![Page 1: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/1.jpg)
Digital Forensics
David Papargiris, EnCE,
DFCP,GCFA,CCE
Director Digital Forensics
Evidox Corporation
![Page 2: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/2.jpg)
EDMOND LOCARD
French forensic pioneer
Locard’s Exchange Principle
"Wherever he steps, wherever he touches, whatever he leaves, even without consciousness, will serve as a silent
witness against him. Not only his fingerprints or his footprints, but his hair, the fibers from his clothes, the glass he
breaks, the tool mark he leaves, the paint he scratches, the blood or semen he deposits or collects. All of these and
more, bear mute witness against him. This is evidence that does not forget. It is not confused by the excitement of
the moment. It is not absent because human witnesses are. It is factual evidence. Physical evidence cannot be wrong,
it cannot perjure itself, it cannot be wholly absent. Only human failure to find it, study and understand it, can
diminish its value."
Locard’s Exchange Principle
* The Illustrated guide to Forensics - True Crime Scene Investigations By Dr. Zakaria Erzinclioglu
![Page 3: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/3.jpg)
Increase in Cybercrimes
• First time Cybercrime surpassed
traditional crimes.
• Increase of computers in houses
• Increase in pay-off (Ex. Bank Robbery)
• Crimes being committed through
computers
![Page 4: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/4.jpg)
How Times Have Changed
• It took 38 years for 50 Million users to use the
radio.
• It took 13 Years for 50 Million users to use a
television.
• It took 4 years to have 50 million users on the
internet.
• It took 9 months for 100 million users to register on Facebook.(1.11 billion March 2013)
(www.tactweet.com)
![Page 5: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/5.jpg)
When was first Computer Monitor and Mouse Available
![Page 6: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/6.jpg)
CYBER CRIME INVESTIGATIONS
Case Examples
![Page 7: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/7.jpg)
CASE EXAMPLES
• DENNIS RADER
THE “BTK KILLER”
• Killed 10 in 30 years
• Sent floppy disk to police
• Contained metadata
source: www.wikipedia.com
![Page 8: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/8.jpg)
![Page 9: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/9.jpg)
![Page 10: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/10.jpg)
9) Volume D\Unallocated Clusters\C384554-385932
Ventus International Agency Letter dated 12-13-00 to John Hancock
Dec. 18, 2000 Gd.Pl.
To: John Hancock Life Insurance Company, Boston, MA 02117
Ref: Edward Cxxxxx VS xxxxxxx in ATTLEBORO DISTRICT COURT,
Attleboro, MA 02703, Docket # 00xx SC xxxx,
(see attachment)
Gentlemen!
Based on our two-year observation, your Company TOP insurance
underwriters of LONGTERM CARE INSURANCE DEPARTMENT at Boston,
MA, indicates’ that there may evaluate Insurance Applications
under influence of DRUGS- MARIJUANA (Marihuana). With-in your
building there is also intensive DRUG TRAFFICING going for
years! We also noticed that do to heavy volume of applicants,
you allow your underwriters evaluate The Cases OUT SITE your
Home Office on their free time and weekends at their homes in
order to increase Department Productivity or Deadlines!
![Page 11: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/11.jpg)
• Convicted for murders of
co-workers
• Internet searches related to faking mental illness
©2010 Office of Massachusetts Attorney General Martha Coakley
MICHAEL “MUCKO” MCDERMOTT
![Page 12: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/12.jpg)
![Page 13: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/13.jpg)
Serial Killer Caught By His
Own
Internet Footprint
By Peter Shinkle
St. Louis Post-Dispatch
6-17-2001
Travis decided it was a good idea to
point authorities to the decomposing
body of an undiscovered victim near
West Alton, Missouri, by sending
directions to the local paper St. Louis
Post-Dispatch, which was later found to
have come from Expedia.com. Maury Travis
![Page 14: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/14.jpg)
Leon v. IDX Systems - A case relying heavily on computer forensic analysis in determining that the plaintiff despoiled evidence by deleting 2,200 files from his IDX-issued laptop computer during the pendency of litigation in which the plaintiff was suing his employer, the defendant, for placing him on unpaid leave, alleging violations of the anti-retaliation provision of the False Claims Act, Title VII, the Americans with Disabilities Act ("ADA"), and Washington state law.
Civil Case Examples
Berryman-Dages v. Gainesville - A case in which a non-party who was subpoenaed for examination of computers, laptops, hard drives, etc., to aid in showing that the plaintiff was demoted due to discrimination based on gender and sexual orientation
http://infosecusa.com/computer-forensics-civil-cases
![Page 15: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/15.jpg)
Webb v. CBS - In this case the defendant, CBS, was compelled to hire a computer forensics expert to examine the plaintiffs' personal computer and review the results due to the plaintiffs' failure to comply with their discovery obligations under the Federal Rules of Civil Procedure, for providing misleading statements in depositions and false affidavits to the court about the existence of discoverable information, for their counsel's active concealment of confidential CBS documents, and for violation of the court's order closing discovery.
Civil Case Examples
Bimbo Bakeries v. Botticella - A case that relied on the use of computer forensics to determine if the appellant, a VP of Operations, copied company confidential files onto his personal computer before leaving his job to work for a competitor
http://infosecusa.com/computer-forensics-civil-cases
![Page 16: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/16.jpg)
EXIF & GEO TAGGING
![Page 17: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/17.jpg)
©2007 Office of
Massachusetts Attorney
General Martha Coakley
![Page 18: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/18.jpg)
©2007 Office of
Massachusetts Attorney
General Martha Coakley
![Page 19: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/19.jpg)
![Page 20: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/20.jpg)
![Page 21: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/21.jpg)
![Page 22: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/22.jpg)
![Page 23: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/23.jpg)
![Page 24: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/24.jpg)
![Page 25: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/25.jpg)
![Page 26: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/26.jpg)
![Page 27: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/27.jpg)
Defining Digital Forensics
![Page 28: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/28.jpg)
Digital forensics is the controlled process of identifying, preserving, analyzing, and
presenting findings related to the existence or significance of data stored on digital storage
media, computers, and other devices for use in court.
DEFINING DIGITAL FORENSICS
![Page 29: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/29.jpg)
• Science – Some procedures repeatable
– Imaging
• Art – No two examinations are the same
– Two examiners should get same data
DIGITAL FORENSICS ART OR SCIENCE?
![Page 30: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/30.jpg)
• We can recover everything
• It’s quick and easy
• A ‘shoestring’ budget is sufficient
• Data will never change during an exam
DIGITAL FORENSICS MYTHS
![Page 31: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/31.jpg)
Hard Drive Storage
How does a computer system load and store
data?
Allocated and unallocated space
Slack Space
![Page 32: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/32.jpg)
Slack Space
Think of a vcr Tape.
![Page 33: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/33.jpg)
• Create duplicate of the media
• Verify that the image is an exact duplicate
• Backup the image
• Place original into evidence
• Use forensic software to conduct analysis
DIGITAL FORENSICS BASIC PROCEDURES
![Page 34: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/34.jpg)
FORENSIC PROCESS
• Documenting the evidence
• Is the system running (Memory)
• Checking the BIOS on computer Systems
• Conducting the bit by bit image of the media
• Why do we conduct bit by bit images
• Solid State Hard Drives
![Page 35: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/35.jpg)
Write Blockers
• 2 Types of write blockers
• Hardware
• Software
![Page 36: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/36.jpg)
Write Blockers
![Page 37: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/37.jpg)
Solid State Hard Drives
![Page 38: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/38.jpg)
Encase & Example of Solid State Drives
Deleted Folder
![Page 39: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/39.jpg)
Preview of Drive 2 Minutes Later
Garbage Collection
![Page 40: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/40.jpg)
Authenticating Evidence
Hash Values
![Page 41: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/41.jpg)
• A hash value is a digital fingerprint of a block of data (file, string, contents of media, etc.)
• The chances of two different files having the same hash value are 1in 2^128
• One in approximately 340 billion billion, billion, billion
• In other words, if the hash values are the same, then there’s a 99.99999% chance that the files are the same
Better than DNA
AUTHENTICATING EVIDENCE
![Page 42: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/42.jpg)
![Page 43: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/43.jpg)
![Page 44: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/44.jpg)
![Page 45: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/45.jpg)
![Page 46: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/46.jpg)
What Happens When You Rename a File
![Page 47: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/47.jpg)
![Page 48: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/48.jpg)
Or Rename The Extension
![Page 49: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/49.jpg)
![Page 50: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/50.jpg)
File "F:\Wellesley\WELLESLE.E01" was acquired by Detective Papargiris at 02/21/02
06:40:56PM.
The computer system clock read: 02/21/02 06:40:56PM.
Evidence acquired under DOS 7.10 using version 3.19.
File Integrity:
Completely Verified, 0 Errors.
Acquisition Hash: 88F7BA9EBE833EEDC2AF312DD395BFEC
Verification Hash: 88F7BA9EBE833EEDC2AF312DD395BFEC
Drive Geometry:
Total Size 12.7GB (26,712,000 sectors)
Cylinders: 28,266
Heads: 15
Sectors: 63
Partitions:
Code Type Start Sector Total Sectors Size
0C FAT32X 0 26700030 12.7GB
![Page 51: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/51.jpg)
Digital Forensic Stages
IDENTIFY
PRESENT
PRESERVE
RECOVER
![Page 52: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/52.jpg)
Example
![Page 53: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/53.jpg)
In Explorer Window
![Page 54: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/54.jpg)
Deleted View
![Page 55: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/55.jpg)
![Page 56: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/56.jpg)
Digital Forensic Equipment
![Page 57: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/57.jpg)
Imaging Device
![Page 58: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/58.jpg)
Forensic
Workstation &
Storage
System
![Page 59: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/59.jpg)
Mobile Devices
![Page 60: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/60.jpg)
GPS’s
![Page 61: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/61.jpg)
![Page 62: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/62.jpg)
![Page 63: Digital Forensics - Boston Ediscovery Summitbostonediscovery.com/.../09/David-Papargiris-Digital-Forensics.pdf · IDX Systems - A case relying heavily on computer forensic analysis](https://reader033.vdocuments.site/reader033/viewer/2022051601/5ad239777f8b9a92258cd5d3/html5/thumbnails/63.jpg)
QUESTIONS