Steve Bunting, EnCE, CCFT, has over 30 years of law enforcement and computer forensics experience. He is a Senior Forensic Consultant for Forward Discovery, a global forensics consulting organization. Previously he served as a captain with the University of Delaware Police Department, where he conducted examinations of computer systems for federal, state, and local law enforcement. He is also the coauthor of Mastering Windows Network Forensics and Investigation.

• Introduction xxiAssessment Test xxviiChapter 1 Computer Hardware 1Computer Hardware Components 2The Boot Process 14Partitions 20File Systems 25Summary 27Exam Essentials 27Review Questions 28Chapter 2 File Systems 33FAT Basics 34The Physical Layout of FAT 36Viewing Directory Entries Using EnCase 52The Function of FAT 58NTFS Basics 73CD File Systems 77exFAT 79Summary 83Exam Essentials 84Review Questions 85Chapter 3 First Response 89Planning and Preparation 90The Physical Location 91Personnel 91Computer Systems 92What to Take with You Before You Leave 94Search Authority 97Handling Evidence at the Scene 98Securing the Scene 98Recording and Photographing the Scene 99Seizing Computer Evidence 99Bagging and Tagging 110Summary 113Exam Essentials 113Review Questions 115Chapter 4 Acquiring Digital Evidence 119Creating EnCase Forensic Boot Disks 121Booting a Computer Using the EnCase Boot Disk 124Seeing Invisible HPA and DCO Data 125Other Reasons for Using a DOS Boot 126Steps for Using a DOS Boot 126Drive-to-Drive DOS Acquisition 128Steps for Drive-to-Drive DOS Acquisition 128Supplemental Information About Drive-to-DriveDOS Acquisition 132Network Acquisitions 135Reasons to Use Network Acquisitions 135Understanding Network Cables 136Preparing an EnCase Network Boot Disk 137Preparing an EnCase Network Boot CD 138Steps for Network Acquisition 138FastBloc/Tableau Acquisitions 151Available FastBloc Models 151FastBloc 2 Features 152Steps for Tableau (FastBloc) Acquisition 154FastBloc SE Acquisitions 163About FastBloc SE 163Steps for FastBloc SE Acquisitions 164LinEn Acquisitions 168Mounting a File System as Read-Only 168Updating a Linux Boot CD with the Latest Version of LinEn 169Running LinEn 171Steps for LinEn Acquisition 173Enterprise and FIM Acquisitions 176EnCase Portable 180Helpful Hints 188Summary 189Exam Essentials 192Review Questions 194Chapter 5 EnCase Concepts 199EnCase Evidence File Format 200CRC, MD5, and SHA-1 201Evidence File Components and Function 202New Evidence File Format 206Evidence File Verification 207Hashing Disks and Volumes 215EnCase Case Files 217EnCase Backup Utility 220EnCase Configuration Files 227Evidence Cache Folder 231Summary 233Exam Essentials 235Review Questions 236Chapter 6 EnCase Environment 241Home Screen 242EnCase Layout 246Creating a Case 249Tree Pane Navigation 255Table Pane Navigation 266Table View 266Gallery View 275Timeline View 277Disk View 280View Pane Navigation 284Text View 284Hex View 287Picture View 288Report View 289Doc View 289Transcript View 290File Extents View 291Permissions View 291Decode View 292Field View 294Lock Option 294Dixon Box 294Navigation Data (GPS) 295Find Feature 297Other Views and Tools 298Conditions and Filters 298EnScript 299Text Styles 299Adjusting Panes 300Other Views 306Global Views and Settings 306EnCase Options 310Summary 318Exam Essentials 320Review Questions 321Chapter 7 Understanding, Searching For, and Bookmarking Data 325Understanding Data 327Binary Numbers 327Hexadecimal 333Characters 336ASCII 337Unicode 338EnCase Evidence Processor 340Searching for Data 352Creating Keywords 353GREP Keywords 364Starting a Search 373Viewing Search Hits and Bookmarking Your Findings 376Bookmarking 377Summary 426Exam Essentials 428Review Questions 430Chapter 8 File Signature Analysis and Hash Analysis 435File Signature Analysis 436Understanding Application Binding 437Creating a New File Signature 438Conducting a File Signature Analysis 442Hash Analysis 449MD5 Hash 449Hash Sets and Hash Libraries 449Hash Analysis 462Summary 466Exam Essentials 468Review Questions 469Chapter 9 Windows Operating System Artifacts 473Dates and Times 475Time Zones 475Windows 64-Bit Time Stamp 476Adjusting for Time Zone Offsets 481Recycle Bin 487Details of Recycle Bin Operation 488The INFO2 File 488Determining the Owner of Files in the Recycle Bin 493Files Restored or Deleted from the Recycle Bin 494Using an EnCase Evidence Processor to Determine the Status of Recycle Bin Files 496Recycle Bin Bypass 498Windows Vista/Windows 7 Recycle Bin 500Link Files 504Changing the Properties of a Shortcut 504Forensic Importance of Link Files 505Using the Link File Parser 509Windows Folders 511Recent Folder 515Desktop Folder 516My Documents/Documents 518Send To Folder 518Temp Folder 519Favorites Folder 520Windows Vista Low Folders 521Cookies Folder 523History Folder 526Temporary Internet Files 532Swap File 535Hibernation File 536Print Spooling 537Legacy Operating System Artifacts 543Windows Volume Shadow Copy 544Windows Event Logs 549Kinds of Information Available in Event Logs 549Determining Levels of Auditing 552Windows Vista/7 Event Logs 554Using the Windows Event Log Parser 555For More Information 558Summary 559Exam Essentials 564Review Questions 566Chapter 10 Advanced EnCase 571Locating and Mounting Partitions 573Mounting Files 588Registry 595Registry History 595Registry Organization and Terminology 596Using EnCase to Mount and View the Registry 601Registry Research Techniques 605EnScript and Filters 608Running EnScripts 609Filters and Conditions 611Email 614Base64 Encoding 619EnCase Decryption Suite 622Virtual File System (VFS) 629Restoration 633Physical Disk Emulator (PDE) 636Putting It All Together 641Summary 645Exam Essentials 648Review Questions 649Appendix A Answers to Review Questions 653Chapter 1: Computer Hardware 654Chapter 2: File Systems 655Chapter 3: First Response 657Chapter 4: Acquiring Digital Evidence 658Chapter 5: EnCase Concepts 659Chapter 6: EnCase Environment 661Chapter 7: Understanding, Searching For, and Bookmarking Data 662Chapter 8: File Signature Analysis and Hash Analysis 663Chapter 9: Windows Operating System Artifacts 664Chapter 10: Advanced EnCase 665Appendix B Creating Paperless Reports 667Exporting the Web Page Report 669Creating Your Container Report 671Bookmarks and Hyperlinks 675Burning the Report to CD or DVD 678Appendix C About the Additional Study Tools 681Additional Study Tools 682Sybex Test Engine 682Electronic Flashcards 682PDF of Glossary of Terms 682Adobe Reader 682Additional Author Files 683System Requirements 683Using the Study Tools 683Troubleshooting 683Customer Care 684Index 685

Steve Bunting, EnCE, CCFT, has over 30 years of law enforcement and computer forensics experience. He is a Senior Forensic Consultant for Forward Discovery, a global forensics consulting organization. Previously he served as a captain with the University of Delaware Police Department, where he conducted examinations of computer systems for federal, state, and local law enforcement. He is also the coauthor of Mastering Windows Network Forensics and Investigation.

• Introduction xxiAssessment Test xxviiChapter 1 Computer Hardware 1Computer Hardware Components 2The Boot Process 14Partitions 20File Systems 25Summary 27Exam Essentials 27Review Questions 28Chapter 2 File Systems 33FAT Basics 34The Physical Layout of FAT 36Viewing Directory Entries Using EnCase 52The Function of FAT 58NTFS Basics 73CD File Systems 77exFAT 79Summary 83Exam Essentials 84Review Questions 85Chapter 3 First Response 89Planning and Preparation 90The Physical Location 91Personnel 91Computer Systems 92What to Take with You Before You Leave 94Search Authority 97Handling Evidence at the Scene 98Securing the Scene 98Recording and Photographing the Scene 99Seizing Computer Evidence 99Bagging and Tagging 110Summary 113Exam Essentials 113Review Questions 115Chapter 4 Acquiring Digital Evidence 119Creating EnCase Forensic Boot Disks 121Booting a Computer Using the EnCase Boot Disk 124Seeing Invisible HPA and DCO Data 125Other Reasons for Using a DOS Boot 126Steps for Using a DOS Boot 126Drive-to-Drive DOS Acquisition 128Steps for Drive-to-Drive DOS Acquisition 128Supplemental Information About Drive-to-DriveDOS Acquisition 132Network Acquisitions 135Reasons to Use Network Acquisitions 135Understanding Network Cables 136Preparing an EnCase Network Boot Disk 137Preparing an EnCase Network Boot CD 138Steps for Network Acquisition 138FastBloc/Tableau Acquisitions 151Available FastBloc Models 151FastBloc 2 Features 152Steps for Tableau (FastBloc) Acquisition 154FastBloc SE Acquisitions 163About FastBloc SE 163Steps for FastBloc SE Acquisitions 164LinEn Acquisitions 168Mounting a File System as Read-Only 168Updating a Linux Boot CD with the Latest Version of LinEn 169Running LinEn 171Steps for LinEn Acquisition 173Enterprise and FIM Acquisitions 176EnCase Portable 180Helpful Hints 188Summary 189Exam Essentials 192Review Questions 194Chapter 5 EnCase Concepts 199EnCase Evidence File Format 200CRC, MD5, and SHA-1 201Evidence File Components and Function 202New Evidence File Format 206Evidence File Verification 207Hashing Disks and Volumes 215EnCase Case Files 217EnCase Backup Utility 220EnCase Configuration Files 227Evidence Cache Folder 231Summary 233Exam Essentials 235Review Questions 236Chapter 6 EnCase Environment 241Home Screen 242EnCase Layout 246Creating a Case 249Tree Pane Navigation 255Table Pane Navigation 266Table View 266Gallery View 275Timeline View 277Disk View 280View Pane Navigation 284Text View 284Hex View 287Picture View 288Report View 289Doc View 289Transcript View 290File Extents View 291Permissions View 291Decode View 292Field View 294Lock Option 294Dixon Box 294Navigation Data (GPS) 295Find Feature 297Other Views and Tools 298Conditions and Filters 298EnScript 299Text Styles 299Adjusting Panes 300Other Views 306Global Views and Settings 306EnCase Options 310Summary 318Exam Essentials 320Review Questions 321Chapter 7 Understanding, Searching For, and Bookmarking Data 325Understanding Data 327Binary Numbers 327Hexadecimal 333Characters 336ASCII 337Unicode 338EnCase Evidence Processor 340Searching for Data 352Creating Keywords 353GREP Keywords 364Starting a Search 373Viewing Search Hits and Bookmarking Your Findings 376Bookmarking 377Summary 426Exam Essentials 428Review Questions 430Chapter 8 File Signature Analysis and Hash Analysis 435File Signature Analysis 436Understanding Application Binding 437Creating a New File Signature 438Conducting a File Signature Analysis 442Hash Analysis 449MD5 Hash 449Hash Sets and Hash Libraries 449Hash Analysis 462Summary 466Exam Essentials 468Review Questions 469Chapter 9 Windows Operating System Artifacts 473Dates and Times 475Time Zones 475Windows 64-Bit Time Stamp 476Adjusting for Time Zone Offsets 481Recycle Bin 487Details of Recycle Bin Operation 488The INFO2 File 488Determining the Owner of Files in the Recycle Bin 493Files Restored or Deleted from the Recycle Bin 494Using an EnCase Evidence Processor to Determine the Status of Recycle Bin Files 496Recycle Bin Bypass 498Windows Vista/Windows 7 Recycle Bin 500Link Files 504Changing the Properties of a Shortcut 504Forensic Importance of Link Files 505Using the Link File Parser 509Windows Folders 511Recent Folder 515Desktop Folder 516My Documents/Documents 518Send To Folder 518Temp Folder 519Favorites Folder 520Windows Vista Low Folders 521Cookies Folder 523History Folder 526Temporary Internet Files 532Swap File 535Hibernation File 536Print Spooling 537Legacy Operating System Artifacts 543Windows Volume Shadow Copy 544Windows Event Logs 549Kinds of Information Available in Event Logs 549Determining Levels of Auditing 552Windows Vista/7 Event Logs 554Using the Windows Event Log Parser 555For More Information 558Summary 559Exam Essentials 564Review Questions 566Chapter 10 Advanced EnCase 571Locating and Mounting Partitions 573Mounting Files 588Registry 595Registry History 595Registry Organization and Terminology 596Using EnCase to Mount and View the Registry 601Registry Research Techniques 605EnScript and Filters 608Running EnScripts 609Filters and Conditions 611Email 614Base64 Encoding 619EnCase Decryption Suite 622Virtual File System (VFS) 629Restoration 633Physical Disk Emulator (PDE) 636Putting It All Together 641Summary 645Exam Essentials 648Review Questions 649Appendix A Answers to Review Questions 653Chapter 1: Computer Hardware 654Chapter 2: File Systems 655Chapter 3: First Response 657Chapter 4: Acquiring Digital Evidence 658Chapter 5: EnCase Concepts 659Chapter 6: EnCase Environment 661Chapter 7: Understanding, Searching For, and Bookmarking Data 662Chapter 8: File Signature Analysis and Hash Analysis 663Chapter 9: Windows Operating System Artifacts 664Chapter 10: Advanced EnCase 665Appendix B Creating Paperless Reports 667Exporting the Web Page Report 669Creating Your Container Report 671Bookmarks and Hyperlinks 675Burning the Report to CD or DVD 678Appendix C About the Additional Study Tools 681Additional Study Tools 682Sybex Test Engine 682Electronic Flashcards 682PDF of Glossary of Terms 682Adobe Reader 682Additional Author Files 683System Requirements 683Using the Study Tools 683Troubleshooting 683Customer Care 684Index 685

Steve Bunting, EnCE, CCFT, has over 30 years of law enforcement and computer forensics experience. He is a Senior Forensic Consultant for Forward Discovery, a global forensics consulting organization. Previously he served as a captain with the University of Delaware Police Department, where he conducted examinations of computer systems for federal, state, and local law enforcement. He is also the coauthor of Mastering Windows Network Forensics and Investigation.

• Introduction xxiAssessment Test xxviiChapter 1 Computer Hardware 1Computer Hardware Components 2The Boot Process 14Partitions 20File Systems 25Summary 27Exam Essentials 27Review Questions 28Chapter 2 File Systems 33FAT Basics 34The Physical Layout of FAT 36Viewing Directory Entries Using EnCase 52The Function of FAT 58NTFS Basics 73CD File Systems 77exFAT 79Summary 83Exam Essentials 84Review Questions 85Chapter 3 First Response 89Planning and Preparation 90The Physical Location 91Personnel 91Computer Systems 92What to Take with You Before You Leave 94Search Authority 97Handling Evidence at the Scene 98Securing the Scene 98Recording and Photographing the Scene 99Seizing Computer Evidence 99Bagging and Tagging 110Summary 113Exam Essentials 113Review Questions 115Chapter 4 Acquiring Digital Evidence 119Creating EnCase Forensic Boot Disks 121Booting a Computer Using the EnCase Boot Disk 124Seeing Invisible HPA and DCO Data 125Other Reasons for Using a DOS Boot 126Steps for Using a DOS Boot 126Drive-to-Drive DOS Acquisition 128Steps for Drive-to-Drive DOS Acquisition 128Supplemental Information About Drive-to-DriveDOS Acquisition 132Network Acquisitions 135Reasons to Use Network Acquisitions 135Understanding Network Cables 136Preparing an EnCase Network Boot Disk 137Preparing an EnCase Network Boot CD 138Steps for Network Acquisition 138FastBloc/Tableau Acquisitions 151Available FastBloc Models 151FastBloc 2 Features 152Steps for Tableau (FastBloc) Acquisition 154FastBloc SE Acquisitions 163About FastBloc SE 163Steps for FastBloc SE Acquisitions 164LinEn Acquisitions 168Mounting a File System as Read-Only 168Updating a Linux Boot CD with the Latest Version of LinEn 169Running LinEn 171Steps for LinEn Acquisition 173Enterprise and FIM Acquisitions 176EnCase Portable 180Helpful Hints 188Summary 189Exam Essentials 192Review Questions 194Chapter 5 EnCase Concepts 199EnCase Evidence File Format 200CRC, MD5, and SHA-1 201Evidence File Components and Function 202New Evidence File Format 206Evidence File Verification 207Hashing Disks and Volumes 215EnCase Case Files 217EnCase Backup Utility 220EnCase Configuration Files 227Evidence Cache Folder 231Summary 233Exam Essentials 235Review Questions 236Chapter 6 EnCase Environment 241Home Screen 242EnCase Layout 246Creating a Case 249Tree Pane Navigation 255Table Pane Navigation 266Table View 266Gallery View 275Timeline View 277Disk View 280View Pane Navigation 284Text View 284Hex View 287Picture View 288Report View 289Doc View 289Transcript View 290File Extents View 291Permissions View 291Decode View 292Field View 294Lock Option 294Dixon Box 294Navigation Data (GPS) 295Find Feature 297Other Views and Tools 298Conditions and Filters 298EnScript 299Text Styles 299Adjusting Panes 300Other Views 306Global Views and Settings 306EnCase Options 310Summary 318Exam Essentials 320Review Questions 321Chapter 7 Understanding, Searching For, and Bookmarking Data 325Understanding Data 327Binary Numbers 327Hexadecimal 333Characters 336ASCII 337Unicode 338EnCase Evidence Processor 340Searching for Data 352Creating Keywords 353GREP Keywords 364Starting a Search 373Viewing Search Hits and Bookmarking Your Findings 376Bookmarking 377Summary 426Exam Essentials 428Review Questions 430Chapter 8 File Signature Analysis and Hash Analysis 435File Signature Analysis 436Understanding Application Binding 437Creating a New File Signature 438Conducting a File Signature Analysis 442Hash Analysis 449MD5 Hash 449Hash Sets and Hash Libraries 449Hash Analysis 462Summary 466Exam Essentials 468Review Questions 469Chapter 9 Windows Operating System Artifacts 473Dates and Times 475Time Zones 475Windows 64-Bit Time Stamp 476Adjusting for Time Zone Offsets 481Recycle Bin 487Details of Recycle Bin Operation 488The INFO2 File 488Determining the Owner of Files in the Recycle Bin 493Files Restored or Deleted from the Recycle Bin 494Using an EnCase Evidence Processor to Determine the Status of Recycle Bin Files 496Recycle Bin Bypass 498Windows Vista/Windows 7 Recycle Bin 500Link Files 504Changing the Properties of a Shortcut 504Forensic Importance of Link Files 505Using the Link File Parser 509Windows Folders 511Recent Folder 515Desktop Folder 516My Documents/Documents 518Send To Folder 518Temp Folder 519Favorites Folder 520Windows Vista Low Folders 521Cookies Folder 523History Folder 526Temporary Internet Files 532Swap File 535Hibernation File 536Print Spooling 537Legacy Operating System Artifacts 543Windows Volume Shadow Copy 544Windows Event Logs 549Kinds of Information Available in Event Logs 549Determining Levels of Auditing 552Windows Vista/7 Event Logs 554Using the Windows Event Log Parser 555For More Information 558Summary 559Exam Essentials 564Review Questions 566Chapter 10 Advanced EnCase 571Locating and Mounting Partitions 573Mounting Files 588Registry 595Registry History 595Registry Organization and Terminology 596Using EnCase to Mount and View the Registry 601Registry Research Techniques 605EnScript and Filters 608Running EnScripts 609Filters and Conditions 611Email 614Base64 Encoding 619EnCase Decryption Suite 622Virtual File System (VFS) 629Restoration 633Physical Disk Emulator (PDE) 636Putting It All Together 641Summary 645Exam Essentials 648Review Questions 649Appendix A Answers to Review Questions 653Chapter 1: Computer Hardware 654Chapter 2: File Systems 655Chapter 3: First Response 657Chapter 4: Acquiring Digital Evidence 658Chapter 5: EnCase Concepts 659Chapter 6: EnCase Environment 661Chapter 7: Understanding, Searching For, and Bookmarking Data 662Chapter 8: File Signature Analysis and Hash Analysis 663Chapter 9: Windows Operating System Artifacts 664Chapter 10: Advanced EnCase 665Appendix B Creating Paperless Reports 667Exporting the Web Page Report 669Creating Your Container Report 671Bookmarks and Hyperlinks 675Burning the Report to CD or DVD 678Appendix C About the Additional Study Tools 681Additional Study Tools 682Sybex Test Engine 682Electronic Flashcards 682PDF of Glossary of Terms 682Adobe Reader 682Additional Author Files 683System Requirements 683Using the Study Tools 683Troubleshooting 683Customer Care 684Index 685