1. Text Searches Slack Space Unallocated Space
Evidence Analysis
Text Searches
Slack Space
Unallocated Space

2. Text Searches

3. Select “Simultaneous Search” Search Menu

4. Talk to Your DA Choose pertinent Words for your Investigation
Important for locating context

5. Positive Reinforcement

6. Select an Entry Drive displays that entry

7. Using Position Manager

8. Key Word Search Displays context of the key word Go through every hit
What can you discern about the case?
Is it relevant to your case?

9. What is lurking in the background
Slack Space Free Space
What is lurking in the background

10. Windows – Drives
In Windows drives are specified by a letter followed by a colon.
C:, D:, etc.
Each drive is either a partition or an actual hard drive.
Often referred to as logical drives.

11. Files
A File is data that is related, as such it is a logical grouping of data.
Files are allocated storage space on a drive when it is created.
As a file is used it is allocated more space as needed.
File names usually have a first name that is descriptive of its contents.
And a second name, the file extension, that indicates the type of file, such as .txt, .pdf, .exe, etc.

12. Disk Storage Review
Data is stored on disks one entire sector at a time
A sector is usually 512 bytes
If you use only one byte, the system still provides the other 511 bytes for you
A sector is the minimum size read from, or written to, a disk
A sector is the minimum I/O unit

13. Clusters Space is allocated to a file one cluster at a time
A cluster is a fixed number of sectors
Must be a power of 2 (1,2,4,8, )
Unused sectors retain the data that was on them prior to allocation
A cluster is the minimum file allocation unit

14. Clusters Cluster 1 Cluster 2 Sector 1 Sector 1 Sector 2 Sector 2

15. File Data Cluster 1 Cluster 2 Sector 1 Sector 1 Sector 2 Sector 2

16. Slack Space Slack is the space allocated to a file, but unused
Space at the end of a sector that remains unused by the file
Sectors allocated to the file that the file hasn’t yet used
Slack space often contains useful evidence
Unused bytes in an allocated sector are less useful
Unused sectors in an allocated cluster retain their original contents and are very useful
Current operating systems write 0’s in the slack space per sector, often leaving the residual data in the unused sectors in the allocated cluster.

17. File Data Slack Space Cluster 1 Cluster 2 Sector 1 Sector 1 Sector 2

18. Unallocated Clusters
Many clusters on a modern hard drive are unallocated
Some have never contain data
Unallocated clusters may have been allocated earlier though and since been deleted
These clusters retain their data until they are reallocated to a new file
Deleted files are still recoverable!

19. Deleting a FAT File Deleting C:taxes.txt
Find the FAT, and Data areas
Locate taxes.txt in the Directory for C:; determine its starting cluster
Go to the FAT
Set FAT entries for taxes.txt cluster to 0
Therefore not allocated
Follow the links
Change filename to axes.txt in C: directory
First character becomes 0xE5

20. Unallocated Space
After deleting a file the previously allocated clusters become unallocated.
They ready to be allocated to some other file.
They have not been touched.
They still contain the data from the original file.
You can recover the data so long it hasn’t been written over by a new file.

21. WinHex to the Rescue Presents the file system
Lets you look at the individual files
Shows files that have been deleted
Attempts to recover deleted files
Gathers slack space

22. Go get the Slack

23. Save It

24. View It Not terribly interesting

25. Go Get Free Space
Save it in your case folder

26. Viewing Free Space

27. Text Search “Simultaneous Search”
First you must delete all positions from the first search
Then search

28. Deleting Previous Searches

29. List of Hits

30. Select Delete
Delete

31. Lab Assignment Select keywords and search for them.
Gather slack space and comment
Gather free space and comment
Search free space for keywords
Highlight some of the keyword hits in free space
Be sure you comment on the relevance of your discovered evidence on the charges