Forensic Examination of Digital Evidence

SPECIAL REPORT / APR. 04
examiner so they can better understand the investigation and provide a better examination).
You can provide an already completed document or a pending report to cover
this step.
6. ***ITEMS TO BE ANALYZED: (NOTE: IF NOT EVIDENCE, STATE THAT FACT)
NOTE: It is only required to list the items to be analyzed, not to answer all the questions.
This must be a complete list of all items that need analysis. An evidence listing must
completely identify all items. The following is just a sample of how to list evidence:
Tag #’s
Tag # XX
Tag # XX
Tag # XX
Description
Western Digital Caviar 31600 Hard Drive, Serial #: WT2891586134
taken from AST Computer Serial # 186AUZ022348.
Fujitsu M1636TAU Hard Drive, Serial #: 08613105, Size: 1226MB.
Gateway 2000, 386/33 MHz, Serial #: 302557386-330XC. Computer
System with a Western Digital 125 MB internal hard drive, a Seagate
107 MB internal hard drive, internal 3.5-inch high-density floppy drive,
one internal 5.25-inch floppy drive, internal sound card.
Gateway 2000 101 Keyboard, Serial #: 9208572226f7.
Computer Mouse Device, Serial #: 850753.
Tag # XX
198 each 3.5-inch floppy diskettes
1 each 5.25-inch floppy diskettes
7. ***SUPPORT REQUESTED: (Specific and detailed request. Do not just cut and paste
what is listed below. These are just some sample statements. If you do not know what
one of these items is, then don’t include it. Also, don’t just say “give me everything”
and expect DCFL to take it from there. List items you need the DCFL to find and how
you need it produced and provided to you.)
e.g.
Computer Media
Extract all system logs, graphic files, text, documents, etc.
Examine file system for modification to operating system software or
configuration.
Examine file system for back doors, check for setuid and setgid files.
Examine file system for any sign of a sniffer program.
Extract data from this 8-mm tape and convert to readable format, cut to CD.
Backup hard drives and place backup on a CD, tape, or other format.
Analyze for deleted files and restore deleted files, cut findings to CD.
If possible, correlate sexually explicit images to the Internet history file.
Extract sexually explicit images from logical, slack space, free space, cut to CD.
Extract all pertinent text files of a sexual nature.
Provide an analysis report and cut all findings to CD (specify).
Conduct string search on physical level of media (provide list of words).
54