Steve Bunting - EnCase Computer Forensics -- The Official EnCE: EnCase Certified Examiner Study Guide

Senior Acquisitions Editor: Jeff Kellum

Development Editor: David Clark

Technical Editors: Jessica M. Bair and Lisa Stewart

Production Editor: Eric Charbonneau

Copy Editor: Kim Wimpsett

Editorial Manager: Pete Gaughan

Production Manager: Tim Tate

Vice President and Executive Group Publisher: Richard Swadley

Vice President and Publisher: Neil Edde

Media Project Manager 1: Laura Moss Hollister

Media Associate Producer: Doug Kuhn

Media Quality Assurance: Marilyn Hummel

Book Designer: Judy Fung

Compositor: Craig Johnson, Happenstance Type-O-Rama

Proofreaders: Jen Larsen and James Saturnio, Word One New York

Indexer: Ted Laux

Project Coordinator, Cover: Katherine Crocker

Cover Designer: Ryan Sneed

Copyright 2012 by John Wiley & Sons, Inc., Indianapolis, Indiana

Published simultaneously in Canada

ISBN: 978-0-470-90106-9

ISBN: 978-1-118-21940-9 (ebk.)

ISBN: 978-1-118-05898-5 (ebk.)

ISBN: 978-1-118-21942-3 (ebk.)

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at www.wiley.com/go/permissions .

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com . For more information about Wiley products, visit www.wiley.com .

Library of Congress Control Number: 2012941757

TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. EnCase and EnCE are registered trademarks of Guidance Software, Inc. for all such names used in the manual. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.

10 9 8 7 6 5 4 3 2 1

Dear Reader,

Thank you for choosing EnCase Computer ForensicsThe Official EnCE : EnCase Certified Examiner Study Guide, Third Edition. This book is part of a family of premium-quality Sybex books, all of which are written by outstanding authors who combine practical experience with a gift for teaching.

Sybex was founded in 1976. More than 30 years later, were still committed to producing consistently exceptional books. With each of our titles, were working hard to set a new standard for the industry. From the paper we print on to the authors we work with, our goal is to bring you the best books available.

I hope you see all that reflected in these pages. Id be very interested to hear your comments and get your feedback on how were doing. Feel free to let me know what you think about this or any other Sybex book by sending me an email at . Customer feedback is critical to our efforts at Sybex.

Best regards,

Neil Edde

Vice President and Publisher

Sybex, an Imprint of Wiley

To Donna, my loving wife and partner for life, for your unwavering love, encouragement, and support.

Any work of this magnitude requires the hard work of many dedicated people, all doing what they enjoy and what they do best. In addition, many others have contributed indirectly, and without their efforts and support, this book would not have come to fruition. That said, many are people deserving of my gratitude, and my intent here is to acknowledge them all.

I would like to first thank Maureen Adams, former Sybex acquisitions editor, who brought me on board with this project with the first edition and tutored me on the fine nuances of the publishing process. I would also like to thank Jeff Kellum, another Sybex acquisitions editor, for his work on the second edition and most recently the third edition. Jeff guided me through the third edition, trying to keep me on schedule and helping in many ways. I would also like to thank David Clark, developmental editor. David allowed me to concentrate on content while he handled the rest. In addition to many varied skills that youd normally find with an editor, David has a strong understanding of topic material and has himself written in the technical field, which helped in so many ways. In addition, with several hundred screen shots in this book to mold and shape, I know there is a graphics department at Sybex deserving of my thanks. To those folks, I say thank you.

A special thanks goes to Jessica M. Bair of Guidance Software, Inc. In addition to being a friend and mentor of many years, Jessica was the technical editor for the first edition and again for the third addition. She worked diligently, making sure the technical aspects of both editions are as accurate and as complete as possible.

I would also thank Lisa Stewart, also of Guidance Software, Inc. Lisa is also a friend and colleague of many years. She reviewed the final material for technical accuracy and, as usual, did a superb job of catching those final details and keeping things as accurate as humanly possible.

The study of computer forensics cant exist within a vacuum. To that extent, any individual examiner is a reflection and product of their instructors, mentors, and colleagues. Through them you learn, share ideas, troubleshoot, conduct research, grow, and develop. Over my career, Ive had the fortune of interacting with many computer forensics professionals and have learned much through those relationships. In no particular order, I would like to thank the following people for sharing their knowledge over the years: Keith Lockhart, Ben Lewis, Chris Stippich, Grant Wade, Ed Van Every, Raemarie Schmidt, Mark Johnson, Bob Weitershausen, John Colbert, Bruce Pixley, Lance Mueller, Howie Williamson, Lisa Highsmith, Dan Purcell, Ben Cotton, Patrick Paige, John DAndrea, Mike Feldman, Mike Nelson, Steve Mahoney, Joel Horne, Mark Stringer, Dustin Hurlbut, Fred Cotton, Ross Mayfield, Bill Spernow, Arnie A. J. Jackson, Ed Novreske, Steve Anson, Warren Kruse, Bob Moses, Kevin Perna, Dan Willey, Scott Garland, and Steve Whalen. Id also like to thank my fellow ATA Cyber instructors who have shared their knowledge and friendship over the past few years while we trained law enforcement officers together around the world. They are Scott Pearson, Steve Williams, Lance Mueller, Art Ehuan, Nate Tiegland, Gerard Myers, Tom Bureau, and Scot Bradeen. Those who teach, learn.