Forensics specifics

As already stated, one does not need all-inclusive forensic software except for the convenience and the acceptability of their analysis in some nontech- nical circles. A good complement of freeware can do the requisite individual tasks. For example, searching an entire hard disk for keywords is easily done with SectorSpyXP, which is available online from numerous sources. This is depicted in Figure 1.1, where the software was asked to find the keyword “Windows.”

One must be cautioned that often a keyword (e.g., “bomb”) does not appear intact in any single sector; part of it (e.g., “b”) may be in one sector and part of it (e.g., “omb”) may be in a distant sector. This is so because Windows write files on whichever sectors it finds available at the time, and it may very well break a single file into numerous noncontiguous sectors.

Keyword searching for “BOULAMITE” will take one to the sector that has the Windows registered owner’s name and affiliation.

All-inclusive forensic software suits like Encase from Guidance Software can also handle numerous personal digital assistants (PDAs), Redundnt Array of Inexpensive Disks (RAID) disks, Flash media (e.g., the popular Uni- versal Serial Bus (USB) key-like plug-ins that seem to be replacing floppy disks as temporary storage media, are formatted like a hard disk with a file allocation table (FAT), and have their own slack and unallocated space, like a disk.

It is noteworthy that renaming a file to something less alerting (e.g., bomb.jpg to holy.txt) actually works against you. Each file type (such as .jpg files) has a unique header that is not changed when the file’s name is changed. In the case of .jpg files, that header is “xFF\xD8\xFF\xFE”; chang- ing the file’s name to holy.txt will only cause that file to be flagged to the

1.4 Computer forensics 13

forensic investigator as an intentionally misnamed file, as shown below, thereby subjecting it to even more scrutiny. In Figure 1.2, an example from Encase software, “!Bad signature” means that the file suffixes (.wpg and .xls) in these files’ names do not match the headers at the beginnings of these files.

Amusingly, the practice of misnaming files to confuse others appears to have also been practiced by Microsoft in the case of the logos.sys and logow.sys files; both of these files have a .sys suffix, suggesting that they are system files whose removal will prevent the computer from booting; in fact, they are bitmaps of splash screens (i.e., ads for Microsoft).

Searching for the link files (.lnk) in the following locations will show which shortcut was created, when, and to which file:

◗ _{Windows\Desktop;} ◗ _{Windows\Recent;} ◗ _{Windows\Start;} ◗ _{Windows\Send.}

Such files could be use to contest defense claims that a suspect had no idea what a file was or how it got there.

The investigator can also search in print spooler files, because files sent to a printer are usually spooled in a file on the hard disk before being printed. The spool file is not intentionally overwritten by Windows. There are two kinds of printer spool files:

1. Shadow (.shd) files show the file’s owner, printer name, file name, and printing method [“raw” or enhanced metafile format (emf)].

2. The .spl file, which also contains the file to be printed, is created even if one prints from a floppy disk.

The existence of a file in the printer spool can again contest defense claims that a suspect had no idea what a file was or how it got there, unless

the printing action is claimed to have been intended to answer that question.

Deleted folders and their contents’ names can often be recovered as well, as long as the data has not been overwritten. Encase and similar software programs make this process easy, as shown in Figure 1.3.

Files sent to the Recycle Bin (a British-sounding term, as opposed to the American term trash can, reportedly conjured up by Microsoft to avoid a legal battle with Apple Computer about its “Trash” icon) can be recovered even if they have been deleted as long as they have not been overwritten. Even if they have been overwritten, their names can often be recovered from the INFO file that is created whenever a file is added to the Recycle Bin, as shown in Figure 1.4.

1.4 Computer forensics 15

Figure 1.4 Recovering deleted files even from the Recycle Bin. Figure 1.3 Recovering deleted folders with Encase.

New Technology File System (NTFS) security permissions are irrelevant and offer no protection from a forensic investigator because the investigator is not operating within a Windows environment in the first place.

The forensic software can also search for the metadata about files (e.g., date of creation) unless the file was created with DOS prior to version 7.

Depending on the software package, operating system, and language support added, computer forensics is obviously not limited to the Latin alphabet, but can handle foreign languages as well, as shown in Figure 1.5.

An investigator who is comfortable with a particular foreign language can do a keyword search in that language just as well as he or she can in English. Indeed, today’s national security organizations must have the in- house competence to handle computer forensics in numerous foreign lan- guages, including languages written right to left.

Equally important, a competent forensics investigation should also include search on metadata, such as when a file appears to have been cre- ated, renamed, moved, deleted, overwritten, and so forth. A computer forensics investigation should also be able to reconstruct, to the extent pos- sible, even deleted “compound files” [i.e., files whose data is shared among more than one individual files, as is the case with Registry, Microsoft Out- look, and Outlook Express files (.dbx and .pst files), among others]. An example of an Outlook e-mail file reconstructed with Encase is shown in Figure 1.6.