ QbR[QTORMUZ bMY^QA 3]Q S__RNQUP V]S RPP^Q[ O]QPQNQUOR_RNMORSTP TQQ[ TSO `Q XUQPQTOQ[ RT NS^UO OS OQPOR_Z ST O]QWA OU^POVSUO]RTQPP MURPQP _USW O]Q PQTPQ S_ S__RNRMY [^OZ MT[ O]Q XQTMMOOMN]Q[ OS M `UQMN]Q[ [^OZ( RT O]Q US^ORTQ MT[ [RPRTOQUQPOQ[ SUR\RT SP^N] POMOQWQTO MT[ RT O]Q X^`YRNROZ S_ O]Q UQNSU[A

    3]Q OURMY NS^UO MT[ O]Q .S^UO S_ %XXQMYP QdXUQPPQ[ WMUiQ[ NZTRNRPSbQU O]Q MNN^UMNZ S_ OUMbQY [SN^WQTOP YRiQ O]Q XMPPXSUO MP VQYY M[SWQPORN MT[ _SUQR\T UQNSU[P S_ [QXMUO^UQP MT[ MUURbMYP _USW MRUX3]QZ NYMRW O]MO RO VS^Y[ TSO ]MbQ `QQT RWXSPPR`YQ _SU IQ`` OS PQNUQOYZUQO^UT OS O]Q B]RYRXXRTQP M_OQU ]Q P^XXSPQ[YZ YQ_O RO ST 'MUN] G( ;GGNSWWRO O]Q NURWQ( \S `MNi OS O]Q 2A&A( MT[ SXQTYZ UQO^UT OS O]QB]RYRXXRTQP M\MRT ST +NOS`QU 9H( ;GG9A 3UMbQY `QOVQQT O]Q 2A&A MT[ O]B]RYRXXRTQP( PMR[ O]Q YSVQU NS^UOP OSSi STYZ M`S^O OVQYbQ OS _S^UOQ]S^UPA

    -__QNO S_ IQ``hP MYR`R OS SO]QUP

    IQ``hP [SN^WQTOQ[ MYR`R MYOS\QO]QU RWXQMN]QP %Y_MUSxP OQPORWSTZ( TSTYZ VRO] UQPXQNO OS ]RW( `^O MYPS VRO] UQPXQNO OS 5QjMTS( -POUM[?QUTMT[Qf( 0MON]MYRMT( )S[UR\^Qf( MT[ !RST\A ?SU( R_ O]Q .S^UO MNNQXOPO]Q XUSXSPRORST O]MO IQ`` VMP RT O]Q 2A&A V]QT O]Q NURWQ OSSi XYMNQ%Y_MUShP OQPORWSTZ VRYY TSO ]SY[ OS\QO]QUA IQ``hP XMUORNRXMORST RMTN]SU S_ %Y_MUShP POSUZA IRO]S^O RO( O]Q QbR[QTNQ M\MRTPO O]Q SO]QW^PO TQNQPPMURYZ _MYYA

    F?G : !9*,4#& " = 3 /:&-1 U3 /%-2-&

    )QX^`YRN bA 'MUNSPJ'MTSOSN( 0) TSA ;D;D:;( ?Q`U^MUZ E( 9:;9

    &^WWMUZ#

  • 8/12/2019 EVID DigestsCompilation SET01

    48/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 CE

    3]Q OUMTPNURXO S_ POQTS\UMX]RN TSOQP =3&,> S_ O]Q XUSNQQ[RT\PX^UXSUOQ[YZ `Q_SUQ O]Q B.00( O]Q XYMRTOR__hP Qd]R`RO rKs( WMZ `Q M X^`YRN[SN^WQTO( `^O V]MO

    VMP XUQPQTOQ[ `Z O]Q XYMRTOR__ VMP M WQUQ X]SOSNSXZ S_ O]Q X^UXSUOQ[3&, MT[ VMP TSO PR\TQ[ `Z O]Q POQTS\UMX]QU V]S P^XXSPQ[YZ OSSi[SVT O]Q XUSNQQ[RT\PA &^N] [SN^WQTO WMZ YRTi O]Q 'MUNSP PR`YRT\P MT[0UQ\SURS %UMTQOM *** OS O]Q RYYJ\SOOQT VQMYO] NMPQ S_ O]Q _SUWQUBUQPR[QTO 'MUNSPA *P -d] K M[WRPPR`YQv ,SA 2T[QU &QNA D S_ )^YQ ;8: S_O]Q )^YQP S_ .S^UO XUSbR[Q O]MO V]QT O]Q SUR\RTMY [SN^WQTO RP RT O]QN^POS[Z S_ M X^`YRN S__RNQU SU RP UQNSU[Q[ RT M X^`YRN S__RNQ( ROP NSTOQTOPWMZ `Q XUSbQ[ `Z M NQUOR_RQ[ NSXZ RPP^Q[ `Z O]Q X^`YRN S__RNQU RTN^POS[Z O]QUQS_A -d]R`RO rKs VMP TSO M NQUOR_RQ[ NSXZ MT[ RO VMP TSO QbQTPR\TQ[ `Z O]Q POQTS\UMX]QU V]S P^XXSPQ[YZ OSSi [SVT O]QXUSNQQ[RT\PA 3]^P( M`PQTO MTZ NSTbRTNRT\ QbR[QTNQ OS ]SY[ SO]QUVRPQ(XQORORSTQU _MRYP OS RO _SYYSVP O]MO XQORORSTQU _MRYQ[ OS XUSbQ O]MO O]Q'MUNSP PR`YRT\P MT[ 0UQ\SURS %UMTQOM *** NSYYM`SUMOQ[ VRO] _SUWQUBUQPR[QTO 'MUNSP MT[ *WQY[M )A 'MUNSP MT[ XMUORNRXMOQ[ RT O]Q _RUPONS^XYQhP MYYQ\Q[ MNN^W^YMORST S_ RYY J\SOOQT VQMYO]

    ?MNOP#

    NMPQ RTbSYbQP B9:: `RYYRST S_ O]Q 'MUNSPQPh MYYQ\Q[ MNN^W^YMOQ[ RYYJ\SOOQT VQMYO]A *O MYPS RTNY^[QP O]Q MYYQ\Q[ ^PQ S_ O]Q WQ[RM TQOVSUiP*!.J;8( !!.J9 MT[ )B,JG _SU O]Q 'MUNSP _MWRYZhP XQUPSTMY `QTQ_ROk O]QMYYQ\Q[ ^PQ S_ /Q &SYQRY %XXMUQY _SU [SYYMU PMYORT\k MT[ O]Q MYYQ\Q[ RYYQ\MYMNg^RPRORST MT[ SXQUMORST S_ O]Q `^P NSWXMTZ BMTOUMTNS ,SUO] -dXUQPP(*TNA =BMTOUMTNS>A

    %_OQU O]Q -/&% BQSXYQ BSVQU )QbSY^ORST RT ;GEH( O]Q _RUPO QdQN^ORbQ MNOS_ O]QT BUQPR[QTO .SUMfST .A %g^RTS VMP OS NUQMOQ O]Q BUQPR[QTORMY.SWWRPPRST ST 0SS[ 0SbQUTWQTO =B.00>A B^UP^MTO OS -dQN^ORbQ +U[QU,SA ;( O]Q B.00 VMP \RbQT O]Q WMT[MOQ#

    &QNA 9A 3]Q .SWWRPPRST P]MYY `Q N]MU\Q[ VRO] O]Q OMPi S_ MPPRPORT\ O]QBUQPR[QTO RT UQ\MU[ OS O]Q _SYYSVRT\ WMOOQUP#

    =M> 3]Q UQNSbQUZ S_ MYY RYYJ\SOOQT VQMYO] MNN^W^YMOQ[ `Z _SUWBUQPR[QTO ?QU[RTMT[ -A 'MUNSP( ]RP RWWQ[RMOQ _MWRYZ( UQYMORbP^`SU[RTMOQP MT[ NYSPQ MPPSNRMOQP(

    3]^P( T^WQUS^P NRbRY MT[ NURWRTMY NMPQP VQUQ P^`PQg^QTOYZ _RYQ[A +TQ O]Q NRbRY NMPQP _RYQ[ `Q_SUQ O]Q &MT[R\MT`MZMT OS UQNSbQU O]Q 'MUNSPMYYQ\Q[ RYYJ\SOOQT VQMYO] VMP .RbRY .MPQ ,SA :::9( TSV P^`jQNO S_ O]RPBQORORSTA

    B.00( MNORT\ ST `Q]MY_ S_ O]Q )QX^`YRN MT[ MPPRPOQ[ `Z O]Q +__RNQ S_ O]Q&SYRNROSU 0QTQUMY =+&0>( _RYQ[ M .SWXYMRTO _SU )QbQUPRST( )QNSTbQZM)QPORO^ORST( %NNS^TORT\ MT[ /MWM\QP M\MRTPO ?QU[RTMT[ -A 'MUNSP( V]SVMP YMOQU P^`PORO^OQ[ `Z ]RP QPOMOQ ^XST ]RP [QMO]k *WQY[M )A 'MUNSPMT[ ]QUQRT UQPXST[QTOP *WQQ 'MUNSPJ'MTSOSN( *UQTQ 'MUNSPJ%UMTQOM(!ST\`ST\ 'MUNSP( 3SWMP 'MTSOSN( MT[ 0UQ\SURS %UMTQOM ***A

    BQORORSTQU PQO _SUO] O]Q _SYYSVRT\ NM^PQP S_ MNORST RT ROP NSWXYMRNM^PQ S_ MNORST# `UQMN] S_ X^`YRN OU^POk PQNST[ NM^PQ S_ MNORST# M`^PUR\]O MT[ XSVQUk O]RU[ NM^PQ S_ MNORST# ^Tj^PO QTURN]WQTOk_S^UO] NM^PS_ MNORST# MNNS^TORT\oO]MO [Q_QT[MTOP( MNORT\ PRT\YZ SU NSYYQNORbQ^TYMV_^Y NSTNQUO VRO] STQ MTSO]QU( MT[ VRO] O]Q MNORbQ NSYYM`SUMORO]RU[ XQUPSTP( P^`jQNO S_ PQXMUMOQ P^ROP( MNg^RUQ[ _^T[P( MPPQOP MXUSXQUOZ [^URT\ O]Q RTN^W`QTNZ S_ [Q_QT[MTO X^`YRN S__RNQUP(WMTR_QPOYZ S^O S_ XUSXSUORST OS O]QRU PMYMURQP( OS O]QRU SO]QU RTNSWQ MT[ RTNSWQ _USW YQ\RORWMOQYZ MNg^RUQ[ XUSXQUOZk ?R_O] NM^MNORST o YRM`RYROZ _SU [MWM\QPA

    3]QUQM_OQU( XQORORSTQU XUQPQTOQ[ MT[ _SUWMYYZ S__QUQ[ ROP QbRM\MRTPO ]QUQRT UQPXST[QTOPA 1SVQbQU( O]Q YMOOQU S`jQNOQ[ OS O]Q S__XURWMURYZ ST O]Q \US^T[ O]MO O]Q [SN^WQTOP bRSYMOQ[ O]Q `QPO QbR[QTNQU^YQ S_ O]Q )^YQP S_ .S^UO( MP O]QPQ [SN^WQTOP VQUQ ^TM^O]QTORNMOQ[kWSUQSbQU( XQORORSTQU ]M[ TSO XUSbR[Q[ MTZ UQMPST _SU ROP _MRY^UQXUQPQTO O]Q SUR\RTMYPA

  • 8/12/2019 EVID DigestsCompilation SET01

    49/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 CG

    *WQY[M )A 'MUNSPk *WQQ 'MUNSPJ'MTSOSN MT[ !ST\`ST\ 'MUNSP( 6UAk*UQTQ 'MUNSPJ%UMTQOM MT[ 0UQ\SURS 'MA %UMTQOM ***k "Q^T\ .]^T FMW("Q^T\ .]^T 1S MT[ "Q^T\ .]^T ?MTk MT[ O]Q B-%JB30I+P^`PQg^QTOYZ _RYQ[ O]QRU UQPXQNORbQ /QW^UUQUP OS -bR[QTNQA

    O]Q &MT[R\MT`MZMT RPP^Q[ O]Q MPPMRYQ[ )QPSY^ORST( V]RN] \UMTOQ[ MYY O]Q/QW^UUQUP OS -bR[QTNQ QdNQXO O]Q STQ _RYQ[ `Z *WQY[M )A 'MUNSPA

    O]Q NS^UO ]QY[ O]MO O]Q QbR[QTNQ( RT XMUORN^YMU( Qd]R`ROP rB(s rK(s r)(s (r&(sMT[ r3(s VQUQ NSTPR[QUQ[ ]QMUPMZ( `QNM^PQ O]QRU SUR\RTMYP VQUQ TSOXUQPQTOQ[ RT NS^UO( TSU VQUQ O]QZ M^O]QTORNMOQ[ `Z O]Q XQUPSTP V]SQdQN^OQ[ O]QWA ?^UO]QUWSUQ( O]Q NS^UO XSRTOQ[ S^O O]MO XQORORSTQU_MRYQ[ OS XUSbR[Q MTZ bMYR[ UQMPST V]Z RO [R[ TSO XUQPQTO O]Q SUR\RTMYP RTNS^UOA 3]QPQ Qd]R`ROP VQUQ P^XXSPQ[ OS P]SV O]Q RTOQUQPOP S_ *WQQ'MUNSPJ'MTSOSi RT O]Q WQ[RM TQOVSUiP *!.J;8( !!.J9 MT[ )B,JG( MYYO]UQQ S_ V]RN] P]Q ]M[ MYYQ\Q[YZ MNg^RUQ[ RYYQ\MYYZA 3]QPQ Qd]R`ROP MYPSPS^\]O OS XUSbQ ]QU MYYQ\Q[ XMUORNRXMORST RT [SYYMU PMYORT\ O]US^\] /Q

    &SYQRY %XXMUQYA

    ?RTMYYZ( O]Q NS^UO ]QY[ O]MO O]Q UQYMORSTP]RX S_ UQPXST[QTOP OS O]Q'MUNSP PXS^PQP VMP TSO QTS^\] UQMPST OS ]SY[ O]Q _SUWQU YRM`YQA

    *T O]Q WMOOQU S_ O]Q PXS^PQP *UQTQ 'MUNSP MT[ 0UQ\SURS %UMTQOM ***( O]QNS^UO PRWRYMUYZ ]QY[ O]MO O]QUQ VMP TS OQPORWSTRMY SU [SN^WQTOMUZQbR[QTNQ O]MO P^XXSUOQ[ XQORORSTQUhP MYYQ\MORSTP M\MRTPO O]Q NS^XYQA%\MRT( XQORORSTQU _MRYQ[ OS XUQPQTO O]Q SUR\RTMY [SN^WQTOP O]MOP^XXSPQ[YZ P^XXSUOQ[ O]Q MYYQ\MORSTP M\MRTPO O]QWA *TPOQM[( RO WQUQYZXUQPQTOQ[ X]SOSNSXRQP S_ [SN^WQTOP O]MO PS^\]O OS XUSbQ ]SV O]Q'MUNSPQP ^PQ[ O]Q BSOQTNRMTSP MP [^WWRQP RT MNg^RURT\ MT[ SXQUMORT\O]Q `^P NSWXMTZ BMTOUMTNSA

    'QMTV]RYQ( MP _MU MP O]Q "Q^T\P VQUQ NSTNQUTQ[( O]Q NS^UO _S^T[ O]QMYYQ\MORSTP M\MRTPO O]QW `MPQYQPPA BQORORSTQU _MRYQ[ OS [QWSTPOUMOQ ]SVO]QRU `^PRTQPP( 0YSURS^P &^T ?MP]RST 0MUWQTOP 'MT^_MNO^URT\( .SA B]RYPA=0YSURS^P &^T>( VMP ^PQ[ MP M bQ]RNYQ _SU [SYYMU PMYORT\k SU OS P]SV O]MOO]QZ O]QWPQYbQP VQUQ [^WWRQP S_ O]Q 'MUNSPQPA %\MRT( O]Q NS^UO ]QY[O]MO O]Q [SN^WQTOMUZ QbR[QTNQ UQYQbMTO OS O]RP MYYQ\MORST VMP

    RTM[WRPPR`YQ _SU `QRT\ WQUQ X]SOSNSXRQP( MT[ O]MO O]Q M__RMTOP ]M[ T`QQT XUQPQTOQ[ MP VROTQPPQPA

    XQORORSTQU _RYQ[ ROP 'SORST _SU BMUORMY )QNSTPR[QUMORST( RTPRPORO]QUQ VMP M XUQXST[QUMTNQ S_ QbR[QTNQ OS P]SV O]MO UQPXST[QTOP'MUNSP PR`YRT\P MT[ 0UQ\SURS %UMTQOM *** ]M[ NSTTRbQ[ VRO] O]QRUXMUQTOP RT MNg^RURT\ RYYJ\SOOQT VQMYO]A

    %PPQUOQ[ O]MO O]Q QbR[QTNQ QPOM`YRP]Q[ O]MO O]Q "Q^T\P VQUQ [^WWRQPS_ O]Q 'MUNSPQP( MT[ O]MO O]Q BMTOUMTNS MPPQOP VQUQ XMUO S_ O'MUNSPQPh MYYQ\Q[ RYYJ\SOOQT VQMYO]A

    K^QPORSTQ[ O]Q NS^UOhP U^YRT\ O]MO O]Q QbR[QTNQ XUQbRS^PYZ M[WROOVMP YMOQU ]QY[ OS `Q RTM[WRPPR`YQ RT QbR[QTNQ M\MRTPO UQPXST[QTOP( O[QXURbRT\ O]Q _SUWQU S_ [^Q XUSNQPPA O]Q NS^UO RPP^Q[ O]Q PQNST[MPPMRYQ[ )QPSY^ORST( [QTZRT\ XQORORSTQUhP 'SORSTA 1QTNQ( O]RP BQORORS

    *PP^Q#

    I+, 3]Q PMT[R\MT`MZMThP U^YRT\ V]RN] UQjQNOQ[ XQROROSTQUhP[SN^WQTOMUZ Qd]R`ROP MYYQ\Q[YZ _SU `QRT\ rRTM[WRPPR`YQs [RUQNOYNSTOUM[RNOP ROP QMUYRQU U^YRT\ M[WROORT\ MYY PMR[ [SN^WQTOMUZ QMT[ VMP UQT[QUQ[ RT M WMTTQU O]MO [QXURbQ[ XQORORSTQUhP UR\]O OS [^XUSNQPP S_ YMVA =I+, O]Q Qd]R`ROP XUQPQTOQ[ `Z O]Q XQORORSTQUP VQUQM[WRPPR`YQA ,S>

    1QY[n)MORS# BQORORSTQU _MRYQ[ OS S`PQUbQ O]Q `QPO QbR[QTNQ U^YQA

    *O RP XQORORSTQUhP `^U[QT OS XUSbQ O]Q MYYQ\MORSTP RT ROP .SWXYMRTUQYRQ_ OS `Q \UMTOQ[( O]Q SXQUMORbQ MNO ST ]SV MT[ RT V]MO WMTTQU O'MUNSP PR`YRT\P XMUORNRXMOQ[ RT MT[nSU `QTQ_ROOQ[ _USW O]Q MNOP S_

  • 8/12/2019 EVID DigestsCompilation SET01

    50/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7

  • 8/12/2019 EVID DigestsCompilation SET01

    51/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7

  • 8/12/2019 EVID DigestsCompilation SET01

    52/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 MT[^XST [Q_M^YO RT O]Q XMZWQTO S_ O]Q YSMT S`YR\MORST( VMP _SUQNYSPQ[ MT[SVTQUP]RX VMP NSTPSYR[MOQ[ RT /!BxP TMWQ &QUM_RT %[SY_S( &UA(]SVQbQU( UQX^UN]MPQ[ O]Q PMWQ( M ZQMU M_OQU ]RP VR_Q [RQ[ RT ;GD:A

    &SWQORWQ RT ;GD MYYQ\Q[YZ WSUO\M\Q[O]Q P^`jQNO XUSXQUOZ _SU O]Q P^W S_ B;9( V]S RWWQ[RMOQYZ OSSi XSPPQPPRST S_ O]Q YMT[A OUMTPMNORST VMP(]SVQbQU( TSO UQ[^NQ[ RTOS VURORT\A

    I]QT %[SY_S [RQ[( ]RP ]QRUP( QdQN^OQ[ M /QQ[ S_ -dOUMj^[RNRMYBMUORORST NSbQURT\ O]Q P^`jQNO XUSXQUOZ MT[ 3.3P VQUQ RPP^Q[ OS O]QWAO]Q PMR[ XUSXQUOZ VMP P^`[RbR[Q[ MT[ PQXMUMOQ OROYQP VQUQ RPP^Q[ RTTMWQP S_ O]Q 1QRUP S_ %[SY_S(

    3]Q 1QRUP S_ %[SY_S QdXUQPPQ[ O]QRU RTOQTORST OS UQ[QQW O]Q WSUO\M\Q[XUSXQUOZ _USW !MT\RP `^O O]Q YMOOQU UQ_^PQ[( NYMRWRT\ O]MO O]QOUMTPMNORST `QOVQQT ]RW MT[ %[SY_S VMP STQ S_ PMYQA

    3]Q 1QRUP S_ %[SY_S _RYQ[ M NSWXYMRT `Q_SUQ =)3.> _SU MTT^YWQTO S_[QQ[ S_ PMYQ MT[ [QNYMUMORST S_ O]Q X^UXSUOQ[ NSTOUMNO S_ PMYQMTORN]UQPRP( MNNS^TORT\ MT[ UQ[QWXORST S_ XUSXQUOZ MT[ [MWM\QM\MRTPO !MT\RP( NSWXYMRTO VMP MWQT[Q[ OS RTNY^[Q M XUMZQU _SU ONMTNQYYMORST S_ 3.3 MT[ O]Q OMd [QNYMUMORSTP RT O]Q TMWQ S_ !MT\RP

    *T ]RP %TPVQU !MT\RP NYMRWQ[ OS ]MbQ `S^\]O O]Q P^`jQNO XUSXQUOZ_USW %[SY_SA 1Q MYPS MYYQ\Q[ OS ]MbQ `QQT RT SXQT MT[ M[bQUPQXSPPQPPRST S_ O]Q XUSXQUOZ PRTNQ ;GD9 MT[ O]MO O]Q NM^PQ S_ MNORST SO]Q 1QRUP S_ %[SY_S ]MP XUQPNUR`Q[A !MT\RP [RQ[ MT[ VMP P^`PORO^OQ[ RTO]RP P^RO `Z ]RP ]QRUP(

    /^URT\ O]Q OURMY( STQ S_ O]Q 1QRUP S_ !MT\RP( XUQPQTOQ[ M X]SOSNSXZS_ MT -dOUMJ6^[RNRMY &QOOYQWQTO VRO] %`PSY^OQ /QQ[ S_ &MYQ _SU X^UXSPQ S_ XUSbRT\ O]Q PMYQ S_ O]Q P^`jQNO YSO `Z %[SY_S MT[ ]RP ]QRUP RT_MbSU S_ ]RP XUQ[QNQPPSUPJRTJRTOQUQPO( %TRNQOS !MT\RP MT[ &Q\^T[RTS.SUOQY( _SU O]Q P^W S_ B;8(:::A::A 1Q MYPS XUQPQTOQ[ M BUSWRPPSUZ ,SOQS_ QbQT [MOQ X^UXSUOQ[YZ QdQN^OQ[ `Z !MT\RP MT[ &Q\^T[RTS .SUOQY^T[QUOMiRT\ OS XMZ O]Q `MYMTNQ S_ O]Q X^UN]MPQ XURNQ !SO] [SN^WQTOPVQUQ TSOMURfQ[ `Z %OOZA @MYQTORT '^URYYS V]S OQPOR_RQ[ OS O]Q _MNO]QRU QdQN^ORSTA !MT\RP YRiQVRPQ OQPOR_RQ[ O]MO O]QZ ]MbQ `QQT XMZRT\OMdQP [^Q ST O]Q XUSXQUOZ MT[ ]M[ QbQT ^PQ[ O]Q PMWQ MP NSYYMOQUMY _M YSMT VRO] M `MTiA )3. UQT[QUQ[ M /QNRPRST RT _MbSU S_ O]Q 1QRUP S_%[SY_S(

    %\\URQbQ[( O]Q 1QRUP S_ !MT\RP MXXQMYQ[ O]Q _SUQ\SRT\ [RPg^RPRORSTOS O]Q .S^UO S_ %XXQMYP =.%>A

    *T ROP MPPMRYQ[ /QNRPRST( O]Q .% M__RUWQ[ O]Q )3. _RT[RT\ O]MO O]QNSTOUMNO `QOVQQT O]Q XMUORQP VMP M WSUO\M\Q( TSO M PMYQA *O TSOQV]RYQ !MT\RP VMP \RbQT XSPPQPPRST S_ O]Q P^`jQNO XUSXQUOZ( O]QNQUOR_RNMOQ S_ OROYQ UQWMRTQ[ RT O]Q N^POS[Z S_ %[SY_S MT[ VMP TQNMTNQYYQ[A

    *PP^Q#

    I+, .% QUUQ[ RT TSO \RbRT\ XUS`MORbQ VQR\]O OS O]Q -dOUMJ6^[RNRMY&QOOYQWQTO VRO] %`PSY^OQ /QQ[ S_ &MYQ V]RN] P^XXSPQ[YZ `SYPOQUP O]Q

  • 8/12/2019 EVID DigestsCompilation SET01

    53/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7

  • 8/12/2019 EVID DigestsCompilation SET01

    54/105

    ! "#$!%&! ( )*$+! , -%#./- 0 & /1! $ #+!121

    ! " # %&%'%( ! )*+,-& ( . %)%,/%,0 ( . 12% ( . +,3)-)%& ( . )24 ( / 2'% ( - &3*55-&( 0 +,4%0% ( 5%4%)+( 5*' ( &-,%6+, ( 3 -,0.+ ( 2 )!*,% 7 8/ 9:;< 7 M\MRTPO O]Q[SNOSUP V]S MYYQ\Q[YZ XMUORNRXMOQ[ RT O]Q _MOQ_^Y iR[TQZ SXQUMORST(TMWQZ# /UPA /QYM @Q\M( 5MTORT ***( ?YSUQT[S( MT[ XQORORSTQU %ORQTfMA

    *O VMP MYYQ\Q[ O]MO O]Q [SNOSUP MT[ O]Q XQORORSTQU VQUQ \USPPYZ TQ\YR\QTO_SU UQWSbRT\ O]Q _^YYZ _^TNORSTMY UR\]O iR[TQZ S_ -[RO]M( RTPOQM[ S_ O]QYQ_O TSTJ_^TNORSTRT\ MT[ TSTJbRP^MYRfRT\ iR[TQZA 3]Q NSWXYMRTO VMP]QMU[ `Z !+' MT[ &RSPST XUQPQTOQ[ O]Q QbR[QTNQ V]RN] NSTPRPOP S_ uJ)MZ X]SOSNSXRQP _SU O]Q X^UXSPQ S_ XUSbRT\ O]MO ]QU iR[TQZP VQUQ `SO]RT O]QRU XUSXQU MTMOSWRNMY YSNMORSTP MO O]Q ORWQ P]Q VMP SXQUMOQ[AQ-141432-. 04>-8 ,47 3=U-@14327 13 1,- 03.9/> 300-. 30 -V,4=417 />>-5425 1,/17/48 -V,4=417 6-.- 42/894774=>- =-@/A7- 1,- 7/9- /.- 9-.- ?,313@3?4-7OTSO XUSXQUYZ R[QTOR_RQ[ MT[ M^O]QTORNMOQ[( MT[ RTOQT[Q[ OS QPOM`YRP]WMOOQUP V]RN] MUQ ]QMUPMZA

    3]Q _SUWMY S__QU S_ QbR[QTNQ VMP M[WROOQ[ `Z !+'A BQORORSTQU MXXQMYQ[OS O]Q .% `^O OS TS MbMRYA

    #NN`PO

    I]QO]QU .% QUUQ[ RT ^X]SY[RT\ O]Q M[WRPPRST S_ RTNSWXQOQTO MT[RTM[WRPPR`YQ QbR[QTNQ `Z UQPXST[QTO `SMU[A

    8PQRO

    BQORORST [QTRQ[A

    :KMSTO

    U3S `Q\RT VRO]( RO RP VQYY PQOOYQ[ O]MO O]Q U^YQP S_ QbR[QTNQ MUQ TSOPOURNOYZ MXXYRQ[ RT XUSNQQ[RT\P `Q_SUQ M[WRTRPOUMORbQ `S[RQP P^N] MP!+'A %YO]S^\] OURMY NS^UOP MUQ QTjSRTQ[ OS S`PQUbQ POURNO QT_SUNQWQTOS_ O]Q U^YQP S_ QbR[QTNQ( RT NSTTQNORST VRO] QbR[QTNQ V]RN] WMZ MXXQMUOS `Q S_ [S^`O_^Y UQYQbMTNZ( RTNSWXQOQTNZ( SU M[WRPPR`RYROZ( VQ ]MbQ]QY[ O]MO# r*O RP O]Q PM_QPO XSYRNZ OS `Q YR`QUMY( TSO UQjQNORT\ O]QW ST

    [S^`O_^Y SU OQN]TRNMY \US^T[P( `^O M[WROORT\ O]QW ^TYQPP XYMRTYZRUUQYQbMTO( RWWMOQURMY SU RTNSWXQOQTO( _SU O]Q UQMPST O]MOUQjQNORST XYMNQP O]QW `QZST[ O]Q NSTPR[QUMORST S_ O]Q NS^UO( R_ O]QZ O]QUQM_OQU _S^T[ UQYQbMTO SU NSWXQOQTOk ST O]Q SO]QU ]MT[( O]QRM[WRPPRST( R_ O]QZ O^UT S^O YMOQU OS `Q RUUQYQbMTO SU RTNSWXQOQTQMPRYZ `Q UQWQ[RQ[ `Z NSWXYQOQYZ [RPNMU[RT\ O]QW SU R\TSURT\ O]QWAs

    J3]Q !QPO -bR[QTNQ )^YQ RP RTMXXYRNM`YQ MP RO _MYYP VRO]RT O]Q QdNQXOS_ O]Q PMR[ U^YQ MP QT^WQUMOQ[ RT &QNORST 8 S_ )^YQ ;8: S_ O]Q )^YQP S_.S^UOA

    IROTQPP /UA %g^RTS OQPOR_RQ[ O]MO O]Q )QNSU[P +__RNQ S_ )'