1. Chapter 16 ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Applying Forensic Science to Computers

2. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 16.1 A selection of storage media and computerized devices.

3. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 16.2 Digital evidence form.

4. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 16.3 Digital Investigation Manager (DIM) from DFLabs used to maintain a database of evidential items and associated information.

5. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 16.4 Comparing bitstream copying to regular copying.

6. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 16.5 Additional class characteristics of EXIF file displayed using ACDSee. The date and time embedded in this file (15:53 on June 11, 2000) is inaccurate because the camera’s clock was not set to the correct time, emphasizing the importance of documenting system time when collecting any kind of computerized device.

7. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 16.6 Fragments of an overwritten JPEG file partially reconstituted by grafting a new header onto the file.

8. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 16.7 Histogram of date-time stamps (created and last modified) showing gaps during suspect’s shifts.

9. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 16.8 Conceptual image of 24-h clocks with MAC times for several days with a line connecting significant events on sequential days.

10. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 16.9 Forensic date and time decoder. These times are generally GMT and must be adjusted for time zones.