Table Of Content225_Cybercrime_FM.qxd 7/17/02 10:34 AM Page i
s o l u t i o n s @ s y n g r e s s . c o m
With more than 1,500,000 copies of our MCSE, MCSD, CompTIA, and Cisco
study guides in print, we continue to look for ways we can better serve the
information needs of our readers. One way we do that is by listening.
Readers like yourself have been telling us they want an Internet-based ser-
vice that would extend and enhance the value of our books. Based on
reader feedback and our own strategic plan, we have created a Web site
that we hope will exceed your expectations.
[email protected] is an interactive treasure trove of useful infor-
mation focusing on our book topics and related technologies. The site
offers the following features:
■ One-year warranty against content obsolescence due to vendor
product upgrades. You can access online updates for any affected
chapters.
■ “Ask the Author” customer query forms that enable you to post
questions to our authors and editors.
■ Exclusive monthly mailings in which our experts provide answers to
reader queries and clear explanations of complex material.
■ Regularly updated links to sites specially selected by our editors for
readers desiring additional reliable information on key topics.
Best of all, the book you’re now holding is your key to this amazing site.
Just go to www.syngress.com/solutions, and keep this book handy when
you register to verify your purchase.
Thank you for giving us the opportunity to serve your needs. And be sure
to let us know if there’s anything else we can do to help you get the
maximum value from your investment. We’re listening.
www.syngress.com/solutions
225_Cybercrime_FM.qxd 7/17/02 10:34 AM Page ii
225_Cybercrime_FM.qxd 7/17/02 10:34 AM Page iii
1 YEAR UPGRADE
BUYER PROTECTION PLAN
Scene of the
Cybercrime
Co m p u t e r Fo r e n s i c s H a n d b o o k
Debra Littlejohn Shinder
Ed Tittel
Technical Editor
225_Cybercrime_FM.qxd 7/17/02 10:34 AM Page iv
Syngress Publishing,Inc.,the author(s),and any person or firm involved in the writing,editing,or
production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results
to be obtained from the Work.
There is no guarantee of any kind,expressed or implied,regarding the Work or its contents.The Work
is sold AS IS and WITHOUT WARRANTY.You may have other legal rights,which vary from state
to state.
In no event will Makers be liable to you for damages,including any loss of profits,lost savings,or
other incidental or consequential damages arising out from the Work or its contents.Because some
states do not allow the exclusion or limitation of liability for consequential or incidental damages,the
above limitation may not apply to you.
You should always use reasonable care,including backup and other appropriate precautions,when
working with computers,networks,data,and files.
Syngress Media®,Syngress®,“Career Advancement Through Skill Enhancement®,”and “Ask the
Author UPDATE®,”are registered trademarks of Syngress Publishing,Inc.“Mission Critical™,”“Hack
Proofing®,”and “The Only Way to Stop a Hacker is to Think Like One™”are trademarks of Syngress
Publishing,Inc.Brands and product names mentioned in this book are trademarks or service marks of
their respective companies.
KEY SERIAL NUMBER
001 JG9H7GYV83
002 R2UV7T5CVF
003 HJ9HFSCX3A
004 9MB76N679Y
005 U8NLT5R33S
006 X5L7NC4ES6
007 G8D4EB42AK
008 9BKMVC6RD7
009 SGWKP7V6FH
010 5BVFJJM39Z
PUBLISHED BY
Syngress Publishing,Inc.
800 Hingham Street
Rockland,MA 02370
Scene of the Cybercrime: Computer Forensics Handbook
Copyright © 2002 by Syngress Publishing,Inc.All rights reserved.Printed in the United States of
America.Except as permitted under the Copyright Act of 1976,no part of this publication may be
reproduced or distributed in any form or by any means,or stored in a database or retrieval system,
without the prior written permission of the publisher,with the exception that the program listings
may be entered,stored,and executed in a computer system,but they may not be reproduced for
publication.
Printed in the United States of America
1 2 3 4 5 6 7 8 9 0
ISBN: 1-931836-65-5
Technical Editor:Ed Tittel Cover Designer:Michael Kavish
Acquisitions Editor:Andrew Williams Page Layout and Art by:Personal Editions
Developmental Editor:Kate Glennon Copy Editor:Darlene Bordwell
Indexer:Claire A.Splan
Distributed by Publishers Group West in the United States and Jaguar Book Group in Canada.
225_Cybercrime_FM.qxd 7/17/02 10:34 AM Page v
Acknowledgments
We would like to acknowledge the following people for their kindness and support
in making this book possible.
Richard Kristof and Duncan Anderson of Global Knowledge,for their generous
access to the IT industry’s best courses,instructors,and training facilities.
Ralph Troupe,Rhonda St.John,and the team at Callisma for their invaluable insight
into the challenges of designing,deploying and supporting world-class enterprise
networks.
Karen Cross,Lance Tilford,Meaghan Cunningham,Kim Wylie,Harry Kirchner,
Kevin Votel,Kent Anderson,Frida Yara,Bill Getz,Jon Mayes,John Mesjak,Peg
O’Donnell,Sandra Patterson,Betty Redmond,Roy Remer,Ron Shapiro,Patricia
Kelly,Andrea Tetrick,Jennifer Pascal,Doug Reil,and David Dahl of Publishers
Group West for sharing their incredible marketing experience and expertise.
Jacquie Shanahan,AnnHelen Lindeholm,David Burton,Febea Marinetti,and
Rosie Moss of Elsevier Science for making certain that our vision remains world-
wide in scope.
Annabel Dent and Paul Barry of Elsevier Science/Harcourt Australia for all
their help.
David Buckland,Wendi Wong,Marie Chieng,Lucy Chong,Leslie Lim,Audrey Gan,
and Joseph Chan of Transquest Publishers for the enthusiasm with which they receive
our books.
Kwon Sung June at Acorn Publishing for his support.
Jackie Gross,Gayle Voycey,Alexia Penny,Anik Robitaille,Craig Siddall,Darlene
Morrow,Iolanda Miller,Jane Mackay,and Marie Skelly at Jackie Gross & Associates
for all their help and enthusiasm representing our product in Canada.
Lois Fraser,Connie McMenemy,Shannon Russell and the rest of the great folks at
Jaguar Book Group for their help with distribution of Syngress books in Canada.
A special welcome to the folks at Woodslane in Australia! Thank you to David Scott
and everyone there as we start selling Syngress titles through Woodslane in Australia,
New Zealand,Papua New Guinea,Fiji Tonga,Solomon Islands,and the Cook Islands.
vv
225_Cybercrime_FM.qxd 7/17/02 10:34 AM Page vi
Author Acknowledgments
and Dedications
It may or may not take a village to raise a child,but I know for sure that it takes a
whole network of people,across time and the globe,to bring a book like this one
into being.An author,like a parent,feels a certain proprietary investment in the final
product—but I couldn’t have done it alone,and I’m glad I didn’t have to.
This book is the culmination of three separate but intertwined vocations I’ve
pursued during my life:law enforcement,computer networking (a.k.a.IT),and
writing.They say that in the end,the last shall be first,and that was and is true for
me.To be a professional writer was one of my first aspirations,way back in eighth
grade when I scrawled my first (badly written but somewhat complete) 300-page
novel on notebook paper and loaned it out to friends like a one-person library.I
went on to write for and edit my high school and college newspapers,and the
teachers and friends who encouraged my ambitions back then deserve the first
debt of gratitude:Bobbie Ferguson,Michael Britton,and Barbara Gifford Brown—
wherever you are now,thank you.
I never gave up that dream,but the kind of writing I was doing early on didn’t
pay the bills,so I followed in my father’s footsteps into government work,and ended
up falling in love with law enforcement and following that path for the third decade
of my life.Without my experience as a police officer and police academy instructor,
this would be just another tech book,so I want to thank some of those who made all
that possible:Larry Beckett,Sarah Whitaker,Danny Price,Marty Imwalle,Mike
Walker,Patt Scheckel-Hollingsworth,Lin Kirk Jones,and Neal Wilson.
I enjoyed being a cop,but as I got older,I found there was something else I
enjoyed even more—and it was easier on the body and paid better,to boot.I’d been
a computer hobbyist for a long time (my old VIC-20 and Commodore 64 are still
here on a high shelf in the closet) and after meeting my husband online,together we
set up our home network and studied together to become MCSEs.He was as tired
of medicine as I was of police work,and when it came time for us to look for a new
career we could share,the solution was obvious.The tech world beckoned.We did
consulting for a while,and then started teaching.There were many who helped us
along the way:Cash Traylor,Johnnie and Irene at Eastfield,Thomas Lee and everyone
vi
225_Cybercrime_FM.qxd 7/17/02 10:34 AM Page vii
on the Saluki list,David (Darkcat) Smith and the gang at DigitalThink,Donna Gang
at Technology Partners,and all our students in the MCSE programs.
Through it all,writing was still my secret passion.When the opportunity arose to
author tech books,it seemed that my life had come full circle.For providing that
opportunity,I have to thank the folks at Syngress and Dave Dusthimer at Cisco Press.
Many people contributed to the success of my and Tom’s writing careers,especially
Julie,Maribeth,Kitty,Carl,our tech editors,and most of all,the readers who bought
the books.
Which brings us to this book.I had a huge amount of input and assistance from
many corners,all of which added value and made writing it easier and more fun:
Andrew Williams,who made it possible;James Michael Stewart,without whose
contributions to Chapters 8 and 9 this book would not have been finished on time;
“Tech Ed”Tittel and Developmental Editor Kate Glennon,whose comments and
questions kept me on my toes.I also want to thank David Rhoades of Maven
Security,for the information about “click kiddies,”and all the law enforcement
officers who shared their experiences and cybercrime expertise,especially Wes Edens,
Glen Klinkhart,Dave Pettinari,Troy Lawrence,Bryan Blake,Dean Scoville,Robert
Bell,Bud Levin and Robert S.Baldygo,James Rogers,Bob Foy,Michael J.West,Tom
Burns,and Ira Wilsker.
Finally (and the first shall be last),there were the friends and family members
who provided encouragement all along the way.This book is dedicated to Tom (my
husband,best friend,and business partner,who also wrote part of the section on
name resolution in Chapter 5),Kris and Kniki (the two best kids in the world),
Mom,Dad (whom I still miss every day),Jeff Tharp (one of the few friends who
really did keep in touch after he moved away),all the Piglets (especially Bob,Lash,
Dee,Robert,Shawn,bud,the Buerger King,Chief Al,MikeO and “Ms.V,Wherever
You Are”),the MarketChat gang,the Storytalkers,the Writingchatters and all the
rodents of unusual sizes on the CBP and related lists.
—Debra Littlejohn Shinder
vii
225_Cybercrime_FM.qxd 7/17/02 10:34 AM Page viii
Author
Debra Littlejohn Shinder is a former Police Sergeant and Police
Academy Instructor,turned IT professional.She and her husband,Dr.
Thomas W.Shinder,have provided network consulting services to busi-
nesses and municipalities,conducted training at colleges and technical
training centers,and spoken at seminars around the country.Deb special-
izes in networking and security,and she and Tom have written numerous
books,including the best selling Configuring ISA Server 2000 (Syngress
Publishing,ISBN:1-928994-29-6),and Deb is the sole author of
Computer Networking Essentials.Deb also is the author of over 100 articles
for print publications and electronic magazines such as TechProGuild,
CNET,8Wire,and Cramsession.Deb is a member of the editorial board of
the Journal of Police Crisis Negotiations and the advisory board of the
Eastfield College Criminal Justice Training Center.
225_Cybercrime_FM.qxd 7/17/02 10:34 AM Page ix
Technical Editor and Contributor
Ed Tittel is a 20-year veteran of the computing industry who has
worked as a programmer,systems engineer,technical manager,writer,
consultant,and trainer.A contributor to over 100 computer books,Ed
created the Exam Cram series of certification guides.Ed also writes
for numerous Web sites and magazines on certification topics including
InformIT.com,Certification and IT Contractor magazines,and numerous
TechTarget venues (www.searchsecurity.com,www.searchnetworking.com,
www.searchWin2000.com,www.searchWebManagement.com).When
he’s not busy writing,researching,or teaching,Ed likes to shoot pool,
consume the occasional glass of red wine,and walk his Labrador retriever,
Blackie.
Contributors
James Michael Stewart (MCSE,CCNA,CISSP,TICSA,CIW Security
Analyst) is a writer,researcher,and trainer who specializes in IT security
and networking related certification topics.A contributor to over 75
books,Michael has most recently contributed to titles on CISSP,TICSA,
Windows 2000,and Windows XP topics.Michael also teaches for
NetWorld + Interop twice yearly,where he offers courses on Windows
security and on Windows performance optimization and tuning.In his
spare time,Michael is an avid handyman,waterskier,world traveler,and a
dancin’fool (primarily the two-step).
Michael Cross (MCSE,MCP+I,CNA,Network+) is an Internet
Specialist and Programmer with the Niagara Regional Police Service
and has also served as their Network Administrator.Michael performs
ix
