You are receiving this email because you are believed to be a music lover, audiophile, musician, or to be a professional in the video or music business. If you wish to be removed from our email list, send an email to unsubscribe(a)mitcables.com.
In our continued effort to help educate and demystify audio cables, regardless if you are an audiophile, home theater specialist, custom installer or hobbyist, Music Interface Technologies (MIT) has published this informative newsletter. This newsletter will endeavor to bring you new and useful information resources.
Subjects will encompass not only the applied sciences of audio cable, but will also deal with systems engineering tips, and most importantly, how to choose the proper cables for any audio interfacing application, thereby saving you time and money.
Future newsletter topics will include-- audio, video, music instrument, as well as cables for pro applications such as microphone cables.
Simply go to one of the URLs listed below and you will access easy-to-understand information regarding cable design, applied sciences, application information, and performance specifications.
For a greater understanding of the science of cables, go to http://mitcables.com/technology. The technical and white papers located here give in-depth explanations about the inner workings of cable and of the technology behind MIT products.
Look at www.audiocables.net for brief tutorials, including helpful overviews to teach you all you really need to know about speaker and audio cables and how to hook them up to your equipment, fast.
Musicians and/or Pro users: try www.guitarcables.net for state-of-the-art musical instrument cables. For the best in Professional level microphone cables, go to: www.microphonecables.com. Discover the secrets of leading recording artists and filmmakersÂ…and make them yours!
Go to www.usedcable.net for huge savings on MIT audio and video cables.
Brought to you by the people at MIT, Music Interface Technologies, makers of "More Than Just Cable"(TM)
We hope this newsletter will be of use to you. If not, please unsubscribe by sending an email to unsubscribe(a)mitcables.com.
***********************************************************************
The Forensic Strategy Data Recovery Newsletter Vol. 1, Issue 2
***********************************************************************
-------- IN THIS ISSUE: -----------------------------------------------
COMMENTARY
- COMPUTER FORENSICS 101: What evidence can be RECOVERED?
UPCOMING NEWSLETTER ISSUES
- Items you can look forward to in future issues!
CONTACT US
- For more information on Forensic Strategy Services.
-----------------------------------------------------------------------
* COMPUTER FORENSICS 101: What evidence can be RECOVERED?
By: Scott Moulton, Computer Forensic Specialist
mailto:scott@forensicstrategy.com
"What evidence can possibly be recovered that can help my client's
case?"
Like other types of investigations, the answer will not be fully
determined until after the data has been recovered and the findings are
meticulously researched. The process involved to investigate a computer
can be exceptionally time intensive. An average of seven hours is
required before a basic assessment can be created. The assessment will
help establish if the computer contains valuable information that would
justify additional resources. Because it is initially uncertain what
evidence a computer contains, it is essential to qualify a particular
computer before investing additional resources.
"When is there a good possibility to recover useful data so that it is
cost effective to involve a Computer Forensic Investigator?"
* Qualifying a Computer for Forensic Recovery:
In practically every computer there is "deleted" data that can be
recovered; however, the data recovered is not always relevant to the
case. Typically, it is a judgment call which computers should be
investigated when there is more than one computer involved. It helps to
establish an order of priority for the computers to be recovered. Using
this method, vital data would be revealed first which would eliminate
wasting resources on less credible computers. It is possible to
predict and prioritize the best computers for recovery based on a
series of questions.
Q: Did any person involved use the computer? Note that this could
include receiving email or files from the party involved.
When a file or email is deleted it is not immediately removed from the
hard drive. It still exists even though it can not be easily accessed.
There is a section of the hard drive that is similar to a "Table of
Contents" and when a file is deleted it is just removed from this
"Table of Contents". The originally deleted file or email is left as
dead space on the hard drive. Since the file exists on the hard drive,
special tools that bypass the "Table of Contents" can search for files
and potentially recover them. A file can be divided in to several
pieces and exist in various locations on a hard drive. Because of this,
it is possible that only part of a file might be recovered. A vital
component to a case might exist in one of those small pieces.
If the item that was deleted was an email, a different set of rules
apply. An email, by its nature, exists in more than one place. There is
always a From:(the sender) a To:(the recipient) and at least one server
(the machines that processed the email). If there was CC:(carbon copy)
or BCC:(blind carbon copy) addresses then more copies exist. An email
has a greater potential to be recovered because an email is stored in a
file similar to a database. Consequently, when an email is deleted it
is removed from the "Table of Contents" of the database and not the
hard drive itself. It is possible for the email to persist in a file or
server for quite a long time after the email is "deleted" by a user.
This includes Outlook Express, Outlook 2002, AOL, Exchange Server and
several other types of email programs.
If email is read via a web browser (i.e. Hotmail) a copy of the email
will usually exist in the Internet cache or temporary files on the hard
drive of the computer it was viewed from. There is an even greater
probability that this might be recovered.
Q: How long has it been since files were deleted?
Because of the way files are left behind as dead space on the hard
drive, as space is needed by different programs or web pages, the file
pieces are gradually overwritten. The longer time that has transpired
since the files were deleted the less probability that something can be
recovered. Although in some past instances data has been recovered
dating back several years.
Q: How much has the computer been used since files were deleted?
Because files are overwritten gradually, the more the computer is used
the more likely new files have overwritten older files erasing your
valuable information. A computer writes files every time that a program
is used (including internet accesses). The Windows Operating System
will overwrite certain files every time the system is powered on. These
standard files are not very large but they account for a significant
percentage of the destruction that occurs to recoverable files. This
is an excellent reason to stop using a computer as soon as it is
learned that it is involved in a case until a Computer Forensic
Specialist can examine it. If this computer is necessary for operations
of the business the specialist can safely and effectively "clone" the
hard drive to preserve the information.
If there is someone who can answer these questions there is a good
chance of determining the usefulness of the computer in a case. This is
not intended to be a final list of questions but is a common set to
help determine the possibility that something useful might exist. In
some cases the client might not be able to answer any of these
questions and it is also often that the answers given are incorrect.
Even when there is no one to answer those questions, there is still a
good possibility of recovering valuable evidence from the right
computer, even when the files never existed on the computer.
Example #1:
To the surprise of the CEO of one company, five of its members of a
branch office left overnight to start their own company. No notice was
given and it wasn't until someone arrived at the office after no one
answered the phone for hours that it was discovered they had departed
to start a new company. Initially, there was no major concern except
that the employees were gone. The CEO stated that nothing was taken but
they wanted to review the hard drives for company security purposes.
During a data recovery several printer spooler files were recovered.
Since it is sometime a pattern of employees to bring floppy disks and
print documents that never existed on the server, a spooler file can be
very revealing. In this case, the spooler indicated that it had
printed to several high-end HP Color Laser Printers. During the
recovery it was noted that the office had no HP Color Laser Printers.
This was brought to the attention of the CEO and he claimed that it was
not possible for the employees to purchase an asset that large as they
have to have approval for purchases over $500. After investigating, it
was determined that the employees had used company funds to purchase
equipment by each individual pooling their purchase below $500 into one
large purchase together.
Often a case will involve someone that believes they are a "computer
guru." They consciously attempt to delete incriminating evidence
believing they knew what they were doing. Their egos make them believe
that they know how to delete a file and that it is permanently
unrecoverable and that they are safe. Many times they are mistaken.
Example #2:
In a divorce case, the husband was accused of having an affair. He was
also chatting and emailing his girlfriend over the Internet. He also
spent several hours a week on illicit adult web sites. The wife
described her husband as a very computer savvy person. She stated
several times that he knew everything about a computer and that he
always deleted everything. Because of this statement there was a great
discussion about wasting time with a court order for the computer.
After the computer was investigated, many incriminating items were
recovered. There were chat logs, emails found in the Internet cache
files, and dozens of revealing photos of the girlfriend. When
questioned during depositions he was shocked at the printed material
and declared that he had used a special program in his attempt to
overwrite all the deleted files.
Share this email by forwarding to your colleagues!
If this was forwarded to you by a colleague and you'd like to
receive your own edition as soon as it is published, subscribe
by clicking here: http://www.forensicstrategy.com/contacts.asp
-----------------------------------------------------------------------
==== UPCOMING NEWSLETTER ISSUES ====
* Equipment used for forensic recovery of data
* Details of Forensic Data Gathering
* Profiling a person based on the content of their computer
==== CONTACT US ====
* COMMENTS OR QUESTIONS ABOUT THIS NEWSLETTER:
To suggest a topic for a future issue or to send a comment to
the editor email: mailto:comments@forensicstrategy.com
* WEBSITE: http://www.forensicstrategy.com
* MAILING ADDRESS/PHONE/FAX:
Forensic Strategy Services, LLC.
601B Industrial Court
Woodstock, Georgia 30189
ph: 770.926.5588
fax: 770.926.7089
* FOR PERMISSION TO REPRINT PLEASE CONTACT
mailto:scott@forensicstrategy.com
-----------------------------------------------------------------------
For a quick UNSUBSCRIBE Click Here:
mailto:fss@forensicstrategy.com?subject=unsubscribe
or - Send an e-mail to: fss(a)forensicstrategy.com
with "unsubscribe" (no quotes) in the subject line.
Thank you for reading Forensic Strategy Data Recovery Newsletter.
__________________________________________________________
Forensic Strategy Services, LLC. Copyright 2003
La Komputada Leksikono de Sergei Pokrovsky havas "free software" kaj
"open source" por angle tradukoj de "libera programaro." "Open source"
estas eble "nefermita fonttekstaro", sed ne estas "libera programaro."
Sergei pripensas kaj probable demandos opiniojn en soc.culture.esperanto.
Mi petas ke vi rigardas kaj donas opiniojn...
-- http://www.esperanto.mv.ru/KompLeks/LI.html#LIBERA-PROGRAMARO
[EN: "Open Source" has been offered as a translation for "free software"
in a dictionary. The author is considering whether to correct it. I
did notice a while ago that OSI's Esperanto translation translated it
to "free software" too. In some other languages, they left it in
English, which was funny. I can't find the translations any more.]
--
MJR