Filesystem

!"

#
$

%

$

#

&
'

(

!

"

)* #

&+

!

#

(

"
!
!

#
$ !%
!

!

"

)!
$

"
(

(

&

'

!

"

),

(

* %*

(

$

#

)

&'. (
&
!

"

/.(
)

"

) !0

#
!

$
#
#
!

*

2

!

"

)

+

"

)

("

0

+

!

* %. (

#

&&
&'
!

"

)

(

,

-

,
*
,
#
#

.!/

,

!

"

1
)

2!

"

,
*
,
$

!

"

)

, 0,
#1

2*

((

,
$

,
#
"
2

,

"

3

!

"

) 32

"
!

!

"

,

*,
*, "
$

#

#
3

#

!

"

) 32

"

) 32

,
*
,
#
$

!

,

*

((

#

3#
,

!

*

,

"

/4
)5

4
5

!

"

)4
5

4
5

*

"

,
*
,
#
$

!

((

+

4"
3

#
"
2

'
4

!

"

)6

6

!

"

)6

6

*

"

,
*
,
$

!

((

)5
,
)1
,
+
) 5+
,
) 1+
,
,
)5
,
)1
,
) 1"
,
3

#
"

"
"

5 )2

(

7

("

6
#

5

Copyright

Many of the designations used by manufacturers and sellers to distinguish their products are
claimed as trademarks. Where those designations appear in thisbook, and the publisher was
aware of a trademark claim, the designations have been printed with initial capital letters or in
all capitals.
The author and publisher have taken care in the preparation of this book, but make no
expressed or implied warranty of any kind and assume no responsibility for errors or
omissions. No liability is assumed for incidental or consequential damages inconnection with
or arising out of the use of the information or programs contained herein.
The publisher offers excellent discounts on this book when ordered in quantity for bulk
purchases or special sales, which may include electronic versions and/or custom covers and
content particular to your business, training goals, marketing focus, and branding interests.
For more information, please contact:U. S. Corporate and Government Sales
(800) 382-3419
corpsales@pearsontechgroup.com
For sales outside the U. S., please contact:
International Sales
international@pearsoned.com
Visit us on the Web: www.awprofessional.com
Library of Congress Catalog Number: 2004116962
Copyright © 2005 Pearson Education, Inc.
All rights reserved. Printed in the United States of America. This publication isprotected by
copyright, and permission must be obtained from the publisher prior to any prohibited
reproduction, storage in a retrieval system, or transmission in any form or by any means,
electronic, mechanical, photocopying, recording, or likewise. For information regarding
permissions, write to
Pearson Education, Inc.
Rights and Contracts Department
One Lake Street
Upper Saddle River, NJ07458
ISBN 0-32-126817-2
Text printed in the United States on recycled paper at R. R. Donnelley in Crawfordsville,
Indiana.
First printing, March 2005

Dedication

THIS BOOK IS DEDICATED TO MY GRANDPARENTS, HENRI, GABRIELLE, ALBERT, AND RITA

6

Foreword

Computer forensics is a relatively new field, and over the years it has been called many
things: "computer forensics," "digitalforensics," and "media analysis" to name a few. It has
only been in the past few years that we have begun to recognize that all of our digital devices
leave digital breadcrumbs and that these breadcrumbs are valuable evidence in a wide range
of inquiries. While criminal justice professionals were some of the first to take an interest in
this digital evidence, the intelligence, informationsecurity, and civil law fields have
enthusiastically adopted this new source of information.
Digital forensics has joined the mainstream. In 2003, the American Society of Crime
Laboratory Directors–Laboratory Accreditation Board (ASCLD–LAB) recognized digital
evidence as a full-fledged forensic discipline. Along with this acceptance came increased
interest in training and education in this...