Dave Kleiman Technical Editor
Kevin Cardwell
Timothy Clinton
Michael Cross
Michael Gregg
Jesse Varsalone
Craig Wright
for Computer Hacking Forensics Investigators
465_SG_CHFI_FM.qxd 10/15/07 9:50 AM Page i
Elsevier, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively
“Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work.
There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold AS IS
and WITHOUT WARRANTY.You may have other legal rights, which vary from state to state.
In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or
consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or
limitation of liability for consequential or incidental damages, the above limitation may not apply to you.
You should always use reasonable care, including backup and other appropriate precautions, when working with
computers, networks, data, and files.
Syngress Media®, Syngress®,“Career Advancement Through Skill Enhancement®,” “Ask the Author UPDATE®,”
and “Hack Proofing®,” are registered trademarks of Elsevier, Inc.“Syngress:The Definition of a Serious Security
Library”™,“Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of
Elsevier, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective
companies.
PUBLISHED BY
Syngress Publishing, Inc.
Elsevier, Inc.
30 Corporate Drive
Burlington, MA 01803
The Official CHFI Study Guide (Exam 312-49) for Computer Hacking Forensic Investigators
Copyright © 2007 by Elsevier, Inc. All rights reserved. Printed in the United States of America. Except as permitted

He is frequently a speaker at many national security conferences and is a regular contributor to security-
related newsletters, Web sites, and Internet forums. Dave is a member of many professional security organizations,
including the Miami Electronic Crimes Task Force (MECTF), International Association of Counter Terrorism and
Security Professionals (IACSP), International Society of Forensic Computer Examiners® (ISFCE), Information
Systems Audit and Control Association® (ISACA), High Technology Crime Investigation Association (HTCIA),
Association of Certified Fraud Examiners (ACFE), and the High Tech Crime Consortium (HTCC). He is also
the Sector Chief for Information Technology at the FBI’s InfraGard®.
Kevin Cardwell (CEH, ECSA, LPT) works as a freelance consultant and provides consulting services for compa-
nies throughout the U.S., U.K., and Europe. He is an adjunct associate professor for the University of Maryland
University College, where he participated in the team that developed the Information Assurance Program for
Graduate Students, which is recognized as a Center of Excellence program by the National Security Agency
(NSA). He is an instructor and technical editor for computer forensics and hacking courses. He has presented at
the Blackhat USA Conference.
During a 22-year period in the U.S. Navy, Kevin tested and evaluated surveillance and weapon system soft-
ware. Some of this work was on projects like the Multi-Sensor Torpedo Alertment Processor (MSTRAP),Tactical
Decision Support System (TDSS), Computer Aided Dead Reckoning Tracer (CADRT), Advanced Radar
Periscope Discrimination and Detection (ARPDD), and the Remote Mine Hunting System (RMHS). He has
worked as both a software and systems engineer on a variety of Department of Defense projects and was selected
to head the team that built a Network Operations Center (NOC) that provided services to the command ashore
and ships at sea in the Norwegian Sea and Atlantic Ocean. He served as the leading chief of information security
at the NOC for six years prior to retiring from the U.S. Navy. During this time he was the leader of a five-person
Red Team.
Contributors
465_SG_CHFI_FM.qxd 10/15/07 9:50 AM Page iii
iv
Kevin wishes to thank his mother, Sally; girlfriend, Loredana; and daughter, Aspen, all of whom are sources
of his inspiration. Kevin holds a master’s degree from Southern Methodist University and is a member of the
IEEE and ACM. Kevin currently resides in Cornwall, England.
Marcus J. Carey (CISSP, CTT+) is the president of Sun Tzu Data, a leading information assurance and infras-
tructure architecture firm based out of central Maryland. Marcus’ specialty is network architecture, network secu-

Regional Police Service. In addition to designing and maintaining the Niagara Regional Police’s Web site
(www.nrps.com) and intranet, he has also provided support and worked in the areas of programming, hardware,
database administration, graphic design, and network administration. In 2007, he was awarded a Police
Commendation for work he did in developing a system to track high-risk offenders and sexual offenders in the
Niagara Region. As part of an information technology team that provides support to a user base of over 1,000
civilian and uniformed users, his theory is that when the users carry guns, you tend to be more motivated in
solving their problems.
Michael was the first computer forensic analyst in the Niagara Regional Police Service’s history, and for five
years he performed computer forensic examinations on computers involved in criminal investigations.The com-
puters he examined for evidence were involved in a wide range of crimes, inclusive to homicides, fraud, and pos-
session of child pornography. In addition to this, he successfully tracked numerous individuals electronically, as in
cases involving threatening e-mail. He has consulted and assisted in numerous cases dealing with computer-
related/Internet crimes and served as an expert witness on computers for criminal trials.
Michael has previously taught as an instructor for IT training courses on the Internet, Web development, pro-
gramming, networking, and hardware repair. He is also seasoned in providing and assisting in presentations on
465_SG_CHFI_FM.qxd 10/15/07 9:50 AM Page iv
v
Internet safety and other topics related to computers and the Internet. Despite this experience as a speaker, he still
finds his wife won’t listen to him.
Michael also owns KnightWare, which provides computer-related services like Web page design, and
Bookworms, which provides online sales of merchandise. He has been a freelance writer for over a decade and has
been published over three dozen times in numerous books and anthologies. When he isn’t writing or otherwise
attached to a computer, he spends as much time as possible with the joys of his life: his lovely wife, Jennifer; dar-
ling daughter Sara; adorable daughter Emily; and charming son Jason.
Michael Gregg is the president of Superior Solutions, Inc. and has more than 20 years’ experience in the IT
field. He holds two associate’s degrees, a bachelor’s degree, and a master’s degree and is certified as CISSP, MCSE,
MCT, CTT+, A+, N+, Security+, CNA, CCNA, CIW Security Analyst, CCE, CEH, CHFI, CEI, DCNP, ES
Dragon IDS, ES Advanced Dragon IDS, and TICSA.
Michael’s primary duties are to serve as project lead for security assessments helping businesses and state
agencies secure their IT resources and assets. Michael has authored four books, including: Inside Network Security

Oracle 8i/9i DBA, Certified Ethical Hacker) is a computer forensic senior professional at CSC. For four years, he
served as the director of the MCSE and Network Security Program at the Computer Career Institute at Johns
Hopkins University. For the 2006 academic year, he served as an assistant professor of computer information sys-
tems at Villa Julie College in Baltimore, Maryland. He taught courses in networking, Active Directory, Exchange,
Cisco, and forensics.
Jesse holds a bachelor’s degree from George Mason University and a master’s degree from the University of
South Florida. He runs several Web sites, including mcsecoach.com, which is dedicated to helping people obtain
their MCSE certification. He currently lives in Columbia, Maryland, with his wife, Kim, and son, Mason.
465_SG_CHFI_FM.qxd 10/15/07 9:50 AM Page v
vi
Craig Wright has personally conducted in excess of 1,200 IT security-related engagements for more than 120
Australian and international organizations in the private and government sectors and now works for BDO
Kendall’s in Australia.
In addition to his consulting engagements, Craig has also authored numerous IT security-related articles. He
also has been involved with designing the architecture for the world’s first online casino (Lasseter’s Online) in the
Northern Territory. He has designed and managed the implementation of many of the systems that protected the
Australian Stock Exchange. He also developed and implemented the security policies and procedural practices
within Mahindra and Mahindra, India’s largest vehicle manufacturer.
He holds (among others) the following industry certifications: CISSP (ISSAP & ISSMP), CISA, CISM,
CCE, GNSA, G7799, GWAS, GCFA, GLEG, GSEC, GREM, GPCI, MCSE, and GSPA. He has completed
numerous degrees in a variety of fields and is currently completing both a master’s degree in statistics (at
Newcastle) and a master’s degree in law (LLM) specializing in international commercial law (E-commerce Law).
Craig is planning to start his second doctorate, a PhD in economics and law in the digital age, in early 2008.
465_SG_CHFI_FM.qxd 10/15/07 9:50 AM Page vi
vii
Contents
Chapter 1 Computer Forensics in Today’s World . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2
The History of Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3
The Objectives of Computer Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3

Spatial Ergonomics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
Essential Laboratory Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
Write Blockers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36
Media Sterilization Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
Data Management (Backup, Retention, Preservation) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46
Portable Device Forensics: Some Basic Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48
Portable Devices and Data Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50
Forensic Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51
Tools in the Enterprise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .54
Ad Hoc Scripts and Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
Software Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
Tool Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56
Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56
Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59
Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60
Chapter 2 Systems, Disks, and Media . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62
File Systems and Hard Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62
Overview of a Hard Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62
Hard Disk Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74
File Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75
Windows XP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . .95
Forensic Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .99
Digital Media Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101
Magnetic Tape . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .102
Floppy Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .102
Compact Discs and DVDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .102
Blu-Ray . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107

Warning Banners . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162
Conducting a Computer Forensic Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165
The Investigation Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165
Evidence Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .171
Acquiring Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .176
Evidence Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .182
Documenting and Reporting of Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .187
Closing the Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189
Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192
Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
Chapter 4 Acquiring Data, Duplicating Data, and Recovering Deleted Files . . . . . . . . . . . . . . . . . . . 197
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198
Recovering Deleted Files and Deleted Partitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198
Deleting Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199
Recycle Bin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .204
Data Recovery in Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .211
Recovering Deleted Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .212
Deleted File Recovery Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .214
Recovering Deleted Partitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .229
Deleted Partition Recovery Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .235
Data Acquisition and Duplication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .240
Data Acquisition Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .243
Hardware Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .250
Backing Up and Duplicating Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .252
Acquiring Data in Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .254
Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .259
Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .259
Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .262
Chapter 5 Windows, Linux, and Macintosh Boot Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265

Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .348
Chapter 7 Steganography and Application Password Crackers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .352
History of Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .352
The Future of Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .354
Classification of Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .354
Background Information to Image Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .354
Insertion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .355
Substitution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .355
Creation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .356
Six Categories of Steganography in Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .356
Substitution System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .356
Transform Domain Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .356
Spread Spectrum Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .357
Statistical Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .357
Distortion Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .357
Cover Generation Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .357
Types of Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .357
Linguistic Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .358
Text Semagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .358
Technical Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .358
Embedding Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .358
Least Significant Bit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .358
Transform Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .358
Spread Spectrum Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .359
Perceptual Masking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .359
Application of Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .360
Still Images: Pictures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .360
Moving Images: Video . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .360
Audio Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .360

x Contents
Visible Noise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .370
Appended Spaces and “Invisible” Characters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .370
Color Palettes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .370
Attacking Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .370
Application Password Cracking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .372
Types of Password Cracking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .373
Password-Cracking Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .375
Common Recommendations for Improving Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .378
Standard Password Advice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .379
Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .380
Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .381
Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .385
Chapter 8 Computer-Assisted Attacks and Crimes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .388
E-mail Clients and Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .388
E-mail Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .390
E-mail Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .390
E-mail Crimes and Violations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .390
Spamming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .390
Mail Bombing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .391
Mail Storm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .391
Sexual Abuse of Children in Chat Rooms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .392
Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .392
Harassment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .392
Identity Fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .392
Chain Letter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .393
Sending Fakemail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .393
Investigating E-mail Crimes and Violations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .394
Examining the E-mail Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .394

Layers of the OSI Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .442
Network Addresses and NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .444
Network Information-Gathering Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .445
Sniffers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .445
Intrusion Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .445
Snort . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .446
Gathering Snort Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .446
Building an Alerts Detail Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .448
Building an Alerts Overview Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .451
Monitoring User Activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .453
Tracking Authentication Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .454
Identifying Brute Force Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .458
Tracking Security Policy Violations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .460
465_SG_CHFI_TOC.qxd 10/15/07 9:53 AM Page x
Contents xi
Auditing Successful and Unsuccessful File Access Attempts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .462
Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .465
Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .465
Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .466
Chapter 10 Router Forensics and Network Forensics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .470
Network Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .470
The Hacking Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .470
The Intrusion Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .471
Searching for Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .471
An Overview of Routers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .472
What Is a Router? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .472
The Function of a Router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .472
The Role of a Router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .472
Routing Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .473

Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .508
Chapter 12 PDA, Blackberry, and iPod Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .512
PDA Background Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .512
Components of a PDA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .512
PDA Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .512
Investigative Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .512
Step 1: Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .513
Step 2: Identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .513
Step 3: Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .513
Step 4: Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .514
PDA Investigative Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .514
Device Switched On . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .514
Device Switched Off . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .514
Device in Its Cradle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .515
Device Not in Its Cradle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .515
Wireless Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .515
Expansion Card in Slot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .515
Expansion Sleeve Removed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .515
Deploying PDA Forensic Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .516
PDA Secure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .516
PDA Seizure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .516
EnCase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .516
Introduction to the Blackberry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .516
Operating System of the Blackberry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .517
465_SG_CHFI_TOC.qxd 10/15/07 9:53 AM Page xi
xii Contents
Blackberry Operation and Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .517
Wireless Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .517
Security for Stored Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .517

iPod Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .534
DiskInternals Music Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .534
Recover My iPod . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .535
DD and the iPod . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .535
Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .536
Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .536
Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .540
Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .542
Chapter 13 Forensic Software and Hardware. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .544
Forensic Software Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .544
Visual TimeAnalyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .544
X-Ways Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .545
Evidor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .547
Slack Space and Data Recovery Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .547
Data Recovery Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .548
Permanent Deletion of Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .550
File Integrity Checker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .551
Disk Imaging Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . .552
Partition Managers: Partimage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .553
Linux/UNIX Tools: Ltools and Mtools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .553
Password Recovery Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .554
Multipurpose Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .556
Toolkits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .557
DataLifter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .559
Forensic Hardware Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .605
Hard Disk Write Protection Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .605
Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .614
Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .614

Signature Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .663
Copying Files/Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .667
E-mail Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .667
Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .667
What Are IE Cache Images? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .668
Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .669
Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .669
Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .672
Chapter 15 Incident Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .676
Preventing Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .676
Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .676
Intrusion Prevention Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .677
Other Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .677
Incident Response, Incident Handling, and Incident Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . .677
Incident Response Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .678
Computer Crime Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .678
Vulnerability Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .678
Categories of Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .679
Denial of Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .680
Malicious Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .680
Unauthorized Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .680
Inappropriate Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .680
Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .681
Staffing the Team . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .681
Steps of Incident Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .682
Preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .684
Identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .684
Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .685
Preservation and Containment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .685

Corporate Espionage Threats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .711
The Various Techniques of Spying . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .712
Espionage and Spying Countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .713
Netspionage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .713
How to Investigate Corporate Espionage Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .714
Features and Functions of Monitoring Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .715
Investigating Trademark and Copyright Infringement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .717
Defining the Term “Trademark” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .717
Investigating Copyright Violations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .720
Patents and Patent Infringement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .730
Domain Name Infringement and How to Check for It . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .732
Laws Related to Trademark and Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .734
Writing Investigative Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .735
Understanding the Importance of Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .735
The Requirements of an Investigative Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .735
Report Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .736
A Sample Investigative Report Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .737
Report Writing Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .739
Consistency and Other Important Aspects of a Good Report . . . . . . . . . . . . . . . . . . . . . . . . . . . .740
The Dos and Don’ts of Forensic Computer Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .743
Best Practice for Investigation and Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .744
Investigating Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .745
Investigating Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .745
What Is Pornography? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .750
The Motives Behind Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .756
Victims of Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .762
The Role of the Internet in Promoting Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . .765
Investigating Child Pornography Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .772
Anti-Child Pornography Initiatives and Organizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .780
Anti-Child Pornography Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .784

Crime (Cybercrime) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .864
Jurisdiction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .865
Defamation and Injurious Falsehood . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .865
Harassment and Cyberstalking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .866
Pornography and Obscenity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .867
465_SG_CHFI_TOC.qxd 10/15/07 9:53 AM Page xiv
Contents xv
Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .868
Searches (and the Fourth Amendment) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .869
Warrants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .870
Anton Piller (Civil Search) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .870
Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .871
License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .871
Intellectual Property . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .871
Evidence Law . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .872
Interpol: Information Technology Crime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .873
The Council of Europe’s Convention on Cybercrime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .874
The G8 Countries:An Action Plan to Combat High-Tech Crime . . . . . . . . . . . . . . . . . . . . . . . . . . . . .876
Principles and Action Plan to Combat High-Tech Crime5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .877
Australia . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .879
Contacts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .882
Albania . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .884
Austria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .884
Bulgaria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .885
Brazil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .887
Belgium . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .887
Canada . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .889
Denmark . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .890
Estonia . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .891
Finland . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .892

■
The Objectives of Computer Forensics
■
Computer-Facilitated Crimes
■
Reasons for Cyber Attacks
■
Computer Forensic Flaws and Risks
■
Computer Forensics: Rules, Procedures, and
Legal Issues
■
The Computer Forensic Lab
■
Laboratory Strategic Planning for Business
■
Elements of Facilities Build-out
■
Electrical and Power Plant Considerations
■
Essential Laboratory Tools
Chapter 1
CHFI
465_SG_CHFI_01.qxd 10/12/07 12:18 PM Page 1
2 Chapter 1 • Computer Forensics in Today's World
Introduction
As is often the case with security compromises, it’s not a matter of if your company will be
compromised, but when.
If I had known the employee I hired was going to resign, break into my office, and damage
my computers in the span of three days, hindsight being 20/20, I would have sent notification

review the objectives of computer forensics. It will also discuss computer-facilitated crimes, the
reasons for cyber crime, the computer forensics flaws and risks, modes of attack, digital foren-
sics, and the stages of forensic investigation in tracking cyber criminals.The chapter also covers
various stages of building a computer forensics laboratory.
465_SG_CHFI_01.qxd 10/12/07 12:18 PM Page 2
Computer Forensics in Today's World • Chapter 1 3
The History of Forensics
Forensics has been around since the dawn of justice. Cavemen had justice in rules set to protect
home and hearth. Francis Galton (1822–1911) made the first recorded study of fingerprints,
Leone Lattes (1887–1954) discovered blood groupings (A, B, AB, and 0), Calvin Goddard
(1891–1955) allowed firearms and bullet comparison for solving many pending court cases,
Albert Osborn (1858–1946) developed essential features of document examination, Hans Gross
(1847–1915) made use of scientific study to head criminal investigations. And in 1932, the FBI
set up a lab to provide forensic services to all field agents and other law authorities across the
country.When you look back at these historic forensic events, you see patterns of confidence
in the forensic information recovered and analyzed.You will see in this study guide, today’s
computer forensics is clearly a new pattern of confidence, acceptance, and analysis.
The Objectives of Computer Forensics
Cyber activity has become an important part of the everyday lives of the general public.
According to the EC-Council, eighty-five percent of businesses and government agencies have
detected a security breach.The examination of digital evidence (media) has provided a medium
for forensic investigators to focus on after an incident has occurred.The ultimate goal of a
computer forensic investigator is to determine the nature and events concerning a crime and to
locate the perpetrator by following a structured investigative procedure.
TEST DAY TIP
Working as a team, computer forensic investigators secure systems and
networks. Computer forensics is one of the three main functions of com-
puter security: the TRIAD consists of vulnerability assessment and risk
management, network intrusion detection, and incident response com-
puter investigations.

break-ins.
■
One of every five Internet sites have suffered a security breach.
Cyber crime includes the following:
■
Theft of intellectual property This pertains to any act that allows access to patent,
trade secrets, customer data, sales trends, and any confidential information.
■
Damage of company service networks This can occur if someone plants a
Trojan horse, conducts a denial of service attack, installs an unauthorized modem, or
installs a back door to allow others to gain access to the network or system.
■
Financial fraud This pertains to anything that uses fraudulent solicitation to
prospective victims to conduct fraudulent transactions.
465_SG_CHFI_01.qxd 10/12/07 12:18 PM Page 4
Damage & Defense…
Computer Forensics in Today's World • Chapter 1 5
■
Hacker system penetrations These occur via the use of sniffers, rootkits, and
other tools that take advantage of vulnerabilities of systems or software.
■
Distribution and execution of viruses and worms These are some of the most
common forms of cyber crime.
Cyber crime comprises three things: tools to commit the crime, targets of the crime
(victim), and material that is tangential to the crime.
Cyber crime is motivated by many different things. Often it’s the thrill of the chase, and a
desire for script kiddies to learn. Sometimes cyber crime is committed by psychologically moti-
vated criminals who need to leave a mark. Other times such crimes are committed by a person
or group that is out for revenge; perhaps it’s a disgruntled employee or friend who wants to
embarrass the target. Most likely, a cyber criminal is being paid to gain information; hackers

case that occurred before any identity theft laws had been passed. The case
involved a woman whose ex-boyfriend was impersonating her online. He cre-
ated an online user profile using her personal information and her picture on a
popular chat site. During his chats, while pretending to be her, he solicited sexual
acts from several men and gave her contact information to them. This informa-
tion included her home address. During several of these online chats, he
described a rape fantasy she wanted to fulfill with the men he was chatting with.
When discussing the case with the prosecutor’s office, the police detectives
brainstormed about the charges they would use. There were no identity theft
laws in place at that time, so the detectives decided to use traditional charges,
including reckless endangerment, aggravated harassment, and impersonation.
Here is an outline of the detectives’ justification for using these statutes:
■
The detectives selected reckless endangerment because the men
were visiting the victim’s home expecting to engage in sexual acts
with her. These acts included the rape fantasy that the suspect
described during the online chats. The reckless endangerment aspect
of this crime was the possibility of some male raping her because of
the described rape fantasy the suspect spoke about. Someone could
have really raped her.
■
The detectives selected aggravated harassment because of the
number of phone calls she was receiving day and night that were
sexually explicit. In New York, it covered the annoying phone calls
the victim was getting.
■
The detectives chose the charge of impersonation because the ex-
boyfriend was pretending to be her. This impersonation included
more than him just pretending to be her online. It included giving
out all of her personal information, along with her picture. Today,

entity whose aim is to destroy a competitor’s reputation.
Stages of Forensic Investigation
in Tracking Computer Crime
A computer forensic investigator follows certain stages and procedures when working on a
case. First he identifies the crime, along with the computer and other tools used to commit
the crime.Then he gathers evidence and builds a suitable chain of custody.The investigator
must follow these procedures as thoroughly as possible. Once he recovers data, he must image,
duplicate, and replicate it, and then analyze the duplicated evidence. After the evidence has
been analyzed, the investigator must act as an expert witness and present the evidence in
court.The investigator becomes the tool which law enforcement uses to track and prosecute
cyber criminals.
For a better understanding of the steps a forensic investigator typically follows, consider the
following, which would occur after an incident in which a server is compromised:
465_SG_CHFI_01.qxd 10/12/07 12:18 PM Page 7
8 Chapter 1 • Computer Forensics in Today's World
1. Company personnel call the corporate lawyer for legal advice.
2. The forensic investigator prepares a First Response of Procedures (FRP).
3. The forensic investigator seizes the evidence at the crime scene and transports it to
the forensic lab.
4. The forensic investigator prepares bit-stream images of the files and creates an MD5
# of the files.
5. The forensic investigator examines the evidence for proof of a crime, and prepares an
investigative report before concluding the investigation.
6. The forensic investigator hands the sensitive report information to the client, who
reviews it to see whether they want to press charges.
7. The FI destroys any sensitive client data.
It is very important that a forensic investigator follows all of these steps and that the pro-
cess contains no misinformation that could ruin his reputation or the reputation of an
organization.
TEST DAY TIP