Index_F

F

Farmer, Dan, 179

FastBloc, 70

FAT16, 38

FAT32, 38

FBI National Computer Crime Squad, 249

fdisk command, 118, 269

Federal Guidelines for Searching and Seizing Computers, 44

Federal Rule of Civil Procedure , 196

rule 26, 269

feedback, from judge and jury, 235

ffind tool (Sleuth Kit), 180

File Allocation Table (FAT), 38-39 , 269

file extensions, 154

comparing with data type, 87

file name layer, 180

file system layer, 180

File Transfer Protocol (FTP), 56, 125

file viewers , 86 , 269

in Forensic Toolkit, 175, 175

Quick View Plus File Viewer, 186

ThumbsPlus File Viewer, 187 , 187

files

computer generated names , 154-155

deleted, 126-127

unerase tool to recover, 87

filesystems, 38-40 , 269

FAT/NTFS, 38-39 , 39

maintaining tools and procedures for, 40

Unix/Linux, 39-40

financial institutions, security for personal information collected, 10

finding passwords, 127-129 , 141-142

findkey program (Coroner's Toolkit), 179

fingerprints , 75

FireWire, 34 , 269

floppy disk

bootable, 103

evidence on, 136-137

floppy drive, 25, 269

expectation of privacy, 43

fls tool (Sleuth Kit), 180

forensic compression, 105, 269

forensic duplicate, 104

"Forensic Examination of Digital Evidence: A Guide for Law Enforcement", 198

Forensic Replicator, 166 , 166-167 , 178

Forensic SF-5000, 104

Forensic Sorter, 178

forensic suite, 269

Forensic Toolkit (AccessData FTK), 63, 77, 113, 119 , 174-177 , 175

forensic tools

CD analysis utilities, 263-264

CD/DVD Inspector, 264

IsoBuster, 263

disk imaging and validation tools, 162-172

ByteBack, 113, 163 , 163

dd utility, 112, 164 , 164 , 268

DriveSpy, 165 , 185

EnCase, 165-166 . See also EnCase

Forensic Replicator, 166 , 166-167 , 178

FTK Imager, 167 , 167-168

Norton Ghost, 104, 168 , 250

ProDiscover, 168-169 , 169

SafeBack, 113, 170

SMART, 170 , 170-171 , 250

WinHex, 98, 105 , 112, 171-172 , 251, 273

graphic viewing utility, 265

Quick View Plus File Viewer, 265

hardware, 187-190 , 265

Forensic Recovery of Evidence Device, 188-189

Vogon Forensic Software, 189-190

Metadata Assistant, 264

Metadata Viewer Utility, 264

miscellaneous, 184-187

DiskJockey File Viewer, 185

DriveSpy, 185

dtSearch, 185-186

Quick View Plus File Viewer, 186

Text Search Plus, 186-187

ThumbsPlus File Viewer, 187

password-cracking utilities, 262-263

ElcomSoft, 263

Passware, 262-263

software suites, 172-184

AccessData Ultimate Toolkit (UTK), 261

Coroner's Toolkit (TCT), 179

EnCase, 172-174 , 173 . See also EnCase

Forensic Toolkit (FTK), 63, 77, 113, 119 , 174-177 , 175

Forensicware, 262

Maresware, 114, 177-178 , 261-262

Paraben, 178-179 . See also Paraben Corporation

ProDiscover, 168-169 , 169 , 182 , 182

Sleuth Kit (TSK), 180-181

Vogon Forensic Software, 183 , 183

X-Ways Forensics, 184 , 262

forensically sound, 104, 269

Forensicon, Inc., 250

forensics experts, disclosure of identities, 196

forensics toolkit, 100 , 100, 190-192

real world scenario, 191

Forensicware, 262

Forentech, LLC, 250

Forentech Security Solutions, 250

format command, 103

former employees , access to computers, 29

Fourth Amendment, 44

fsstat tool (Sleuth Kit), 180

FTK Imager, 167 , 167-168

full volume images, 96-109

collecting volatile data, 100-103

data extraction from PDAs, 107-108

evidence collection order, 96-97

hard disk drive duplication, 103-107

image and tool documentation, 108-109

media and tools preparation, 97-100