Computer Forensics-Computer Crime Scene Investigation

---

John Vacca

CHARLES RIVER MEDIA, INC.

Hingham, Massachusetts

Copyright 2002 by CHARLES RIVER MEDIA, INC.

All rights reserved.

No part of this publication may be reproduced in any way, stored in a retrieval system of any type, or transmitted by any means or media, electronic or mechanical, including, but not limited to, photocopy, recording, or scanning, without prior permission in writing from the publisher.

Publisher: David F. Pallai

Production: Tolman Creek Design

Cover Design: The Printed Image

CHARLES RIVER MEDIA, INC.

20 Downer Avenue, Suite 3

Hingham, Massachusetts 02043

781-740-0400

781-740-8816 (FAX)

[e-mail]

www.charlesriver.com

This book is printed on acid-free paper.

John Vacca. Computer Forensics: Computer Crime Scene Investigation.

ISBN: 1-58450-018-2

All brand names and product names mentioned in this book are trademarks or service marks of their respective companies. Any omission or misuse (of any kind) of service marks or trademarks should not be regarded as intent to infringe on the property of others. The publisher recognizes and respects all marks used by companies, manufacturers, and developers as a means to distinguish their products.

Library of Congress Cataloging-in-Publication Data

Vacca, John R.
Computer forensics: computer crime scene investigation / John Vacca.
p. cm.
ISBN 1-58450-018-2
1. Computer security. 2. Computer networks-Security measures. 3.
Forensic sciences. I. Title.
QA76.9.A25 V33 2002
363.25'968-dc21
2002002583

Printed in the United States of America
02 7 6 5 4 3 2 First Edition

CHARLES RIVER MEDIA titles are available for site license or bulk purchase by institutions, user groups, corporations, etc. For additional information, please contact the Special Sales Department at 781-740-0400.

Requests for replacement of a defective CD-ROM must be accompanied by the original disc, your mailing address, telephone number, date of purchase and purchase price. Please state the nature of the problem, and send the information to CHARLES RIVER MEDIA, INC., 20 Downer Avenue, Suite 3, Hingham, Massachusetts 02043. CRM ís sole obligation to the purchaser is to replace the disc, based on defective materials or faulty workmanship, but not on the operation or functionality of the product.

LIMITED WARRANTY AND DISCLAIMER OF LIABILITY

THE CD-ROM WHICH ACCOMPANIES THE BOOK MAY BE USED ON A SINGLE PC ONLY. THE LICENSE DOES NOT PERMIT THE USE ON A NETWORK (OF ANY KIND). YOU FURTHER AGREE THAT THIS LICENSE GRANTS PERMISSION TO USE THE PRODUCTS CONTAINED HEREIN, BUT DOES NOT GIVE YOU RIGHT OF OWNERSHIP TO ANY OF THE CONTENT OR PRODUCT CONTAINED ON THIS CD-ROM. USE OF THIRD PARTY SOFTWARE CONTAINED ON THIS CD-ROM IS LIMITED TO AND SUBJECT TO LICENSING TERMS FOR THE RESPECTIVE PRODUCTS.

CHARLES RIVER MEDIA, INC. ('CRM') AND/OR ANYONE WHO HAS BEEN INVOLVED IN THE WRITING, CREATION, OR PRODUCTION OF THE ACCOMPANYING CODE ('THE SOFTWARE'), OR THE THIRD PARTY PRODUCTS CONTAINED ON THE CD-ROM OR TEXTUAL MATERIAL IN THE BOOK, CANNOT AND DO NOT WARRANT THE PERFORMANCE OR RESULTS THAT MAY BE OBTAINED BY USING THE SOFTWARE OR CONTENTS OF THE BOOK. THE AUTHOR AND PUBLISHER HAVE USED THEIR BEST EFFORTS TO ENSURE THE ACCURACY AND FUNCTIONALITY OF THE TEXTUAL MATERIAL AND PROGRAMS CONTAINED HEREIN; WE, HOWEVER, MAKE NO WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, REGARDING THE PERFORMANCE OF THESE PROGRAMS OR CONTENTS. THE SOFTWARE IS SOLD 'AS IS' WITHOUT WARRANTY (EXCEPT FOR DEFECTIVE MATERIALS USED IN MANUFACTURING THE DISC OR DUE TO FAULTY WORKMANSHIP).

THE AUTHOR, THE PUBLISHER, DEVELOPERS OF THIRD PARTY SOFTWARE, AND ANYONE INVOLVED IN THE PRODUCTION AND MANUFACTURING OF THIS WORK SHALL NOT BE LIABLE FOR DAMAGES OF ANY KIND ARISING OUT OF THE USE OF (OR THE INABILITY TO USE) THE PROGRAMS, SOURCE CODE, OR TEXTUAL MATERIAL CONTAINED IN THIS PUBLICATION. THIS INCLUDES, BUT IS NOT LIMITED TO, LOSS OF REVENUE OR PROFIT, OR OTHER INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THE PRODUCT.

THE SOLE REMEDY IN THE EVENT OF A CLAIM OF ANY KIND IS EXPRESSLY LIMITED TO REPLACEMENT OF THE BOOK AND/OR CD-ROM AND ONLY AT THE DISCRETION OF CRM.

THE USE OF 'IMPLIED WARRANTY' AND CERTAIN 'EXCLUSIONS' VARY FROM STATE TO STATE, AND MAY NOT APPLY TO THE PURCHASER OF THIS PRODUCT.

Acknowledgments

There are many people whose efforts on this book have contributed to its successful completion. I owe each a debt of gratitude and want to take this opportunity to offer my sincere thanks.

A very special thanks to my publisher, David Pallai, without whose initial interest and support would not have made this book possible; and, for his guidance and encouragement over and above the business of being a publisher. Thanks to production coordinator, Kelly Robinson, who provided staunch support and encouragement when it was most needed. Thanks to my copyeditor, Annette R. Pagliaro whose fine editorial work has been invaluable. And a special thanks to Michael Erbschloe, who wrote the foreword for this book. Finally, thanks to all the other people at Charles River Media whose many talents and skills are essential to a finished book.

Thanks to my wife, Bee Vacca, for her love, help, and understanding of my long work hours.

Finally, I wish to thank the organizations and individuals who granted me permission to use the research material and information necessary for the completion of this book.

I thank you all so very much.

To my mystery loving wife Bee

---