Index_P

P

.pab file extension, 126

packets, 124, 125, 271

tracking path , 101

PAGEFILE.SYS file, trace evidence in, 136

Palm dd, 108, 115

palmtops. See personal digital assistant (PDA)

paper format, for electronic evidence, 196

Paraben Corporation, 178-179 , 250

Case Agent Companion, 178, 214, 217

Forensic Replicator, 166 , 166-167

Lockdown, 167

partial volume image, 109-111

partitions

ByteBack to rebuild, 163

hidden, 134

identifying, 118

passcode, 150, 271

Passware, 262-263

password-cracking utilities, 262-263

ElcomSoft, 263

Passware, 262-263

passwords, 140-146 , 271

cracking, 143-146 , 271

deducing , 142-143

finding, 127-129 , 141-142

for Jaz drive, 25-26

social engineering to obtain, 16-17, 122

payload, 151

PDA Seizure, 179

PDAZap, 115

PDBLOCK, 70

personal computer (PC), 23

personal digital assistant (PDA), 24-25 , 271

data extraction from, 107-108

evidence on, 54

Paraben tools for, 178

power requirements, 92-93

PGP, 157-158

Phoenix Technologies, 107

PhotoCrypt, 152

photographs, 200

of evidence's original state, 61

for scene documentation, 74

value of, 53-54

PkCrack utility, 158

PKZIP, 155

PKZip Cracker, 155

plaintext, 148, 271

Pockey drive, 32

pop-up web pages, 120

port scanner, 129, 271

portable laptop drive, 32

Post Office Protocol (POP), 125

power supply, 82-83

loss, and data corruption, 81

PowerPoint presentation, 91, 234

preparation

hardware knowledge, 22-35 . See also hardware

incident response team (IRT) development, 45-47

clarity of processes, 46-47

coordination with law enforcement, 47

organization, 46

limits awareness, 42-45

legal organizational rights and limits, 43

likelihood of court proceedings , 45

search and seizure guidelines, 44-45

operating system knowledge, 35-42 . See also operating systems

presentation of evidence, 88-92

audience characteristics, 89-91

organization of, 91

simplicity in, 92

use of technology for, 92, 234-235

preservation of evidence, 80-84

handling live system, 81-82

initial state, 83-84

power supply, 82-83

privacy, expectation of, 43

and search warrant , 44

private key algorithm, 147, 148-150 , 271

processes, list of running, 102

ProDiscover, 168-169 , 169 , 182 , 182

Professional Certified Investigator (PCI), 258-259

profile in Windows, 119

programming bomb, 7

proprietary information, stealing, 4-5

protocols, 123, 125, 271

PsService, 102, 102

.pst file extension, 126

public key algorithm, 148, 150-151 , 271

publicity, 47

.pwl file extension, 128