8Key Word Search Displays context of the key word Go through every hit What can you discern about the case?Is it relevant to your case?
9What is lurking in the background Slack Space Free SpaceWhat is lurking in the background
10Windows – DrivesIn Windows drives are specified by a letter followed by a colon.C:, D:, etc.Each drive is either a partition or an actual hard drive.Often referred to as logical drives.
11FilesA File is data that is related, as such it is a logical grouping of data.Files are allocated storage space on a drive when it is created.As a file is used it is allocated more space as needed.File names usually have a first name that is descriptive of its contents.And a second name, the file extension, that indicates the type of file, such as .txt, .pdf, .exe, etc.
12Disk Storage ReviewData is stored on disks one entire sector at a timeA sector is usually 512 bytesIf you use only one byte, the system still provides the other 511 bytes for youA sector is the minimum size read from, or written to, a diskA sector is the minimum I/O unit
13Clusters Space is allocated to a file one cluster at a time A cluster is a fixed number of sectorsMust be a power of 2 (1,2,4,8, )Unused sectors retain the data that was on them prior to allocationA cluster is the minimum file allocation unit
16Slack Space Slack is the space allocated to a file, but unused Space at the end of a sector that remains unused by the fileSectors allocated to the file that the file hasn’t yet usedSlack space often contains useful evidenceUnused bytes in an allocated sector are less usefulUnused sectors in an allocated cluster retain their original contents and are very usefulCurrent operating systems write 0’s in the slack space per sector, often leaving the residual data in the unused sectors in the allocated cluster.
17File Data Slack Space Cluster 1 Cluster 2 Sector 1 Sector 1 Sector 2
18Unallocated ClustersMany clusters on a modern hard drive are unallocatedSome have never contain dataUnallocated clusters may have been allocated earlier though and since been deletedThese clusters retain their data until they are reallocated to a new fileDeleted files are still recoverable!
19Deleting a FAT File Deleting C:taxes.txt Find the FAT, and Data areasLocate taxes.txt in the Directory for C:; determine its starting clusterGo to the FATSet FAT entries for taxes.txt cluster to 0Therefore not allocatedFollow the linksChange filename to axes.txt in C: directoryFirst character becomes 0xE5
20Unallocated SpaceAfter deleting a file the previously allocated clusters become unallocated.They ready to be allocated to some other file.They have not been touched.They still contain the data from the original file.You can recover the data so long it hasn’t been written over by a new file.
21WinHex to the Rescue Presents the file system Lets you look at the individual filesShows files that have been deletedAttempts to recover deleted filesGathers slack space
31Lab Assignment Select keywords and search for them. Gather slack space and commentGather free space and commentSearch free space for keywordsHighlight some of the keyword hits in free spaceBe sure you comment on the relevance of your discovered evidence on the charges