Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
Windows NTFS Log File..............................................................................................28
TMP, BAK and Spool Files..........................................................................................28
Windows Registry .......................................................................................................30
Cookies ........................................................................................................................30
Application Metadata ..................................................................................................31
Hidden Data..................................................................................................................32
Shadow Data................................................................................................................33
Other Revealing Data ..................................................................................................33
Contextual Analysis ....................................................................................................34
Going, Going, Gone.....................................................................................................34
Bit Stream Backup.......................................................................................................35
Now What?...................................................................................................................36
Forensic Imaging Should Be Routine........................................................................37
Answers to Frequently Asked Questions about Forensic Imaging ........................37
Steps to Preserve the Evidence .................................................................................40
What’s It Going to Cost?.............................................................................................41
Who Pays? ...................................................................................................................42
Is Digital Different?......................................................................................................42
Shifting Costs: The Rowe and Zubulake Decisions .................................................44
The Rough Road Ahead..............................................................................................45
Note to Readers:
This article focuses on technical matters impacting the cost, complexity and scope of
e-discovery, rather than the burgeoning case law. For extensive resources on
electronic discovery law, please look at other materials available at www.craigball.com
and visit the following helpful sites:
K&L Gates Electronic Discovery Law Site
http://www.ediscoverylaw.com/
Berkman Center for Internet & Society at Harvard Law School
http://cyber.law.harvard.edu/digitaldiscovery/library.html
Discovery Resources
http://discoveryresources.org/
For extensive links to further information about computer forensics, visit:
The Electronic Evidence Information Center
http://www.e-evidence.info/index.html
Page 5