1. (Discussion and WS – Analysis of Electronic Data)
Wednesday April 25, 2018
(Discussion and WS – Analysis of Electronic Data)

2. What is the purpose of a computer’s “operating system (OS)?”
The Daily CSI
Wednesday, 4/25/18
1/1
What is the purpose of a computer’s “operating system (OS)?”
A computer’s OS provides the user with a working environment and facilitates interaction with the system’s components. B A C

3. We will take Quiz 16 one week from Thursday (5/3)!
Announcements
We will take Quiz 16 one week from Thursday (5/3)!
CYDI

4. Announcements Attention Seniors!
Please check your and sign up for Six Flags using the link. The trip is on Friday, May 18th.
The money is NOT due yet, but you need to sign up by TOMORROW, April 26th.

5. 4/18 N/A 4/19 4/23 4/24 Assignment F2 F3 F4 F5 Last Day Accepted
Summative or Formative #
Date Issued
Gone Missing Day
Last Day Accepted
WS – Dennis Rader, Input to Output: How Does the Computer Work? F2
4/18
N/A
Hold for eResearch Paper
Pop Quiz – Storing and Retrieving Data, Processing the Electronic Crime Scene F3
4/19
WS – Storing and Retrieving Data, Processing the Electronic Crime Scene F4
4/23
Forensic Files – Hack Attack F5
4/24

6. Computer Forensics (Part 3)
Analysis of Electronic Data

7. Analysis of Electronic Data
One byte = ___ bits 8
One sector = ____bytes
512
One cluster = ___ sectors 6

8. Analysis of Electronic Data
One megabyte = _________ bytes
1,000,000
One gigabyte = _____ megabytes
1,000
One terabyte = _____ gigabytes
1,000

9. Analysis of Electronic Data
The types of computer evidence can be grouped under two major subheadings:
visible data is data that the operating system (OS) is aware of, and thus easily accessible to the user. It includes any type of user created data, such as word processing documents, spreadsheets, databases, and A/V media.
latent data is the data that the OS is not aware of. The constant shuffling of data through deletion, defragmentation, swapping, and so on is one of the ways data is stored in latent areas.

10. Analysis of Electronic Data
Latent data can exist in both RAM slack and cluster slack.
(8-1) RAM slack is the area from the end of the logical file to the end of the sector.
(8-2) Cluster slack is the remaining area from the end of the final sector containing data to the end of the cluster.

11. Analysis of Electronic Data
Latent data might be found in (8-3) unallocated space – space on a HDD that the operating system sees as empty and ready for data.
When a user deletes files the data typically remains behind, so (8-4) deleted files are another source of latent data.

12. Analysis of Electronic Data
(9-1) Temporary files created by programs as a sort of backup on the fly prove valuable as evidence.
Data in the (9-2) swap space (used to conserve the valuable RAM within the computer system) can also yield evidentiary evidence.

13. Analysis of Electronic Data
Disk “fragmentation” a situation in which data for the same file is contained in noncontiguous clusters on the HDD. This can degrade the performance of a HDD, causing the read/write heads to have to traverse the platters to locate the data.

14. Analysis of Electronic Data
Worksheet
Analysis of Electronic Data