- Introduction: The Whistle-Blower
- Preparation
- Evidence Collection and Chain of Custody
- Drive Imaging
- Review of the Logical File Structure
- Review of Unallocated Space and File Slack
- Smoking Gun
- Reporting
- Lessons Learned
This chapter is from the book
This chapter is from the book
This chapter is from the book
15.5 Review of the Logical File Structure
After imaging the suspect hard drives, we reviewed the logical file structure. To facilitate this process, our team used the EnCase Forensic Edition software. This is a licensed software tool. By using our Linux servers, previously used for hard drive imaging, as file servers (utilizing Samba as the mechanism for file sharing), our Windows-based analysis machines could access the raw data files that contained images of our suspects' hard drives.
With EnCase as our tool, we opened each raw data file and began our analysis. EnCase has the built-in technology to read the file and present the data as if it were actually connected to a hard drive. The view that is represented is similar to what an average Windows-based computer user sees when accessing the Windows Explorer utility (see Figure 15.2).
)
Figure 15.2 EnCase Logical File Structure Review
A review of logical file structure involves both automated and manual procedures. The computer forensic software being utilized facilitates the automated procedures. By using EnCase, we were able to search through the directories of the suspect's computer system and quickly locate any files that seemed pertinent to our investigation. As a follow-up method, we looked through the directories manually to identify any files that might not have been detected during our automated search with EnCase.
Each file we located that was deemed pertinent to our investigation was copied to the analysis drive, to be included in our computer forensic analysis report. When performing this step it is important to record the logical address of the file. This is the full path name; for example, the full path name of the System32 directory on many Windows NT/2K/XP computers is C:\Winnt\System32.