Rock Around the Clock - SANS Computer Forensics

computer.forensics.sans.org

Rock Around the Clock - SANS Computer Forensics

!"#$%&#'&()*#"*%+#+%,%-#'./0-)''1#2%%0#343$#-%45##


6&7)*8.'%*#39#:.'023;'#

#


3'9#

#


?@.-A'#9@39#3--%$#+)5#


!9#43'#+3243*)#

!#43'#@3/0)B#

C$#/39#B.B#.9#

!9#43'#D%B#

!9#43'#32.)-'#

E$)'1#*)322$F#


G#"38%&*.9)#/3')#%"#+.-)5#


D&$#@3'#/%+73-$#2379%7#

D&$#'&*"'#7%*-#E322)A)B2$F#

D&$#A)9'#H*)B#

D&$#'&)'#/%+73-$#

I%+73-$#@.*)'#+)#


C$#H-B.-A'J#


?@.'#A&$#2.0)'#@.'#7%*-5#

G#2%9K#

#

#

#

K-%9#3-#3/9&32#L&%9)#"*%+#+$#*)7%*9#


D&$#@.*)'#/%+7&9)*#"%*)-'./#)M7)*9#


N59@)#O!P6#/2%/0#/%&2B#;)#+3-&322$#')9#;3/05#P-/)#

9@)#/%+7&9)*#.'#*);%%9)B1#9@)#%7)*3,-A#'$'9)+#4.22#

930)#.9'#/&**)-9#,+)#"*%+#9@)#O!P6#/2%/0#3-B#3-$#H2)'#

/*)39)B#%*#/@3-A)B#9@)*)3Q)*#4.22#*)R)/9#9@)#E7*)S

B39)BF#,+)#3'#'))-#;$#9@)#%7)*3,-A#'$'9)+5#


N?@)*)#.'#-%#'.+72)#43$#%"#9)22.-A#4@)9@)*#3#

/%+7&9)*T'#O!P6#/2%/0#@3'#;))-#U9&*-)B#;3/0T1#

)'7)/.322$#."#.9#43'#'&;')L&)-92$#*)')9#9%#9@)#/%**)/9#

,+)VW#


X*%8.B)#)M3+72)'#%"#/2%/0#/@3-A)'#

D)9#$% %#9@.-0#

Y)B&/)#=Z:#


=.2)#!B)-,H)*[C=?#\-9*$#

G2+%'9#)8)*$#H2)["%2B)*#%-#]?=6#@3'#3#&-.L&)#-&+;)*#

]&+;)*#.'#;3')B#%-#C=?#)-9*$#

])4#H2)'#3*)#!"!#$$%#/*)39)B#.-#')L&)-/)#


=.2)#!B)-,H)*[C=?#\-9*$#

P*B)*#H2)'#;$#/*)3,%-1#9@)-#.B)-,H)*#

6+322#B.'/*)73-/.)'#3*)#-%*+32#

^3*A)#B.'/*)73-/.)'#*)L&.*)#"&*9@)*#.-8)',A3,%-#


?)/@-%2%A./32#GB83-/)+)-9#

:%/&+)-9#+)93B393#

\_!=#B393#

=.2)#'$'9)+'#

#


=.2)#6$'9)+#

`@)*)#%-#9@)#B*.8)#.'#9@)#B393#2%/39)BJ#

#


\8)-9#^%A'#

:)"3&29#%"#abcdO#.-#_X1#ceCO#.-#f.'931#`.-g#

6)L&)-,322$#4*.h)-#

P8)*4*.h)-#"*%+#'93*9#4@)-#"&22#

\8)-9#!:'#

:39)[?.+)#'93+7#

#


_X#

\8)-9#!:#ace#.-#')/&*.9$#2%Ai#

N?@)#'$'9)+#,+)#43'#/@3-A)BW#

#

?@.'#2)8)2#%"#3&B.,-A#.'#%(#;$#B)"3&29#

#


f.'931#`.-g#

\8)-9#!:#b#.-#'$'9)+#2%Ai#

N?@)#'$'9)+#,+)#@3'#/@3-A)B#9%#

cebbSebSeb?eeieeieeVeeeeeeeeej#"*%+#

cebbSe>Seb?beibgie>VbkgckckeejW#

\8)-9#!:#>lbl#.-#')/&*.9$#2%A#

N?@)#'$'9)+#,+)#43'#/@3-A)BW#

#


m%&*-32#

=%&-B#.-#9@)#nm#'9*)3+#%"#nZ'-m*-2#

C3$#%-2$#@%2B#")4#@%&*'#%*#B3$'#%"#B393#

6)L&)-,322$#'9%*)B#

Y)/%*B'#)8)*$#H2)#9*3-'3/,%-#%-#9@)#H2)#'$'9)+#


m%&*-32#

!


m%&*-32#

!"#$%&'$( )&*$(&%+(,"'$(

')9&737.V377V2%A# kb[ea[cebb#bkika#

:^^ikl#

YZ]:^^kcV\_\S:lbc\:gbV7"# eo[eb[cebe#bbieb#

23&-/@$V.-.# eo[eb[cebe#bbiek#

CPO6q]IV\_\SIa\ccp>=V7"# eo[eb[cebe#bbiba#

.-B)MVB39# kb[ea[cebb#bkiak#

?G6d


m%&*-32#

!"#$%&'$( )&*$(&%+(,"'$(

')9&737.V377V2%A# kb[ea[cebb#bkika#

:^^ikl#

YZ]:^^kcV\_\S:lbc\:gbV7"# eo[eb[cebe#bbieb#

23&-/@$V.-.# eo[eb[cebe#bbiek#

CPO6q]IV\_\SIa\ccp>=V7"# eo[eb[cebe#bbiba#

.-B)MVB39# kb[ea[cebb#bkiak#

?G6d


^.-0#=.2)'#

C)3-.-A#%"#^V!V=V\#E


^.-0#=.2)'#


Y)'9%*)#X%.-9'#

_X#*)'9%*)#7%.-9'#-3+)B#')L&)-,322$#

-$.*/0$(1/"%*( 20$&3/%()&*$4,"'$( -$.*/0$(1/"%*(5&'$(

YXbkb# bgic>ibp#be[ek[cebb# 6$'9)+#I@)/07%.-9#

YXbkc# bpiepiko#bb[ek[cebb# 6$'9)+#I@)/07%.-9#

YXbkk# bgibgiag#b>[ek[cebb# !-'93223,%-#%"#D%%A2)#I@*%+)#

YXbk># bli>licc#bb[ec[cebb# !-'93223,%-#%"##C%r.223#=.*)"%M#

YXbka# beiekibc#ba[ek[cebb# 6$'9)+#I@)/07%.-9#

YXbkl# beik>ieo#ba[ek[cebb# !-'93223,%-#%"#C./*%'%Q#Ps/)#


Y)'9%*)#X%.-9'#

_X#*)'9%*)#7%.-9'#-3+)B#')L&)-,322$#

-$.*/0$(1/"%*( 20$&3/%()&*$4,"'$( -$.*/0$(1/"%*(5&'$(

YXbkb# bgic>ibp#be[ek[cebb# 6$'9)+#I@)/07%.-9#

YXbkc# bpiepiko#bb[ek[cebb# 6$'9)+#I@)/07%.-9#

YXbkk# bgibgiag#b>[ek[cebb# !-'93223,%-#%"#D%%A2)#I@*%+)#

YXbk># bli>licc#bb[ec[cebb# !-'93223,%-#%"##C%r.223#=.*)"%M#

YXbka# beiekibc#ba[ek[cebb# 6$'9)+#I@)/07%.-9#

YXbkl# beik>ieo#ba[ek[cebb# !-'93223,%-#%"#C./*%'%Q#Ps/)#


6@3B%4#f%2&+)'#

f.'93[g#0))7#377*%M#ce#f6I'#;)"%*)#*)/$/2.-A#9@)+#

P&9#%"#')L&)-/)#f6I#+3$#;)#3#/2&)#

f6I#DZ!:'#3*)#'.+.23*2$#-3+)B#"%*#'7)/.H/#,+)'#

G-$#&-&'&322$#-3+)B#f6I'J#


6@3B%4#f%2&+)'#


`);#X3A)'#

=%*&+'#

])4'['7%*9'#'.9)'#

O2%A'#


`);#X3A)'#


`);#X3A)'#

D%%A2)#X2&'#E4@39T'#9@39JF#

\8)*$#2.-0#,+)S'93+7)B#`


`);#X3A)'#

D%%A2)#X2&'#E4@39T'#9@39JF#

\8)*$#2.-0#,+)S'93+7)B#`


!-B)MVB39#=.2)'#

]%9#')L&)-,32#

I@)/0#.-9)*-)9#')y-A'#

^3*A)#/2%/0#/@3-A)'#)3'.)*#9%#B)9)/9#


\+3.2#C)''3A)'#

C6D[\C^#H2)#@3'#3#/*)3,%-#B39)#%"#C3$#bg#cebb#

!'#.9#3//&*39)J#

MIME-Version: 1.0 Received: by 10.68.14.37 with SMTP

id m5mr1406525pbc.474.1307239107883; Sat, 04 Jun

2011 18:58:27 -0700 (PDT) Sender:

harry@hogwarts.ac.uk Received: by 10.68.66.136 with

HTTP; Sat, 4 Jun 2011 18:58:27 -0700 (PDT) Date:

Sat, 4 Jun 2011 20:58:27 -0500 X-Google-Sender-Auth:

WiTe_KdGL5stt8fvjLC6pdnkRtY Message-ID:


Subject: Cloak of Invisibility From: Harry Potter

To: Hermione

Granger, Ron

Weasley

#


\+3.2#C)''3A)'#

C6D[\C^#H2)#@3'#3#/*)3,%-#B39)#%"#C3$#bg#cebb#

!'#.9#3//&*39)J#

MIME-Version: 1.0 Received: by 10.68.14.37 with SMTP

id m5mr1406525pbc.474.1307239107883; Sat, 04 Jun

2011 18:58:27 -0700 (PDT) Sender:

harry@hogwarts.ac.uk Received: by 10.68.66.136 with

HTTP; Sat, 4 Jun 2011 18:58:27 -0700 (PDT) Date:

Sat, 4 Jun 2011 20:58:27 -0500 X-Google-Sender-Auth:

WiTe_KdGL5stt8fvjLC6pdnkRtY Message-ID:


Subject: Cloak of Invisibility From: Harry Potter

To: Hermione

Granger, Ron

Weasley

#


?@&+;-3.2'#

_X#z#%-)#*)7%'.9%*$#"%*#)3/@#"%2B)*#

f.'93[`.-g#z#%-)#"%*#322#"%2B)*'#

O%9@#'9%*)#.9)+'#')L&)-,322$#


?@&+;'VB;#

67.$*(89:*$.;( !"#$(5&'$(


?@&+;'VB;#

67.$*(89:*$.;( !"#$(5&'$(


?@&+;'VB;#

?@.'#CGq#;)#B&)#9%#3#/2%/0#/@3-A)#

=.2)#+3$#@38)#;))-#+%8)B[)B.9)B#

^%%0#"%*#/%**%;%*3,-A#)8.B)-/)#


?@&+;/3/@)VB;#

67.$*(89:*$.;( 20$&3/%(60"?"%&#(1"@*A0$(

bel# bc[ea[bb#bgi>cikb#

cgpoe# bc[ea[bb#bgi>cikp#

aalg># bc[ea[bb#bgi>ci>k#

pk>ap# bc[ea[bb#bgi>ciaa#

bbe>g># bc[ea[bb#bgi>kieg#

b>aaa># bb[ec[bb#bbiekial#

bgkgcc# bb[ec[bb#bbie>ie>#

oc>g>c# bc[ea[bb#bgi>licc#

oa>elc# bc[ea[bb#bgi>licg#


?@&+;/3/@)VB;#

67.$*(89:*$.;( 20$&3/%(60"?"%&#(1"@*A0$(

bel# bc[ea[bb#bgi>cikb#

cgpoe# bc[ea[bb#bgi>cikp#

aalg># bc[ea[bb#bgi>ci>k#

pk>ap# bc[ea[bb#bgi>ciaa#

bbe>g># bc[ea[bb#bgi>kieg#

b>aaa># bb[ec[bb#bbiekial#

bgkgcc# bb[ec[bb#bbie>ie>#

oc>g>c# bc[ea[bb#bgi>licc#

oa>elc# bc[ea[bb#bgi>licg#


P77%'.-A#)M7)*9#/%-/)B)B#

C$#/2.)-9#4%-#9@)#/3')#3-B#/%'9'#

\8.B)-/)#B)=Z:.H)B#


^))#`@.{.)2B#

"%*)-'./>/3'9V/%+#

|2))x4@.{.)2B#

?@3-0S$%&#

More magazines by this user
Similar magazines