Data Types

ACS can search for evidence throughout the data, examining both intact files and the remains of files. Using specialized software and working with a forensic copy of the source data, ACS can view any scrap of data that exists. We also pay attention to patterns of use.

Sources of information range from the most familiar file types and formats to those that the majority of users have never encountered. For example, information can be found and viewed in well-known locations such as:

• Directory listings and log files
• Programs, files, documents, images, and data
• Email messages and attachments
• Data stored by the back-up system

Often, more interesting information is located in areas not visible to most users and not easily accessible. These include:

• Registry files
    – User information
    –  Programs installed or removed
    –  Devices installed or removed
    –  Record of activities

• Hidden files
    –  Unlisted files and the remains of files
    –  Files deleted, as in the normal course of business
    –  Files deliberately erased or overwritten in an attempt to eliminate content
    –  Remains of deleted, erased, “shredded,” corrupted, partially overwritten, and/or reformatted data
    –  Partial back-ups

Other information includes artifacts created automatically and often deleted automatically by the system. Frequently, users aren't aware of this data, which includes:

• Temporary Internet files
• Print spooler files
• Files sent to the Recycle Bin
• Windows temporary files
• Shortcuts
    –  Desktop (Link files)
    –  Recent (last 15 files accessed)
    –  Start Menu
    –  Send To