text:
Transwiki:Computer forensics

The simple definition of computer forensics ''... is the art and science of applying computer science to aid the legal process. Although plenty of science is attributable to computer forensics, most successful investigators possess a nose for investigations and a skill for solving puzzles, which is where the art comes in. - Chris L.T. Brown, Computer Evidence Collection and Preservation, 2006'' Thus, it is more than the technological, systematic inspection of the computer system and its contents for evidence or supportive evidence of a civil wrong or a criminal act. Computer forensics requires specialized expertise and tools that goes above and beyond the normal data collection and preservation techniques available to end-users or system support personnel. One definition is analogous to "Electronic Evidentiary Recovery, known also as e-discovery, requires the proper tools and knowledge to meet the Court's criteria, whereas Computer Forensics is simply the application of computer investigation and analysis techniques in the interests of determining potential legal evidence." Another is "a process to answer questions about digital states and events". This process often involves the investigation and examination computer system(s), including, but not limitied to the data acquisition that resides on the media within the computer. The forensic examiner renders an opinion, based upon the examination of the material that has been recovered. After rendering an opinion and report, to determine whether they are or have been used for criminal, civil or unauthorized activities. Mostly, computer forensics experts investigate data storage devices, these include but are not limited to hard drives, portable data devices (USB Drives, External drives, Micro Drives and many more). Computer forensics experts:

Computer forensics is done in a fashion that adheres to the standards of evidence that are admissible in a court of law. Thus, computer forensics must be techno-legal in nature rather than purely technical or purely legal. Refer to Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations for the US Department of Justice requirements for Computer Forensices and electronic evidence processing.
 * 1) Identify sources of documentary or other digital evidence.
 * 2) Preserve the evidence.
 * 3) Analyze the evidence.
 * 4) Present the findings.

Understand the suspects
It is absolutely vital for the forensics team to have a solid understanding of the level of sophistication of the suspect(s). If insufficient information is available to form this opinion, the suspects must be considered to be experts, and should be presumed to have installed countermeasures against forensic techniques. Because of this, it is critical that you appear to the equipment to be as indistinguishable as possible from its normal users until you have shut it down completely, either in a manner which probably prohibits the machine modifying the drives, or in exactly the same way they would.

If the equipment contains only a small amount of critical data on the hard drive, for example, software exists to wipe it permanently and quickly if a given action occurs. It is straightforward to link this to the Microsoft Windows "Shutdown" command, for example. However, simply "pulling the plug" isn't always a great idea, either-- information stored solely in RAM, or on special peripherals, may be permanently lost. Losing an encryption key stored solely in Random Access Memory, and possibly unknown even to the suspects themselves by virtue of having been automatically generated, may render a great deal of data on the hard drive(s) unusable, or at least extremely expensive and time-consuming to recover.

Electronic evidence considerations
Electronic evidence can be collected from a variety of sources. Within a company’s network, evidence will be found in any form of technology that can be used to transmit or store data. Evidence should be collected through three parts of an offender’s network: at the workstation of the offender, on the server accessed by the offender, and on the network that connects the two. Investigators can therefore use three different sources to confirm of the data’s origin.

Like any other piece of evidence used in a case, the information generated as the result of a computer forensics investigation must follow the standards of admissible evidence. Special care must be taken when handling a suspect’s files; dangers to the evidence include viruses, electromagnetic or mechanical damage, and even booby traps. There are a handful of cardinal rules that are used to ensure that the evidence is not destroyed or compromised: In order to verify that a tool is forensically sound, the tool should be tested in a mock forensic examination to verify the tool's performance. There are government agencies such as the Defense Cyber Crime Institute that accept requests to test specific digital forensic tools and methods for governmental agencies, law enforcement organizations, or vendors of digital forensic products at no cost to the requestor. If such steps are not followed the original data may be changed, ruined or become tainted, and so any results generated will be challenged and may not hold up in a court of law. Other things to take into consideration are: In any investigation in which the owner of the digital evidence has not given consent to have his or her media examined – as in most criminal cases – special care must be taken to ensure that you as the forensic specialist have legal authority to seize, image, and examine each device. Besides having the case thrown out of court, the examiner may find him or herself on the wrong end of a hefty civil lawsuit. As a general rule, if you aren't sure about a specific piece of media, do not examine it. Amateur forensic examiners should keep this in mind before starting any unauthorized investigation.
 * 1) Only use tools and methods that have been tested and evaluated to validate their accuracy and reliability.
 * 1) Handle the original evidence as little as possible to avoid changing the data.
 * 2) Establish and maintain the chain of custody.
 * 3) Document everything done.
 * 4) Never exceed personal knowledge.
 * 1) The time that business operations are inconvenienced.
 * 2) How sensitive information which is unintentionally discovered will be handled.

Some of the most valuable information obtained in the course of a forensic examination will come from the computer user themself. In accordance with applicable laws, statutes, organizational policies, and other applicable regulations, an interview of the computer user can often yield invaluable information regarding the system configuration, applications, and most important, software or hardware encryption methodology and keys utilized with the computer. Forensic analysis can become exponentially easier when analysts have passphrase(s) utilized by the user open encrypted files or containers used on the local computer system, or on systems mapped to the local computer through a local network or the internet.

Secure the machine and the data
Unless completely unavoidable, data should never be analyzed using the same machine it is collected from. Instead, forensically sound copies of all data storage devices, primarily hard drives, must be made. Exceptional consideration to this practice are detailed below regarding live system considerations.

To ensure that the machine can be analyzed as completely as possible, the following sequence of steps must be followed:

Examine the machine's surroundings

The collection phase starts off with the computer forensic team analyzing its surroundings. Similar to police investigating a crime in any other case, all printouts, disks, notes, and other physical evidence must be collected to take back to the laboratory for analysis. Furthermore, an investigating team must take digital photographs of the surrounding environment before any of the hardware is dealt with. This initial collection phase sets the tone for the rest of the investigation and therefore the evidence must be locked away securely, with limited access granted to authorized team members only.

Look for notes, concealed or in plain view, that may contain passwords or security instructions. Secure any recordable media, including music mixes. Also look for removable storage devices such as keydrives, MP3 players or security tokens. See Category:Solid-state computer storage media.

Examine the Live System and record open applications
If the machine is still active, any intelligence which can be gained by examining the applications currently open should be recorded. If the machine is suspected of being used for illegal communications, such as terrorist traffic, not all of this information may be stored on the hard drive. If information stored solely in RAM is not recovered before powering down it may be lost, so acquiring the data while the RAM is still powered is a priority. For most practical purposes, it is not possible to completely scan contents of RAM modules in a running computer. Though specialized hardware could do this, the computer may have been modified to detect chassis intrusion (some Dell machines, for example, can do this stock; software need only monitor for it) and removing the cover could cause the system to dump the contents. Ideally, prior intelligence or surveillance will indicate what action should be taken to avoid losing this information.

Several Open Source tools are available to conduct an analysis of open ports, mapped drives (including through an active VPN connection), and of significant importance, open or mounted encrypted files (containers) on the live computer system. Additionally, through Microsoft's implementation of the Encrypted File System (EFS), once a system is powered down, the difficulty to examine previously mounted EFS files and directory structures is substantially increased. Utilizing open source tools and commercially available products, it is possible to obtain an image of these mapped drives and the open encrypted containers in an unencrypted format. For Windows based systems, these Open Source tools include Knoppix and Helix. Commercial imaging tools include Access Data's Forensic Tool Kit and Guidance Software's EnCase application. Both companies make available their imaging tools for free; however, in order to analyze the data imaged using these tools you will need to purchase a full licensed version of the application.

The aforementioned Open Source tools can also scan RAM and Registry information to show recently accessed web-based email sites and the login/password combination used. Additionally these tools can also yield login/password for recently access local email applications including MS Outlook.

With MS most recent addition, Vista, and Vista's use of BitLocker and the Trusted Platform Module (TPM), the importance of developing procedures for examining and imaging live (mounted unencrypted) systems is anticipated to significantly increase.

It is possible that in utilizing tools to analyze and document a live computer system that changes can be made to the content of the hard drive. During each phase of system analysis, the forensic examiner must document what they did and why they did it. Specifically, the examiner should detail the potentially perishable information that can/will be lost during a system power down process. The examiner must balance the need to potentially change data on the hard drive versus the evidentiary value of such perishable data.

RAM can be analyzed for prior content after power loss. Although as production methods become cleaner the impurities used to indicate a particular cell's charge prior to power loss are becoming less common. Data held statically in an area of RAM for long periods of time are more likely to be detectable using these methods. The likelihood of such recovery increases as the originally applied voltages, operating temperatures and duration of data storage increases. Holding unpowered RAM below − 60 °C will help preserve the residual data by an order of magnitude, thus improving the chances of successful recovery. However, the practicality of utilizing such a method in a field examination environment severely limits this approach.

As expeditious destruction of chronic residual stress within the module can really only be achieved by impractical exposure to high energies, applications written with data security in mind will periodically bit-flip critical data, such as encryption keys, to eliminate 'imprinting' of this data on the RAM, thus preventing the need to actively destroy it in the first place.

It is important to note that when preforming a live analysis that the order of volatility be followed. The data that is most likely to be modified or damaged first should be captured first. The order of volatility is.

1. Network connections

Network connections can close quickly and often leave no evidence of where they were connected to or the data being transferred.

2. Running Processes

It is important to note which programs are running on a computer before further analysis is conducted.

3. RAM

The systems Random Accessing Memory contains information on all running programs as well as recently run programs. The information that can be gained from the system ram includes Passwords, encryption keys, personal information and system and program settings.

4. System settings

The Operating system settings can now be extracted. this includes User lists, currently logged in users, system date and time, currently accessed files and current security policies.

5. Hard Disk

The hard disk can then be imaged. It is important to note that it is not forensically sound to image a hard drive while it is running live unless there are extenuating circumstances.

Power down carefully
If the computer is running when seized, it should be powered down in a way that is least damaging to data currently in memory and that which is on the hard disk. The method that should be used is dependent on many differing values, such as the operating system in use, and the role of the computer to be seized. Performing a proper shut down may cause malicious scripts to be run, or volatile data to be lost. On the other hand, removing the power plug may cause corruption of the filesystem or loss of crucial data.

Be aware of the fact that computers may feature an internal uninterruptible power supply (UPS). With such devices the computer may stay running long after the power cable has been removed.

Fully document hardware configuration
Completely photograph and diagram the entire configuration of the system. Note serial numbers and other markings. Pay special attention to the order in which the hard drives are wired, since this will indicate boot order, as well as being necessary to reconstruct a RAID array. A little time being thorough here will save you more later.

Duplicate the electronic media (evidence)
The process of creating an exact duplicate of the original evidenciary media is often called Imaging. Using a standalone hard-drive duplicator or software imaging tools such as DCFLdd or IXimager, completely duplicate the entire hard drive. This should be done at the sector level, making a bit-stream copy of every part of the user-accessible areas of the hard drive which can physically store data, rather than duplicating the filesystem. Be sure to note which physical drive each image corresponds to. The original drives should then be moved to secure storage to prevent tampering.

Usually some kind of hardware write protection to ensure no writes will be made to the original drive is used. Even if operating systems like Linux can be configured to prevent this, a hardware write blocker is usually the best practice. The Defense Cyber Crime Institute warns that if a hardware write-block is used the examiner should take into consideration the fact that write-blocks can introduce extra benign data when being used to image damaged media (bad sectors). Special consideration is also given to hard drives with Host Protected Areas (HPAs) and Device Configuration Overlays (DCOs). These small areas of a hard drive, normally reserved for hard drive device and diagnostic utilities and hidden from the operating system, can be altered up to the entire capacity of the hard drive and used to store information (potential evidence) that many imaging applications and devices fail to image. You can image to another hard disk drive, a tape, or other media. Tape is a preferred format for archive images, since it is less vulnerable for damage and can be stored for a longer time. There are two goals when making an image: The imaging process is verified by using the SHA-1 message digest algorithm (with a program such as sha1sum) or other still viable algorithms. To make a forensically sound image, you need to make two reads that result in the same output by the message digest algorithm. Generally, a drive should be hashed in at least two algorithms to help ensure its authenticity from modification in the event one of the algorithms is cracked. This can be accomplished by first imaging to one tape labeled as the Master and then make an image labeled Working. If onsite and time is critical, the second read can be made to Null.
 * 1) Completeness (imaging all of the information)
 * 2) Accuracy (copying it all correctly)

Note: Ultimately the methodology used by computer forensic investigators in capturing potential evidence on a system (such as imaging hard drives) will be dictated by the proportionality of the likely importance of that evidence in the matter for which these services are engaged. Additional influences such as claims of privilege and potential damages sought for business interruption create potential headaches for corporate investigations where forensic soundness is often sacrificed for practicality. Law enforcement personnel moving into the corporate environment tend to be overly strict in their application of computer forensic principles in litigations where the burden of proof does not require it. There is an increasing need to capture servers live and capturing less than whole disks worth of data in an effort to work within a time and cost framework. Even an unsolved murder investigation must be wound up at some point where there are diminishing gains to be had in progressing the investigation, so too with computer forensic investigations in both the corporate and criminal arenas where the sheer quantity of digital evidence can become overwhelming and threaten to overburden investigators. Also, it must be remembered that any computer evidence is potentially admissible regardless of the methodology by which it came to the attention of the court. If an examiner fails to create a SHA or MD5 hash on the original hard drive, the data is not necessarily worthless or non admissible. Traditional discovery has been happening for at least a decade (often without a hashes). Application of proper forensic principles will however improve its overall credibility and diminish admissibility challenges. However, reasonable attempts should be made to ensure that the most complete and accurate image possible is obtained.

E-mail review
E-mail has become one of the primary mediums of communication in the digital age, and vast amounts of evidence may be contained therein, whether in the body or enclosed in an attachment. Because users may access email in a variety of ways, it's important to look for different kinds of emails. The user may have used a dedicated program, or Mail User Agent (MUA), a web browser, or some other program to read and write email. Additionally, files for each of these programs may be stored on a local hard drive, a network device, or a removable device. A good examiner will search all of these locations for email data. Be aware that many email clients will save a copy of outgoing messages, so both the sender and the recipient may have a copy of each message. Finally, mail may also be stored on a dedicated mail server, either awaiting delivery or as permanent storage.

E-mail headers
All email programs generate headers that attach to the messages. The study of these headers is complex. Some investigators favor reading the headers from the bottom up, others from the top down. Under normal circumstances, headers are supposed to be created by the mail user agent and then prepended by mail servers, the bottom up method should work. But a malicious mail server or forger may make this difficult.

The headers added by an MUA are different from those added by mail servers. For example, here is the format for headers generated by Mozilla Thunderbird 1.0 running on Microsoft Windows.

Message-ID: <41B5F981.5040504@example.net> Date: Tue, 07 Dec 2004 13:42:09 -0500 From: User Name  User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: recipient@example.com Subject: Testing Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit

Extensions such as enigmail may add extra headers.

The Message-ID field has three parts:

 * 1) The time the message was sent in seconds past the epoch in hexadecimal (Unix 32 bit Big Endian Hex Value)
 * 2) A random value called a salt. The salt is of the format #0#0#0# where # is a random digit. Because Thunderbird treats the salt like a number, it may be shorter if the leading digits are zeros. For example, a salt of "0030509" would display as "30509".
 * 3) The fully qualified domain name of the sender.

Message-ID: [time]. [ salt ] @[domain-name]

Information on the Message-ID header was derived from the source code in mozilla/mailnews/compose/src/nsMsgCompUtils.cpp in function msg_generate_message_id and therefore applies only to mail sent by this application. Generally the format of the Message-ID is arbitrary, and you should refer to the applicable RFCs.

Sorting through the masses
While theoretically possible to review all e-mails, the sheer volume that may be subject to review may be a daunting task; large-scale e-mail reviews cannot look at each and every e-mail due to the sheer impracticality and cost. Forensics experts use review tools to make copies of and search through e-mails and their attachments looking for incriminating evidence using keyword searches. Some programs have been advanced to the point that they can recognize general threads in e-mails by looking at word groupings on either side of the search word in question. Thanks to this technology vast amounts of time can be saved by eliminating groups of e-mails that are not relevant to the case at hand.

Also, emails may contain In-Reply-To: headers that allow threads to be reconstructed. Good email clients can do this.

Computer forensic examples
Forensics can be defined as the use of technology and science for investigation and fact recovery when dealing with criminal matters. Computer forensics is the technological aspect of retrieving evidence to use within criminal or civil courts of law. They are able to recover damaged and deleted files. Some cases in particular used the art of computer forensics as their lead of evidence to indict a criminal offender or find the location of a missing person.

Example
Chandra Levy, who went missing on April 30, 2001, was a Washington, D.C. intern whose disappearance was widely publicized. While her location was unknown, she had used the Internet as well as e-mail to make travel arrangements and to communicate with her parents. The use of this technology helped a computer criminalist trace her whereabouts. The information found on her computer led police to her location, even though she had been missing for one year.

Example two
There have been a number of cases at private schools where authority figures have been charged with possession of child pornography. These discoveries were made using computer forensics. By tracking the buying and selling of pornography online, computer forensic investigators have been able to locate people involved in these crimes. They are able to use information found on the computers as circumstantial evidence in court, allowing prosecution to occur.

Example three
A final example of how computer forensics is affecting the current workplace is the aspect of security. Employees' work computers are now being monitored to ensure no illegal actions are taking place in the office. They also have heightened security so outsiders cannot access a company’s confidential files. If this security is broken a company is then able to use computer forensics to trace back to which computer was being tampered with and what information was extracted from it, possibly leading to the guilty parties and other potential parties involved.

Comparison to Physical Forensics
There are many core differences between computer forensics and "physical forensics." At the highest level, the physical forensic sciences focus on identification and individualization. Both of these processes compare an item from a crime scene with other substances to identify the class of the item (i.e. is the red liquid fruit juice or blood?) or the source of the item (i.e. did this blood come from person X?). Computer forensics on the other hand focuses on finding the evidence and analyzing it. Therefore, it is more analogous to a physical crime scene investigation than the physical forensic processes.

Related Journals

 * Journal of Digital Investigation
 * International Journal of Digital Evidence
 * International Journal of Forensic Computer Science
 * Journal of Digital Forensic Practice
 * Cryptologia
 * Cryptologia

title: Transwiki:Computer forensics


text:
Transwiki talk:Computer forensics

* (cur) (last) 07:52, 25 September 2007 77.232.66.107 (Talk) (30,704 bytes) (Undo linkspam) (undo) * (cur) (last) 22:28, 24 September 2007 80.42.112.153 (Talk) (30,805 bytes) (→External links) (undo) * (cur) (last) 19:24, 22 September 2007 Rjwilmsi (Talk | contribs) m (30,704 bytes) (Typo & format fix, typos fixed: transfered → transferred using AWB) (undo) * (cur) (last) 21:37, 21 September 2007 77.232.66.107 (Talk) (30,703 bytes) (Undo last edit which removed valuable content without consensus) (undo) * (cur) (last) 19:52, 21 September 2007 97.96.166.230 (Talk) (8,045 bytes) (undo) * (cur) (last) 19:51, 21 September 2007 ClueBot (Talk | contribs) (30,703 bytes) (Reverting possible vandalism by Special:Contributions/97.96.166.230. If this is a mistake, report it. Thanks, ClueBot. (Bot)) (undo) * (cur) (last) 19:50, 21 September 2007 97.96.166.230 (Talk) (empty) (←Blanked the page) (undo) * (cur) (last) 19:41, 21 September 2007 97.96.166.230 (Talk) (30,640 bytes) (undo) * (cur) (last) 19:41, 21 September 2007 97.96.166.230 (Talk) (30,677 bytes) (undo) * (cur) (last) 01:03, 19 September 2007 85.178.102.243 (Talk) (30,703 bytes) (→Sorting through the masses - Very advanced technology... that has been available for ages.) (undo) * (cur) (last) 16:02, 14 September 2007 Natural Born Devastator (Talk | contribs) (30,584 bytes) (Added order of volatility to the live analysis portion of the article) (undo) * (cur) (last) 16:07, 13 September 2007 209.77.228.119 (Talk) (29,310 bytes) (→Examine the Live System and record open applications - Paragraph two, last sentence: replaced comma with semicolon in "... for free; however, ...") (undo) * (cur) (last) 01:15, 13 September 2007 74.86.28.230 (Talk) (29,310 bytes) (Rv linkspam) (undo) * (cur) (last) 22:50, 12 September 2007 64.140.208.253 (Talk) (29,367 bytes) (undo) * (cur) (last) 22:49, 12 September 2007 64.140.208.253 (Talk) (29,367 bytes) (undo) * (cur) (last) 22:08, 12 September 2007 75.62.216.11 (Talk) (29,310 bytes) (→Examine the machine's surroundings - There's no quarter in the pic!) (undo) * (cur) (last) 22:07, 12 September 2007 75.62.216.11 (Talk) (29,350 bytes) (→Examine the machine's surroundings - There's not a quarter in this picture!) (undo) * (cur) (last) 14:18, 10 September 2007 201.63.150.130 (Talk) (29,385 bytes) (→Electronic evidence considerations) (undo) * (cur) (last) 15:51, 7 September 2007 Rurik (Talk | contribs) m (29,384 bytes) (Undid revision 156238593 by Ajcblyth (talk) rv linkspam) (undo) * (cur) (last) 09:30, 7 September 2007 Ajcblyth (Talk | contribs) m (29,471 bytes) (→External links) (undo) * (cur) (last) 12:28, 31 August 2007 Comte0 (Talk | contribs) (29,384 bytes) (→E-mail headers - use reserved names) (undo) * (cur) (last) 15:19, 25 August 2007 Cydebot (Talk | contribs) m (29,388 bytes) (Robot - Speedily moving category Computer Forensics to Computer forensics per CFD.) (undo) * (cur) (last) 13:56, 24 August 2007 Rurik (Talk | contribs) m (29,388 bytes) (Removed non-notable item) (undo) * (cur) (last) 13:53, 24 August 2007 Rurik (Talk | contribs) m (29,424 bytes) (Undid revision 153311231 by 122.252.232.52 (talk)) (undo) * (cur) (last) 06:59, 24 August 2007 122.252.232.52 (Talk) (29,410 bytes) (→Electronic evidence considerations) (undo) * (cur) (last) 00:21, 20 August 2007 Smoshlak (Talk | contribs) (29,424 bytes) (Revision of 19 August 2007, changes.) (undo) * (cur) (last) 00:11, 20 August 2007 69.255.148.228 (Talk) (29,467 bytes) (Additional data referencing civil litigation and Chris Brown reference.) (undo) * (cur) (last) 14:34, 14 August 2007 Mmernex (Talk | contribs) (28,745 bytes) (clean up using AWB) (undo) * (cur) (last) 15:36, 9 August 2007 Rurik (Talk | contribs) (28,745 bytes) (rv linkspam) (undo) * (cur) (last) 14:44, 9 August 2007 Brandonjelinek (Talk | contribs) (28,875 bytes) (→External links) (undo) * (cur) (last) 14:42, 9 August 2007 Brandonjelinek (Talk | contribs) (28,745 bytes) (→Related Journals) (undo) * (cur) (last) 14:41, 9 August 2007 Brandonjelinek (Talk | contribs) (28,878 bytes) (→Related Journals) (undo) * (cur) (last) 03:24, 9 August 2007 67.182.87.209 (Talk) (28,674 bytes) (→Example) (undo) * (cur) (last) 03:17, 1 August 2007 Callidior (Talk | contribs) m (28,675 bytes) (→Examine the Live System and record open applications) (undo) * (cur) (last) 02:35, 1 August 2007 Callidior (Talk | contribs) m (28,670 bytes) (undo) * (cur) (last) 23:51, 31 July 2007 Pndfam05 (Talk | contribs) (28,674 bytes) (→See also) (undo) * (cur) (last) 21:20, 29 July 2007 Freber1977 (Talk | contribs) (28,665 bytes) (→See also) (undo) * (cur) (last) 15:48, 27 July 2007 74.86.28.230 (Talk) (28,645 bytes) (Revert linkspam) (undo) * (cur) (last) 14:48, 27 July 2007 70.223.237.63 (Talk) (28,740 bytes) (undo) * (cur) (last) 11:00, 18 July 2007 Afcyrus (Talk | contribs) (28,645 bytes) (was not a duplication. charlene is attempting to vandalize my contributions) (undo) * (cur) (last) 08:48, 18 July 2007 Charlene.fic (Talk | contribs) (28,609 bytes) (→Duplicate the electronic media (evidence)) (undo) * (cur) (last) 00:00, 18 July 2007 Afcyrus (Talk | contribs) (28,645 bytes) (→References) (undo) * (cur) (last) 00:00, 18 July 2007 Afcyrus (Talk | contribs) (28,644 bytes) (→References) (undo) * (cur) (last) 23:59, 17 July 2007 Afcyrus (Talk | contribs) (28,643 bytes) (→References) (undo) * (cur) (last) 23:58, 17 July 2007 Afcyrus (Talk | contribs) (28,639 bytes) (undo) * (cur) (last) 19:04, 17 July 2007 214.3.152.67 (Talk) (28,077 bytes) (→Duplicate the electronic media (evidence)) (undo) * (cur) (last) 19:02, 17 July 2007 214.3.152.67 (Talk) (28,074 bytes) (→Duplicate the hard drives) (undo) * (cur) (last) 15:54, 17 July 2007 85.177.200.74 (Talk) (26,757 bytes) (INternal UPS) (undo) * (cur) (last) 12:34, 15 July 2007 Ceyockey (Talk | contribs) m (26,779 bytes) (Disambiguate Sector to Disk sector using popups) (undo) * (cur) (last) 06:41, 14 July 2007 72.4.161.25 (Talk) (26,767 bytes) (Reverting linkspam) (undo) * (cur) (last) 04:13, 14 July 2007 75.74.8.225 (Talk) (26,843 bytes) (→External links - added link to multimediaforensics.com discussion forum) (undo) * (cur) (last) 09:04, 12 July 2007 212.44.19.206 (Talk) (26,767 bytes) (whitespace) (undo) * (cur) (last) 13:12, 9 July 2007 72.4.161.25 (Talk) (26,766 bytes) (Revert linkspam) (undo) * (cur) (last) 12:39, 9 July 2007 86.153.62.36 (Talk) (26,821 bytes) (→External links) (undo) * (cur) (last) 05:20, 6 July 2007 59.93.15.242 (Talk) (26,766 bytes) (→Example) (undo) * (cur) (last) 05:19, 6 July 2007 59.93.15.242 (Talk) (26,807 bytes) (→Example) (undo) * (cur) (last) 15:49, 27 June 2007 72.4.161.25 (Talk) (26,766 bytes) (Revert linkspam) (undo) * (cur) (last) 14:37, 27 June 2007 Withouttrace (Talk | contribs) (26,842 bytes) (→External links) (undo) * (cur) (last) 14:37, 27 June 2007 Withouttrace (Talk | contribs) (26,787 bytes) (→See also) (undo) * (cur) (last) 15:03, 25 June 2007 Rurik (Talk | contribs) (26,766 bytes) (Rv linkspam - there are hundreds of schools that teach computer forensic courses) (undo) * (cur) (last) 12:54, 25 June 2007 161.74.11.24 (Talk) (26,864 bytes) (→External links) (undo) * (cur) (last) 12:53, 25 June 2007 161.74.11.24 (Talk) (26,839 bytes) (added external link about studying computer forensics) (undo) * (cur) (last) 10:44, 22 June 2007 SmackBot (Talk | contribs) m (26,766 bytes) (Date/fix the maintenance tags or gen fixes) (undo) * (cur) (last) 19:27, 21 June 2007 BirgitteSB (Talk | contribs) m (26,751 bytes) (Wikipedia:Unreferenced articles; you can help!) (undo) * (cur) (last) 14:54, 19 June 2007 Rurik (Talk | contribs) m (26,768 bytes) (Removed accidental formatting) (undo) * (cur) (last) 14:53, 19 June 2007 Rurik (Talk | contribs) (26,784 bytes) (Undid revision 139205098 by 84.12.70.138 (talk) Stop posting commercial links) (undo) * (cur) (last) 14:23, 19 June 2007 84.12.70.138 (Talk) (27,070 bytes) (→Electronic evidence considerations) (undo) * (cur) (last) 14:23, 19 June 2007 84.12.70.138 (Talk) (27,071 bytes) (→Electronic evidence considerations) (undo) * (cur) (last) 15:09, 14 June 2007 89.149.205.164 (Talk) (26,768 bytes) (Reverting commercial linkspam from 7safe (again)) (undo) * (cur) (last) 15:03, 14 June 2007 84.12.70.138 (Talk) (26,844 bytes) (→External links) (undo) * (cur) (last) 11:43, 12 June 2007 89.149.205.164 (Talk) (26,768 bytes) (Revert commercial linkspam) (undo) * (cur) (last) 07:03, 12 June 2007 84.12.70.138 (Talk) (26,836 bytes) (→External links) (undo) * (cur) (last) 17:25, 9 June 2007 Editus Reloaded (Talk | contribs) (26,768 bytes) (→Related Journals) (undo) * (cur) (last) 17:24, 9 June 2007 Editus Reloaded (Talk | contribs) (26,751 bytes) (undo) * (cur) (last) 17:12, 9 June 2007 Asyndeton (Talk | contribs) (26,744 bytes) (added infobox) (undo) * (cur) (last) 21:58, 6 June 2007 78.12.76.81 (Talk) (26,724 bytes) (undo) * (cur) (last) 13:42, 5 June 2007 165.206.43.5 (Talk) (26,697 bytes) (undo) * (cur) (last) 02:14, 5 June 2007 57.67.17.100 (Talk) (26,674 bytes) (→Example) (undo) * (cur) (last) 02:13, 5 June 2007 57.67.17.100 (Talk) (26,673 bytes) (→Example) (undo) * (cur) (last) 10:26, 27 May 2007 64.34.176.139 (Talk) (26,696 bytes) (Reverting linkspam - the so called WikiCrimeLine page has no useful CF content at all. Please do not replace.) (undo) * (cur) (last) 07:35, 27 May 2007 Ron Barker (Talk | contribs) (26,798 bytes) (→External links - adding link to WikiCrimeLine Computer forensics) (undo) * (cur) (last) 09:53, 26 May 2007 64.34.176.139 (Talk) (26,696 bytes) (Reverting link to content empty page) (undo) * (cur) (last) 09:42, 26 May 2007 Ron Barker (Talk | contribs) (26,798 bytes) (→External links - adding link to WikiCrimeLine Computer forensics) (undo) * (cur) (last) 09:39, 26 May 2007 Ron Barker (Talk | contribs) (26,696 bytes) (→Computer forensic examples - adding == so that 'Example' becomes a heading as it was meant to be.) (undo) * (cur) (last) 05:56, 24 May 2007 Abune (Talk | contribs) m (26,692 bytes) (→See also) (undo) * (cur) (last) 05:29, 24 May 2007 210.212.236.21 (Talk) (26,664 bytes) (→Electronic evidence considerations) (undo) * (cur) (last) 11:43, 23 May 2007 H.sanat (Talk | contribs) m (26,669 bytes) (→Examine the Live System and record open applications - Internal link for EnCase) (undo) * (cur) (last) 20:22, 22 May 2007 216.246.78.14 (Talk) (26,665 bytes) (Revert linkspam) (undo) * (cur) (last) 18:56, 22 May 2007 155.212.77.26 (Talk) (26,722 bytes) (→External links) (undo) * (cur) (last) 12:33, 21 May 2007 GCarty (Talk | contribs) m (26,673 bytes) (→Examine the Live System and record open applications) (undo) * (cur) (last) 20:45, 20 May 2007 Moreschi (Talk | contribs) m (26,672 bytes) (Reverted edits by 24.193.215.247 (talk) to last version by 210.212.236.21) (undo) * (cur) (last) 20:45, 20 May 2007 24.193.215.247 (Talk) (2,215 bytes) (undo) * (cur) (last) 08:01, 15 May 2007 210.212.236.21 (Talk) (26,672 bytes) (→Electronic evidence considerations) (undo) * (cur) (last) 07:59, 15 May 2007 210.212.236.21 (Talk) (26,673 bytes) (→Electronic evidence considerations) (undo) * (cur) (last) 14:03, 13 May 2007 88.105.146.14 (Talk) (26,672 bytes) (Grammar) (undo) * (cur) (last) 10:50, 10 May 2007 64.34.176.139 (Talk) (26,692 bytes) (Revert linkspam) (undo) * (cur) (last) 09:05, 10 May 2007 84.12.70.138 (Talk) (26,745 bytes) (→External links) (undo) * (cur) (last) 11:20, 9 May 2007 64.34.176.139 (Talk) (26,692 bytes) (Rv. Linkspam) (undo) * (cur) (last) 10:51, 9 May 2007 Disklabs (Talk | contribs) m (29,264 bytes) (→External links) (undo) * (cur) (last) 10:49, 9 May 2007 Disklabs (Talk | contribs) m (29,282 bytes) (→External links) (undo) * (cur) (last) 10:49, 9 May 2007 Disklabs (Talk | contribs) (29,199 bytes) (→Related Journals) (undo) * (cur) (last) 10:48, 9 May 2007 Disklabs (Talk | contribs) m (29,262 bytes) (→Related Journals) (undo) * (cur) (last) 10:46, 9 May 2007 Disklabs (Talk | contribs) m (29,197 bytes) (→Computer forensic examples) (undo) * (cur) (last) 13:35, 8 May 2007 64.34.176.139 (Talk) (26,692 bytes) (Rv Linkspam) (undo) * (cur) (last) 13:19, 8 May 2007 207.229.150.60 (Talk) (26,797 bytes) (→External links) (undo) * (cur) (last) 08:00, 6 May 2007 Pmboogie (Talk | contribs) (26,692 bytes) (The value provided is 32 Bit Big Endian Hex Value: Unix - which is important for investigators to know) (undo) * (cur) (last) 19:06, 26 April 2007 131.128.82.122 (Talk) (26,657 bytes) (→Inspect for traps) (undo) * (cur) (last) 19:06, 26 April 2007 131.128.82.122 (Talk) (28,484 bytes) (→Inspect for traps) (undo) * (cur) (last) 16:18, 26 April 2007 66.79.171.86 (Talk) (28,470 bytes) (Revert linkspam) (undo) * (cur) (last) 15:54, 26 April 2007 195.130.154.150 (Talk) (28,521 bytes) (undo) * (cur) (last) 07:58, 26 April 2007 Epitome83 (Talk | contribs) m (28,470 bytes) (→Example one) (undo) * (cur) (last) 14:24, 23 April 2007 66.79.171.86 (Talk) (28,471 bytes) (Reverting out unsuitable 'general security' reference link.) (undo) * (cur) (last) 14:13, 23 April 2007 24.127.11.31 (Talk) (28,540 bytes) (→Related Journals) (undo) * (cur) (last) 12:31, 20 April 2007 Dave Cohoe (Talk | contribs) (28,471 bytes) (→Example two - fix awkward wording) (undo) * (cur) (last) 12:28, 20 April 2007 Dave Cohoe (Talk | contribs) (28,530 bytes) (→Example one - fix awkward wording) (undo) * (cur) (last) 23:42, 18 April 2007 69.255.171.97 (Talk) (undo) * (cur) (last) 14:13, 16 April 2007 Rurik (Talk | contribs) (Undid revision 122878838 by 216.93.153.82 (talk)) (undo) * (cur) (last) 01:00, 15 April 2007 216.93.153.82 (Talk) (→Understand the suspects) (undo) * (cur) (last) 17:58, 13 April 2007 MartinBot (Talk | contribs) m (BOT - rv 205.157.149.151 (talk) to last version by Nivix) (undo) * (cur) (last) 17:58, 13 April 2007 205.157.149.151 (Talk) (→Examine the machine's surroundings) (undo) * (cur) (last) 17:56, 13 April 2007 Nivix (Talk | contribs) m (Reverted 2 edits by 205.157.149.151 identified as vandalism to last revision by Public Menace. using TW) (undo) * (cur) (last) 17:56, 13 April 2007 205.157.149.151 (Talk) (→Examine the machine's surroundings) (undo) * (cur) (last) 17:55, 13 April 2007 205.157.149.151 (Talk) (→Examine the machine's surroundings) (undo) * (cur) (last) 17:53, 13 April 2007 Public Menace (Talk | contribs) m (→Example three - changed 'employees' to 'employees' ' to indicate plural possession) (undo) * (cur) (last) 19:24, 2 April 2007 192.92.62.147 (Talk) (→Examine the Live System and record open applications) (undo) * (cur) (last) 23:15, 30 March 2007 72.18.138.210 (Talk) (Rv rmv linkspam) (undo) * (cur) (last) 21:27, 30 March 2007 Pndfam05 (Talk | contribs) (→External links - adedd TUCOFS link) (undo) * (cur) (last) 21:05, 30 March 2007 Abune (Talk | contribs) m (→Comparison to Physical Forensics) (undo) * (cur) (last) 20:46, 30 March 2007 Abune (Talk | contribs) m (→Examine the Live System and record open applications) (undo) * (cur) (last) 20:45, 30 March 2007 Abune (Talk | contribs) m (→Examine the Live System and record open applications) (undo) * (cur) (last) 20:21, 30 March 2007 Abune (Talk | contribs) m (→Examine the Live System and record open applications) (undo) * (cur) (last) 20:18, 30 March 2007 Abune (Talk | contribs) m (→Examine the Live System and record open applications) (undo) * (cur) (last) 20:16, 30 March 2007 Abune (Talk | contribs) m (→Examine the Live System and record open applications) (undo) * (cur) (last) 20:14, 30 March 2007 Abune (Talk | contribs) m (undo) * (cur) (last) 20:13, 30 March 2007 Abune (Talk | contribs) m (undo) * (cur) (last) 20:09, 30 March 2007 Abune (Talk | contribs) m (→References) (undo) * (cur) (last) 19:49, 30 March 2007 El C (Talk | contribs) m (Reverted edits by 155.212.77.26 (talk) to last version by Snowbot) (undo) * (cur) (last) 19:40, 30 March 2007 155.212.77.26 (Talk) (→Related Journals) (undo) * (cur) (last) 13:15, 23 March 2007 Snowbot (Talk | contribs) m (trashing Category:Criminology topics per CFD) (undo) * (cur) (last) 15:00, 21 March 2007 200.169.33.95 (Talk) (→Related Journals) (undo) * (cur) (last) 10:32, 19 March 2007 DarK AQ (Talk | contribs) m (Fixed a typo - inlcude --> include) (undo) * (cur) (last) 15:30, 15 March 2007 63.229.28.158 (Talk) (→Inspect for traps) (undo) * (cur) (last) 15:18, 15 March 2007 63.229.28.158 (Talk) (→Secure the machine and the data) (undo) * (cur) (last) 15:13, 15 March 2007 63.229.28.158 (Talk) (→Record open applications) (undo) * (cur) (last) 15:12, 15 March 2007 63.229.28.158 (Talk) (→Record open applications) (undo) * (cur) (last) 21:36, 13 March 2007 63.162.143.21 (Talk) (→Electronic evidence considerations) (undo) * (cur) (last) 22:27, 8 March 2007 62.241.187.59 (Talk) (undo) * (cur) (last) 21:32, 8 March 2007 ChrisWagoner (Talk | contribs) (undo) * (cur) (last) 17:09, 7 March 2007 66.98.130.224 (Talk) (Reverting linkspam again.) (undo) * (cur) (last) 12:01, 7 March 2007 24.30.23.132 (Talk) (→Related Journals) (undo) * (cur) (last) 11:59, 7 March 2007 24.30.23.132 (Talk) (→External links) (undo) * (cur) (last) 07:27, 7 March 2007 67.15.77.161 (Talk) (Revert linkspam) (undo) * (cur) (last) 02:33, 7 March 2007 24.30.23.132 (Talk) (→External links) (undo) * (cur) (last) 02:33, 7 March 2007 24.30.23.132 (Talk) (→Related Journals) (undo) * (cur) (last) 02:31, 7 March 2007 24.30.23.132 (Talk) (→External links) (undo) * (cur) (last) 17:26, 6 March 2007 66.98.130.224 (Talk) (Rv: linkspam) (undo) * (cur) (last) 14:19, 6 March 2007 70.50.200.105 (Talk) (→External links) (undo) * (cur) (last) 17:18, 27 February 2007 Binarygal (Talk | contribs) (Clearing vandalism through article revert) (undo) * (cur) (last) 13:38, 27 February 2007 59.92.130.113 (Talk) (→Comparison to Physical Forensics) (undo) * (cur) (last) 07:38, 27 February 2007 67.15.77.183 (Talk) (Revert linkspam) (undo) * (cur) (last) 19:39, 26 February 2007 70.89.100.98 (Talk) (→External links) (undo) * (cur) (last) 19:50, 24 February 2007 Golden Wattle (Talk | contribs) m (Reverted edits by 158.135.1.91 (talk) to last version by SmackBot) (undo) * (cur) (last) 19:43, 24 February 2007 158.135.1.91 (Talk) (undo) * (cur) (last) 23:07, 20 February 2007 SmackBot (Talk | contribs) m (Date/fix maintenance tags) (undo) * (cur) (last) 21:59, 20 February 2007 Rich Farmbrough (Talk | contribs) m (Reverted edits by SmackBot (talk) to last version by Mrld) (undo) * (cur) (last) 18:43, 20 February 2007 SmackBot (Talk | contribs) m (Date/fix maintenance tags) (undo) * (cur) (last) 01:43, 20 February 2007 Mrld (Talk | contribs) (I put a merge on the page) (undo) * (cur) (last) 01:30, 20 February 2007 209.6.203.212 (Talk) (undo) * (cur) (last) 01:20, 20 February 2007 209.6.203.212 (Talk) (→Common Analysis Tools) (undo) * (cur) (last) 01:19, 20 February 2007 209.6.203.212 (Talk) (undo) * (cur) (last) 01:18, 20 February 2007 209.6.203.212 (Talk) (undo) * (cur) (last) 01:13, 20 February 2007 209.6.203.212 (Talk) (undo) * (cur) (last) 00:59, 20 February 2007 209.6.203.212 (Talk) (→Related Journals) (undo) * (cur) (last) 12:42, 19 February 2007 Xx0033 (Talk | contribs) m (undo) * (cur) (last) 03:38, 17 February 2007 Amars (Talk | contribs) (→Example two) (undo) * (cur) (last) 11:32, 16 February 2007 66.98.131.13 (Talk) (Revert to clean up after serial link spammer insertion) (undo) * (cur) (last) 10:24, 16 February 2007 Praveen Dalal (Talk | contribs) (undo) * (cur) (last) 10:08, 16 February 2007 Praveen Dalal (Talk | contribs) (undo) * (cur) (last) 16:56, 13 February 2007 Jerzy (Talk | contribs) (→Example one - lk Chandra Levy) (undo) * (cur) (last) 11:48, 12 February 2007 STBotD (Talk | contribs) m (robot Modifying: pl:Informatyka śledcza) (undo) * (cur) (last) 11:51, 28 January 2007 Frap (Talk | contribs) (Restructuring, capitalization, misc) (undo) * (cur) (last) 14:29, 23 January 2007 Binarygal (Talk | contribs) (Restoring page following vandalism) (undo) * (cur) (last) 14:22, 23 January 2007 72.20.128.66 (Talk) (←Replaced page with 'booty booty booty') (undo) * (cur) (last) 14:42, 19 January 2007 66.98.131.200 (Talk) (Reverting out the latest Adsense fuelled linkspam) (undo) * (cur) (last) 14:23, 19 January 2007 Shumdw (Talk | contribs) (undo) * (cur) (last) 16:29, 11 January 2007 84.12.27.162 (Talk) (undo) * (cur) (last) 15:31, 11 January 2007 Rurik (Talk | contribs) (Major: Rewrite/reduction of "Power Down Carefully" section) (undo) * (cur) (last) 22:28, 5 January 2007 Thiseye (Talk | contribs) m (Limited spellcheck + minor fixes READ ME, Replaced: likelyhood → likelihood using AWB) (undo) * (cur) (last) 09:17, 5 January 2007 66.98.130.225 (Talk) (Revert out linkspam repetition) (undo) * (cur) (last) 02:18, 5 January 2007 69.255.182.49 (Talk) (→External links) (undo) * (cur) (last) 15:00, 3 January 2007 216.208.35.131 (Talk) (→Power down carefully) (undo) * (cur) (last) 16:47, 2 January 2007 66.98.130.128 (Talk) (Delete out paper thin linkspam effort) (undo) * (cur) (last) 14:00, 2 January 2007 Smoshlak (Talk | contribs) m (The Definition of Computer Forensics and it's reference and an appropriate link for the author.) (undo) * (cur) (last) 01:59, 13 December 2006 Splintercellguy (Talk | contribs) (undo) * (cur) (last) 13:24, 6 December 2006 194.66.175.70 (Talk) (→Record open applications) (undo) * (cur) (last) 03:21, 4 December 2006 Krellis (Talk | contribs) m (spelling corrections) (undo) * (cur) (last) 03:16, 4 December 2006 210.8.141.253 (Talk) (→Duplicate the hard drives) (undo) * (cur) (last) 10:00, 2 December 2006 66.98.130.225 (Talk) (Reverse out commercial nonsense) (undo) * (cur) (last) 01:26, 2 December 2006 207.194.211.11 (Talk) (→External links) (undo) * (cur) (last) 08:37, 30 November 2006 SmackBot (Talk | contribs) m (Date the unreferenced tag (approx) using AWB) (undo) * (cur) (last) 00:51, 29 November 2006 SmackBot (Talk | contribs) m (Date the maintenance tags using AWB) (undo) * (cur) (last) 22:58, 25 November 2006 Binarygal (Talk | contribs) (Recovery from vandalism.) (undo) * (cur) (last) 21:55, 25 November 2006 63.3.16.129 (Talk) (undo) * (cur) (last) 21:52, 25 November 2006 63.3.16.129 (Talk) (fuck) (undo) * (cur) (last) 21:51, 25 November 2006 63.3.16.129 (Talk) (undo) * (cur) (last) 13:55, 24 November 2006 66.98.131.111 (Talk) (This seg (software) is getting way out of hand. Moved to discussion. This isn't a directory of the thousands of related software products.) (undo) * (cur) (last) 13:54, 24 November 2006 66.98.131.111 (Talk) (Tidy) (undo) * (cur) (last) 12:57, 24 November 2006 195.130.154.150 (Talk) (→Software) (undo) * (cur) (last) 01:59, 22 November 2006 64.81.115.252 (Talk) (→Software - Added WFT and added company for Helix) (undo) * (cur) (last) 17:49, 11 November 2006 213.84.174.116 (Talk) (→Example Two) (undo) * (cur) (last) 09:10, 8 November 2006 67.15.76.111 (Talk) (Revert. No way can start listing books here. The list would never end! Please refrain.) (undo) * (cur) (last) 04:12, 8 November 2006 67.151.170.141 (Talk) (→Related Journals) (undo) * (cur) (last) 04:09, 8 November 2006 67.151.170.141 (Talk) (→External links) (undo) * (cur) (last) 21:15, 5 November 2006 Appraiser (Talk | contribs) (clean up using AWB) (undo) * (cur) (last) 22:01, 26 October 2006 Rurik (Talk | contribs) (Removed vandalism) (undo) * (cur) (last) 14:04, 26 October 2006 Binarygal (Talk | contribs) (→Record open applications - Delete vandalism) (undo) * (cur) (last) 12:56, 26 October 2006 137.240.136.81 (Talk) (→Record open applications) (undo) * (cur) (last) 12:55, 26 October 2006 137.240.136.81 (Talk) (→Record open applications) (undo) * (cur) (last) 23:01, 25 October 2006 Webucation (Talk | contribs) m (→See also) (undo) * (cur) (last) 23:01, 25 October 2006 Webucation (Talk | contribs) (→See also) (undo) * (cur) (last) 17:59, 25 October 2006 69.27.252.245 (Talk) (→Record open applications) (undo) * (cur) (last) 17:54, 25 October 2006 67.15.76.112 (Talk) (Revert linkspam by 'TheWeasel' who has spammed his company across several wiki pages, not just this one. See his history.) (undo) * (cur) (last) 17:53, 25 October 2006 69.27.252.245 (Talk) (→Record open applications) (undo) * (cur) (last) 16:30, 25 October 2006 TheWeasel (Talk | contribs) (Added MacForensicsLab software for Mac OS X) (undo) * (cur) (last) 15:54, 25 October 2006 216.69.63.254 (Talk) (→Example One) (undo) * (cur) (last) 04:33, 20 October 2006 24.239.132.234 (Talk) (→Software) (undo) * (cur) (last) 06:57, 19 October 2006 207.44.237.18 (Talk) (Revert to remove blatant advert.) (undo) * (cur) (last) 03:37, 19 October 2006 TheWeasel (Talk | contribs) (Added MacForensicsLab. The leading forensic suite for Mac forensics, used by several US and worldwide government branches.) (undo) * (cur) (last) 16:55, 17 October 2006 Praveen Dalal (Talk | contribs) (Computer forensics is techno-legal in nature) (undo) * (cur) (last) 14:53, 16 October 2006 PinchasC (Talk | contribs) m (Reverted edits by Zorry (talk) to last version by 70.84.56.175) (undo) * (cur) (last) 11:12, 16 October 2006 Zorry (Talk | contribs) (undo) * (cur) (last) 09:23, 16 October 2006 70.84.56.175 (Talk) (Rv: Removal of blogspam (again). Please do not use the wiki to promote your blog/opinions.) (undo) * (cur) (last) 07:52, 16 October 2006 Zorry (Talk | contribs) (undo) * (cur) (last) 07:46, 16 October 2006 Zorry (Talk | contribs) (undo) * (cur) (last) 07:44, 16 October 2006 Zorry (Talk | contribs) (undo) * (cur) (last) 07:42, 16 October 2006 Zorry (Talk | contribs) (undo) * (cur) (last) 07:01, 16 October 2006 70.85.195.229 (Talk) (Rv: Link spam (Another self opinionated 'blog' link)) (undo) * (cur) (last) 04:16, 16 October 2006 Zorry (Talk | contribs) (undo) * (cur) (last) 02:36, 15 October 2006 124.197.12.66 (Talk) (→Example Two) (undo) * (cur) (last) 11:27, 6 October 2006 58.68.83.130 (Talk) (→Understand the suspects) (undo) * (cur) (last) 15:43, 2 October 2006 69.33.111.74 (Talk) (→External links) (undo) * (cur) (last) 15:42, 2 October 2006 69.33.111.74 (Talk) (→External links) (undo) * (cur) (last) 20:34, 24 September 2006 207.44.237.18 (Talk) (Reverting to last stable page following link spamming.) (undo) * (cur) (last) 18:47, 24 September 2006 140.247.241.29 (Talk) (→External links) (undo) * (cur) (last) 18:47, 24 September 2006 140.247.241.29 (Talk) (undo) * (cur) (last) 17:28, 24 September 2006 67.15.76.114 (Talk) (Revert: dup link) (undo) * (cur) (last) 16:38, 24 September 2006 140.247.62.201 (Talk) (→External links) (undo) * (cur) (last) 13:43, 24 September 2006 62.140.137.30 (Talk) (→External links) (undo) * (cur) (last) 22:54, 17 September 2006 Newsmare (Talk | contribs) (→Record open applications - expanded on data recovery from solid state memory, with Gutmann cite) (undo) * (cur) (last) 11:21, 11 September 2006 66.98.131.109 (Talk) (Rv: Linkspam clensing) (undo) * (cur) (last) 06:09, 11 September 2006 59.176.63.100 (Talk) (→External links) (undo) * (cur) (last) 06:45, 7 September 2006 67.15.76.110 (Talk) (Revert out spamlink) (undo) * (cur) (last) 04:34, 7 September 2006 Frank Kai Fat Chow (Talk | contribs) (→External links) (undo) * (cur) (last) 02:38, 7 September 2006 Rurik (Talk | contribs) (Rmvd repetitive addition - same gist as bullet points at beginning, and out of place) (undo) * (cur) (last) 00:56, 7 September 2006 128.172.220.5 (Talk) (→Understand the suspects) (undo) * (cur) (last) 16:20, 6 September 2006 Sanguinity (Talk | contribs) m (→Electronic Evidence Considerations - Disambiguation link repair - You can help!) (undo) * (cur) (last) 20:22, 5 September 2006 63.116.153.5 (Talk) (→Software) (undo) * (cur) (last) 20:21, 5 September 2006 63.116.153.5 (Talk) (→Software) (undo) * (cur) (last) 21:20, 1 September 2006 70.85.195.228 (Talk) (Delete crude link spam and misc) (undo) * (cur) (last) 20:56, 1 September 2006 72.16.197.162 (Talk) (→External links) (undo) * (cur) (last) 16:21, 26 August 2006 Rmislan (Talk | contribs) (→See also) (undo) * (cur) (last) 16:21, 26 August 2006 Rmislan (Talk | contribs) (→External links) (undo) * (cur) (last) 16:20, 26 August 2006 Rmislan (Talk | contribs) (→External links) (undo) * (cur) (last) 16:20, 26 August 2006 Rmislan (Talk | contribs) (→Related Journals) (undo) * (cur) (last) 14:52, 25 August 2006 67.15.76.110 (Talk) (Rv: linkspam. This isn't a directory and the existing links are already comprehensive) (undo) * (cur) (last) 14:36, 25 August 2006 80.126.20.42 (Talk) (→External links) (undo) * (cur) (last) 01:20, 23 August 2006 Midnightcomm (Talk | contribs) m (→Example Three - heading level) (undo) * (cur) (last) 01:20, 23 August 2006 Midnightcomm (Talk | contribs) (→Computer Forensic Examples - cleanup) (undo) * (cur) (last) 18:15, 22 August 2006 68.99.206.96 (Talk) (→Software) (undo) * (cur) (last) 00:50, 20 August 2006 Centrx (Talk | contribs) (Not a copyright violation: The alleged site copied it /from/ Wikipedia, based on reviewing dates and page history) (undo) * (cur) (last) 17:02, 27 July 2006 Rattatosk (Talk | contribs) (copyvio) (undo) * (cur) (last) 19:14, 25 July 2006 80.189.172.216 (Talk) (Rv: Remove too general a link (PDF) and too issue specific link (to blog)) (undo) * (cur) (last) 19:02, 25 July 2006 70.132.171.54 (Talk) (→External links) (undo) * (cur) (last) 16:13, 24 July 2006 65.242.114.226 (Talk) (undo) * (cur) (last) 07:34, 23 July 2006 Chris83 (Talk | contribs) m (Disambiguate Server to Server (computing) using popups) (undo) * (cur) (last) 16:28, 22 July 2006 84.12.195.145 (Talk) (→Electronic Evidence Considerations) (undo) * (cur) (last) 15:35, 17 July 2006 80.189.172.4 (Talk) (Rv to remove link spam to commercial nonsense.) (undo) * (cur) (last) 14:23, 17 July 2006 Variables (Talk | contribs) (→External links) (undo) * (cur) (last) 15:41, 7 July 2006 217.252.171.195 (Talk) (→External links) (undo) * (cur) (last) 11:32, 7 July 2006 Reedy Boy (Talk | contribs) (clean up & adding Category:Criminology topics to replace list using AWB) (undo) * (cur) (last) 23:08, 26 June 2006 Cappleby-dborkowski (Talk | contribs) (→Examine the machine's surroundings) (undo) * (cur) (last) 23:02, 26 June 2006 Cappleby-dborkowski (Talk | contribs) (→Electronic Evidence Considerations) (undo) * (cur) (last) 23:01, 26 June 2006 Cappleby-dborkowski (Talk | contribs) (→Electronic Evidence Considerations) (undo) * (cur) (last) 15:27, 26 June 2006 Cloizides mmacnicol (Talk | contribs) (undo) * (cur) (last) 02:43, 23 June 2006 60.49.64.39 (Talk) (→See also) (undo) * (cur) (last) 15:05, 20 June 2006 Cinnamon42 (Talk | contribs) m (rv - linkspam) (undo) * (cur) (last) 14:00, 20 June 2006 65.196.52.2 (Talk) (undo) * (cur) (last) 23:52, 19 June 2006 GraemeL (Talk | contribs) m (Reverted edits by 68.198.199.159 (talk) to last version by Arichnad) (undo) * (cur) (last) 23:51, 19 June 2006 68.198.199.159 (Talk) (→External links) (undo) * (cur) (last) 17:38, 12 June 2006 Arichnad (Talk | contribs) (→Record open applications - fixed spelling, added wikiformatting. not even sure if this sentence should be here at all: Wikipedia:No original research) (undo) * (cur) (last) 04:34, 11 June 2006 128.175.241.2 (Talk) (→Secure the machine and the data) (undo) * (cur) (last) 04:46, 10 June 2006 Arichnad (Talk | contribs) m (→E-mail Headers - fixed wiki markup) (undo) * (cur) (last) 20:24, 8 June 2006 65.196.52.2 (Talk) (undo) * (cur) (last) 15:51, 8 June 2006 65.196.52.2 (Talk) (undo) * (cur) (last) 19:21, 2 June 2006 Zzuuzz (Talk | contribs) (link cleanup (WP:EL)) (undo) * (cur) (last) 18:49, 2 June 2006 63.116.153.5 (Talk) (→Software) (undo) * (cur) (last) 18:48, 2 June 2006 63.116.153.5 (Talk) (→Software) (undo) * (cur) (last) 19:53, 1 June 2006 62.206.8.4 (Talk) (→Record open applications) (undo) * (cur) (last) 04:47, 28 May 2006 210.84.25.86 (Talk) (→External links) (undo) * (cur) (last) 22:19, 24 May 2006 64.60.108.59 (Talk) (→Software) (undo) * (cur) (last) 23:18, 22 May 2006 DGX (Talk | contribs) (rvt) (undo) * (cur) (last) 23:16, 22 May 2006 210.86.121.154 (Talk) (→Electronic Evidence Considerations) (undo) * (cur) (last) 17:15, 14 May 2006 80.189.50.146 (Talk) (Dup and spam link clear out) (undo) * (cur) (last) 12:37, 13 May 2006 Waggers (Talk | contribs) m (clean up & grammar fix ("different than/to" to "different from") using AWB) (undo) * (cur) (last) 15:28, 7 May 2006 24.98.102.117 (Talk) (→External links) (undo) * (cur) (last) 02:09, 4 May 2006 Frap (Talk | contribs) m (→External links) (undo) * (cur) (last) 02:07, 4 May 2006 Frap (Talk | contribs) m (undo) * (cur) (last) 02:03, 4 May 2006 Frap (Talk | contribs) (misc fixes) (undo) * (cur) (last) 01:46, 4 May 2006 Frap (Talk | contribs) (→Power down carefully - nicer table) (undo) * (cur) (last) 23:53, 29 April 2006 Randy Johnston (Talk | contribs) (Revert to revision dated 16:59, 22 April 2006 by Midnightcomm, oldid 49665694 using popups) (undo) * (cur) (last) 23:43, 29 April 2006 210.212.48.3 (Talk) (→External links) (undo) * (cur) (last) 23:42, 29 April 2006 210.212.48.3 (Talk) (→External links) (undo) * (cur) (last) 23:40, 29 April 2006 210.212.48.3 (Talk) (→Software) (undo) * (cur) (last) 23:38, 29 April 2006 210.212.48.3 (Talk) (→Software) (undo) * (cur) (last) 22:59, 22 April 2006 Midnightcomm (Talk | contribs) (→E-mail Headers) (undo) * (cur) (last) 22:52, 22 April 2006 Midnightcomm (Talk | contribs) (→Inspect for traps) (undo) * (cur) (last) 22:44, 22 April 2006 Midnightcomm (Talk | contribs) (→Inspect for traps - seealso) (undo) * (cur) (last) 20:04, 20 April 2006 82.108.12.170 (Talk) (→Understand the suspects) (undo) * (cur) (last) 06:27, 20 April 2006 Mboverload (Talk | contribs) m (Unicodifyed article and did a very quick lookover using AWB) (undo) * (cur) (last) 01:06, 20 April 2006 24.193.242.220 (Talk) (undo) * (cur) (last) 01:05, 20 April 2006 24.193.242.220 (Talk) (undo) * (cur) (last) 18:43, 10 April 2006 JonHarder (Talk | contribs) (Sharpen category.) (undo) * (cur) (last) 14:03, 10 April 2006 216.73.33.154 (Talk) (undo) * (cur) (last) 11:32, 8 April 2006 YurikBot (Talk | contribs) m (robot Adding: ru:Программно-техническая экспертиза) (undo) * (cur) (last) 08:54, 8 April 2006 80.189.167.71 (Talk) (Orig wiki) (undo) * (cur) (last) 21:18, 7 April 2006 Ligulem (Talk | contribs) (replacing deprecated with ) (undo) * (cur) (last) 13:10, 5 April 2006 Zzuuzz (Talk | contribs) m (rvt) (undo) * (cur) (last) 12:34, 5 April 2006 141.154.179.140 (Talk) (→Inspect for traps) (undo) * (cur) (last) 22:57, 4 April 2006 Zzuuzz (Talk | contribs) (undo) * (cur) (last) 22:47, 4 April 2006 Pseudo clever (Talk | contribs) (→Electronic Evidence Considerations) (undo) * (cur) (last) 16:23, 3 April 2006 142.165.49.201 (Talk) (undo) * (cur) (last) 16:20, 3 April 2006 142.165.49.201 (Talk) (undo) * (cur) (last) 02:39, 2 April 2006 Mrmiscellanious (Talk | contribs) (→Secure the machine and the data - Replace copyrighted image with free-license) (undo) * (cur) (last) 05:35, 29 March 2006 216.80.50.198 (Talk) (→See also) (undo) * (cur) (last) 23:48, 21 March 2006 84.56.36.54 (Talk) (→External links - Computer Forensics Wik.) (undo) * (cur) (last) 22:30, 21 March 2006 YurikBot (Talk | contribs) m (robot Adding: pl:Computer Forensics) (undo) * (cur) (last) 17:03, 7 March 2006 Tizio (Talk | contribs) m (I agree the link is useless, but you reintroduced it!) (undo) * (cur) (last) 16:45, 7 March 2006 Rklawton (Talk | contribs) (removed useless link) (undo) * (cur) (last) 15:09, 7 March 2006 65.125.73.4 (Talk) (undo) * (cur) (last) 04:49, 5 March 2006 B-Con (Talk | contribs) (There was an awkward phase that my edit made more awkward, even incorrect. Fixed.) (undo) * (cur) (last) 04:46, 5 March 2006 B-Con (Talk | contribs) (MD5 IS still acceptable for this purpose, it just should not be trusted in circumstances where the origonal document can be altered.) (undo) * (cur) (last) 08:38, 3 March 2006 Dancontiki (Talk | contribs) (→Electronic Evidence Considerations) (undo) * (cur) (last) 16:41, 24 February 2006 148.81.137.2 (Talk) (→E-mail Headers - fixed) (undo) * (cur) (last) 16:31, 24 February 2006 148.81.137.2 (Talk) (→E-mail Headers - how to do it without space after and before?) (undo) * (cur) (last) 09:06, 24 February 2006 Alistair.phillips1 (Talk | contribs) (→External links) (undo) * (cur) (last) 06:16, 24 February 2006 Khoikhoi (Talk | contribs) (if it's not true, delete it!) (undo) * (cur) (last) 06:14, 24 February 2006 24.118.140.53 (Talk) (→Examine the machine's surroundings) (undo) * (cur) (last) 08:12, 20 February 2006 Robert Bond (Talk | contribs) m (→Power down carefully) (undo) * (cur) (last) 08:05, 20 February 2006 Robert Bond (Talk | contribs) m (undo) * (cur) (last) 07:35, 20 February 2006 Robert Bond (Talk | contribs) m (undo) * (cur) (last) 02:48, 16 February 2006 Gajedi (Talk | contribs) (undo) * (cur) (last) 02:45, 16 February 2006 DanielCD (Talk | contribs) (undo) * (cur) (last) 02:40, 16 February 2006 Gajedi (Talk | contribs) (undo) * (cur) (last) 22:57, 9 February 2006 Khanssen (Talk | contribs) (undo) * (cur) (last) 11:37, 3 February 2006 Tizio (Talk | contribs) (→References - conference reference template) (undo) * (cur) (last) 21:52, 2 February 2006 DanielCD (Talk | contribs) (→References - tweak ref, add affiliated University) (undo) * (cur) (last) 21:23, 2 February 2006 Długosz (Talk | contribs) m (→Inspect for traps) (undo) * (cur) (last) 21:22, 2 February 2006 Długosz (Talk | contribs) m (→Inspect for traps - mdash) (undo) * (cur) (last) 16:39, 28 January 2006 Tizio (Talk | contribs) m (→Examine the machine's surroundings - skip redirect) (undo) * (cur) (last) 16:38, 28 January 2006 Tizio (Talk | contribs) (split first sentence, remove reference to laptop, etc. remove must (this is not a guide)) (undo) * (cur) (last) 19:44, 27 January 2006 DanielCD (Talk | contribs) m (Reverted edits by 206.207.175.145 (talk) to last version by 213.152.38.162) (undo) * (cur) (last) 16:49, 27 January 2006 206.207.175.145 (Talk) (→Record open applications) (undo) * (cur) (last) 16:48, 23 January 2006 213.152.38.162 (Talk) (→Electronic Evidence Considerations) (undo) * (cur) (last) 16:47, 23 January 2006 213.152.38.162 (Talk) (→Electronic Evidence Considerations) (undo) * (cur) (last) 07:49, 19 January 2006 Algae (Talk | contribs) (rv link spam to last version by 80.47.70.170) (undo) * (cur) (last) 03:37, 19 January 2006 71.133.92.255 (Talk) (→Software) (undo) * (cur) (last) 14:10, 18 January 2006 80.47.70.170 (Talk) (Add ref to cw forum) (undo) * (cur) (last) 11:29, 18 January 2006 AlMac (Talk | contribs) (→See also) (undo) * (cur) (last) 11:28, 18 January 2006 AlMac (Talk | contribs) (→See also) (undo) * (cur) (last) 08:43, 18 January 2006 Algae (Talk | contribs) (rv link spam to last version by Algae) (undo) * (cur) (last) 04:34, 18 January 2006 203.212.242.40 (Talk) (→External links) (undo) * (cur) (last) 08:50, 16 January 2006 Algae (Talk | contribs) (rv link spam to last version by TimBentley) (undo) * (cur) (last) 05:57, 16 January 2006 216.80.50.198 (Talk) (→External links) (undo) * (cur) (last) 05:14, 16 January 2006 TimBentley (Talk | contribs) m (Corrected link to disambiguation page. (you can help!)) (undo) * (cur) (last) 23:31, 12 January 2006 Algae (Talk | contribs) (rv link spam to last version by Algae) (undo) * (cur) (last) 22:53, 12 January 2006 70.132.171.54 (Talk) (→External links) (undo) * (cur) (last) 22:52, 12 January 2006 70.132.171.54 (Talk) (→External links) (undo) * (cur) (last) 22:38, 10 January 2006 Algae (Talk | contribs) (rv link spam to last version by 65.220.79.4) (undo) * (cur) (last) 21:39, 10 January 2006 207.245.34.150 (Talk) (→Services & Software) (undo) * (cur) (last) 20:17, 8 January 2006 65.220.79.4 (Talk) (→External links) (undo) * (cur) (last) 19:45, 30 December 2005 24.98.116.112 (Talk) (→External links) (undo) * (cur) (last) 18:00, 30 December 2005 Algae (Talk | contribs) (rv unrelated commercial link) (undo) * (cur) (last) 07:16, 30 December 2005 66.56.21.102 (Talk) (→External links) (undo) * (cur) (last) 07:15, 30 December 2005 66.56.21.102 (Talk) (→Software) (undo) * (cur) (last) 07:15, 30 December 2005 66.56.21.102 (Talk) (→Software) (undo) * (cur) (last) 22:45, 29 December 2005 Algae (Talk | contribs) (rv link spam to last version by Algae) (undo) * (cur) (last) 18:36, 27 December 2005 70.132.171.54 (Talk) (→External links) (undo) * (cur) (last) 18:36, 27 December 2005 70.132.171.54 (Talk) (→External links) (undo) * (cur) (last) 22:05, 21 December 2005 Algae (Talk | contribs) (→Software - rm commercial offerings) (undo) * (cur) (last) 20:53, 21 December 2005 71.103.113.42 (Talk) (→Software) (undo) * (cur) (last) 17:19, 20 December 2005 Algae (Talk | contribs) m (→External links - fmt) (undo) * (cur) (last) 17:19, 20 December 2005 Algae (Talk | contribs) (de:, nuke external links (see talk)) (undo) * (cur) (last) 16:13, 20 December 2005 81.153.83.174 (Talk) (→External links) (undo) * (cur) (last) 10:06, 20 December 2005 210.18.109.10 (Talk) (→External links) (undo) * (cur) (last) 06:12, 15 December 2005 64.231.233.242 (Talk) (→External links) (undo) * (cur) (last) 21:53, 14 December 2005 70.132.171.54 (Talk) (→External links) (undo) * (cur) (last) 17:19, 8 December 2005 128.186.122.118 (Talk) (→Duplicate the hard drives) (undo) * (cur) (last) 16:52, 8 December 2005 128.186.122.118 (Talk) (undo) * (cur) (last) 16:51, 8 December 2005 128.186.122.118 (Talk) (undo) * (cur) (last) 16:50, 8 December 2005 128.186.122.118 (Talk) (→Duplicate the hard drives) (undo) * (cur) (last) 16:40, 3 December 2005 213.123.217.135 (Talk) (→External links) (undo) * (cur) (last) 21:13, 30 November 2005 68.236.175.148 (Talk) (→External links) (undo) * (cur) (last) 21:13, 30 November 2005 68.236.175.148 (Talk) (→External links) (undo) * (cur) (last) 15:40, 30 November 2005 68.236.175.148 (Talk) (→External links) (undo) * (cur) (last) 15:37, 30 November 2005 68.236.175.148 (Talk) (→External links) (undo) * (cur) (last) 15:36, 30 November 2005 68.236.175.148 (Talk) (→External links) (undo) * (cur) (last) 21:44, 28 November 2005 216.64.87.106 (Talk) (→External links) (undo) * (cur) (last) 10:43, 27 November 2005 Aluion (Talk | contribs) m (Commenting out self-reference) (undo) * (cur) (last) 12:29, 25 November 2005 200.169.33.111 (Talk) (→Understand the suspects) (undo) * (cur) (last) 12:27, 25 November 2005 200.169.33.111 (Talk) (→Understand the suspects) (undo) * (cur) (last) 10:13, 24 November 2005 217.34.253.105 (Talk) (→External links) (undo) * (cur) (last) 10:12, 24 November 2005 217.34.253.105 (Talk) (→External links) (undo) * (cur) (last) 16:00, 15 November 2005 80.126.20.42 (Talk) (→External links) (undo) * (cur) (last) 15:59, 15 November 2005 80.126.20.42 (Talk) (→External links) (undo) * (cur) (last) 12:31, 11 November 2005 The Anome (Talk | contribs) m (Reverted edits by 82.110.42.4 to last version by 68.67.217.117) (undo) * (cur) (last) 12:07, 11 November 2005 82.110.42.4 (Talk) (→External links) (undo) * (cur) (last) 01:10, 6 November 2005 68.67.217.117 (Talk) (→E-mail Headers) (undo) * (cur) (last) 15:36, 2 November 2005 216.64.87.106 (Talk) (→External links) (undo) * (cur) (last) 22:05, 31 October 2005 68.21.169.163 (Talk) (→External links) (undo) * (cur) (last) 21:39, 31 October 2005 68.21.169.163 (Talk) (→External links) (undo) * (cur) (last) 21:06, 28 October 2005 217.77.131.3 (Talk) (.nl extension was missing in ext link) (undo) * (cur) (last) 01:54, 22 October 2005 Mmmbeer (Talk | contribs) m (dab Evidence (law) and wkfy Digital evidence and documentary evidence) (undo) * (cur) (last) 01:52, 22 October 2005 Mmmbeer (Talk | contribs) (→See also - Add digital evidence link) (undo) * (cur) (last) 16:19, 21 October 2005 207.67.97.70 (Talk) (undo) * (cur) (last) 16:18, 21 October 2005 207.67.97.70 (Talk) (undo) * (cur) (last) 15:30, 18 October 2005 194.66.175.72 (Talk) (→Examine the machine's surroundings) (undo) * (cur) (last) 13:19, 3 October 2005 198.110.182.104 (Talk) (spelling - removable) (undo) * (cur) (last) 16:19, 1 October 2005 Gene.arboit (Talk | contribs) (removed unfinished sentence which did not contribute information) (undo) * (cur) (last) 15:05, 1 October 2005 85.99.190.200 (Talk) (→Electronic Evidence Considerations) (undo) * (cur) (last) 01:35, 27 September 2005 Justinc (Talk | contribs) (image is gone) (undo) * (cur) (last) 16:44, 26 September 2005 Gene.arboit (Talk | contribs) (fr interwiki) (undo) * (cur) (last) 02:55, 25 September 2005 Bloodshedder (Talk | contribs) m (→Fully document hardware configuration - disambig) (undo) * (cur) (last) 11:07, 21 September 2005 60.224.45.60 (Talk) (undo) * (cur) (last) 02:43, 21 September 2005 71.98.64.92 (Talk) (→Software) (undo) * (cur) (last) 01:25, 21 September 2005 Dontaskme (Talk | contribs) m (→See also - Updated link after moving the target) (undo) * (cur) (last) 22:02, 26 August 2005 24.24.132.242 (Talk) (undo) * (cur) (last) 21:10, 25 August 2005 Jessekornblum (Talk | contribs) (→E-Mail Review) (undo) * (cur) (last) 07:42, 21 August 2005 82.82.102.103 (Talk) (→External links) (undo) * (cur) (last) 18:13, 7 August 2005 67.141.64.195 (Talk) (undo) * (cur) (last) 16:46, 5 August 2005 Texture (Talk | contribs) m (Reverted edits by 67.141.67.115 to last version by G Clark) (undo) * (cur) (last) 02:49, 5 August 2005 67.141.67.115 (Talk) (→External links) (undo) * (cur) (last) 22:36, 29 July 2005 G Clark (Talk | contribs) m (→Sorting Through the Masses - though/through) (undo) * (cur) (last) 18:03, 25 July 2005 204.194.75.3 (Talk) (→External links) (undo) * (cur) (last) 10:29, 22 July 2005 195.251.166.110 (Talk) (→External links) (undo) * (cur) (last) 16:55, 20 July 2005 204.194.75.3 (Talk) (undo) * (cur) (last) 16:52, 20 July 2005 204.194.75.3 (Talk) (undo) * (cur) (last) 05:19, 13 July 2005 Orbframe (Talk | contribs) (→Duplicate the hard drives - lots of problems with this section, need to come back) (undo) * (cur) (last) 15:33, 12 July 2005 69.120.107.19 (Talk) (→External links) (undo) * (cur) (last) 15:20, 29 June 2005 69.112.34.5 (Talk) (→Power down carefully) (undo) * (cur) (last) 01:33, 25 June 2005 68.106.249.173 (Talk) (→Power down carefully) (undo) * (cur) (last) 19:59, 22 June 2005 Kbdank71 (Talk | contribs) (recat) (undo) * (cur) (last) 17:45, 13 June 2005 Joy (Talk | contribs) m (→See also - avoid redirects) (undo) * (cur) (last) 21:12, 12 June 2005 81.178.79.221 (Talk) (minor grammar correction) (undo) * (cur) (last) 12:43, 8 June 2005 Honeyjew (Talk | contribs) (rewrote section *power down carefully*) (undo) * (cur) (last) 18:14, 6 June 2005 GroupOne (Talk | contribs) m (→See also) (undo) * (cur) (last) 06:39, 6 June 2005 67.183.78.175 (Talk) (→See also) (undo) * (cur) (last) 15:40, 5 June 2005 GroupOne (Talk | contribs) m (→See also) (undo) * (cur) (last) 14:09, 5 June 2005 24.22.210.44 (Talk) (→Other Sources of Reading) (undo) * (cur) (last) 14:07, 5 June 2005 24.22.210.44 (Talk) (→Other Sources of Reading) (undo) * (cur) (last) 01:52, 5 June 2005 GroupOne (Talk | contribs) (undo) * (cur) (last) 17:15, 17 May 2005 217.77.131.3 (Talk) (ext link) (undo) * (cur) (last) 17:21, 16 May 2005 24.75.222.34 (Talk) (→External links) (undo) * (cur) (last) 22:05, 6 May 2005 129.21.129.33 (Talk) (undo) * (cur) (last) 15:37, 13 April 2005 Wmahan (Talk | contribs) m (suroundings->surroundings, algoritm->algorithm, jewlery->jewelry, etc.) (undo) * (cur) (last) 12:51, 18 March 2005 212.191.80.146 (Talk) (Fixed typos) (undo) * (cur) (last) 15:42, 16 March 2005 70.84.56.180 (Talk) (New ref.) (undo) * (cur) (last) 17:11, 13 March 2005 ArnoldReinhold (Talk | contribs) m (→Fully document hardware configuration) (undo) * (cur) (last) 17:09, 13 March 2005 ArnoldReinhold (Talk | contribs) (→Examine the machine's suroundings -add pictures) (undo) * (cur) (last) 16:55, 13 March 2005 ArnoldReinhold (Talk | contribs) (→Secure the Machine and the Data - add info) (undo) * (cur) (last) 14:12, 4 March 2005 ArnoldReinhold (Talk | contribs) (→External links - Category:Cryptographic attacks) (undo) * (cur) (last) 14:07, 4 March 2005 ArnoldReinhold (Talk | contribs) (add links) (undo) * (cur) (last) 13:46, 4 March 2005 ArnoldReinhold (Talk | contribs) (→External links - Category:Computer security) (undo) * (cur) (last) 08:57, 21 January 2005 Thorbjørn Ellefsen (Talk | contribs) m (→Secure the Machine and the Data) (undo) * (cur) (last) 12:55, 21 December 2004 Necrothesp (Talk | contribs) m (undo) * (cur) (last) 20:09, 10 December 2004 MSR (Talk | contribs) m (→Secure the Machine and the Data) (undo) * (cur) (last) 20:08, 10 December 2004 MSR (Talk | contribs) m (→Secure the Machine and the Data) (undo) * (cur) (last) 19:22, 5 December 2004 CanisRufus (Talk | contribs) m (RedWolf - dab RAM) (undo) * (cur) (last) 07:51, 6 October 2004 Tero (Talk | contribs) (see also MAC times) (undo) * (cur) (last) 18:17, 28 September 2004 216.213.8.25 (Talk) (→External links) (undo) * (cur) (last) 19:40, 31 August 2004 Necrothesp (Talk | contribs) m (cat) (undo) * (cur) (last) 04:31, 31 August 2004 68.174.180.194 (Talk) (→External links) (undo) * (cur) (last) 18:42, 27 August 2004 66.98.130.243 (Talk) (Addition of reference) (undo) * (cur) (last) 13:31, 11 August 2004 Jimregan (Talk | contribs) m (→Secure the Machine and the Data - sp, wiki fmt. in place of HTML tags) (undo) * (cur) (last) 09:22, 1 July 2004 ALargeElk (Talk | contribs) m (No mercy for spam) (undo) * (cur) (last) 09:00, 1 July 2004 81.136.5.114 (Talk) (→Secure the Machine and the Data) (undo) * (cur) (last) 10:09, 4 June 2004 81.136.5.114 (Talk) (undo) * (cur) (last) 14:00, 24 April 2004 64.160.121.62 (Talk) (fixed typos) (undo) * (cur) (last) 14:00, 24 April 2004 64.160.121.62 (Talk) (Fixed a few links) (undo) * (cur) (last) 13:59, 24 April 2004 64.160.121.62 (Talk) (Fixed some caps and links.) (undo) * (cur) (last) 13:56, 24 April 2004 Merovingian (Talk | contribs) m (wikify) (undo) * (cur) (last) 13:56, 24 April 2004 Merovingian (Talk | contribs) m (not a stub, but unwikified mass) (undo) * (cur) (last) 13:55, 24 April 2004 64.160.121.62 (Talk) (bad italic tag) (undo) * (cur) (last) 13:55, 24 April 2004 64.160.121.62 (Talk) (initial creation)
 * (cur) (last) 18:25, 4 October 2007 85.228.26.80 (Talk) (30,705 bytes) (→Electronic evidence considerations) (undo)

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/

title: Transwiki talk:Computer forensics


text:
Japanese/Transcribing English to Japanese

The transcription of English to Japanese has been done since the earliest cultural contacts between English speakers and Japanese. During the Edo period, kanji were used phonetically to write English and other foreign words, but in the modern period katakana have become the principal target script. Unlike the systems for romaji, there is no standard for transcribing into katakana, and methods vary. However, generally all methods attempt to preserve the pronunciation of English, not the spelling. That is, transcription not transliteration is done.

This article deals with transcription of English words into the nearest phonetic equivalent in Japanese.

Reasons for transcribing
The purpose of the transcription partly determines how it is done. There are reasons why one would want to transcribe an English word to Japanese: Many legal documents, such as company registrations, require that only Japanese script is used. A computer database may need entry in Japanese script for the purpose of sorting and collation. Educators want to explain the pronunciation of English words by transcribing. Loan words from English are usually written in a transcribed form. Or one may simply be interested in how one's name looks in Japanese.

Accordingly, there are different priorities for the transcriber. The educator might want to indicate many of the subtleties of English pronunciation whereas a person naming a new product might be more concerned with the ease of pronunciation for native speakers of Japanese.

Difficulties
Japanese distinguishes fewer sounds than English. For example, Japanese does not distinguish the vowel sound of "run" and "ran", or the consonant sound of "row" and "low". Moreover the rules by which sounds can be combined in Japanese are generally more restrictive than the English rules. As a result, the pronunciation of the transcribed word can differ quite considerably from the original word in English.

If writing for a Japanese audience, it is worth checking whether there is already an accepted transcription into Japanese, and whether the meaning of the new word has changed in Japanese. The word mishin illustrates both pitfalls: not only is this an unexpected rendering of the English word "machine", but the Japanese word's meaning is limited to sewing machines. It is also worth noting that some terms which may at first glance appear to be mangled English loanwords are, in fact, loans from other languages: koppu (drinking glass) is not a version of the English "cup" but a loan of Dutch kop, and tabako is from Portuguese tabaco, not from "tobacco".

Procedure for transcription
Most Japanese people do not use a systematic procedure for transcription; instead they transcribe according to their perception of the English pronunciation, albeit significantly influenced by the spelling. However, the process can be represented formally as a set of transformations, which is presented in one possible order below. Proficient Japanese speakers internalize the transformations and perform them all simultaneously when inserting English words into written or spoken Japanese.

Step 1: Transcribe the English phonetically
The first step is to start with a phonetic representation of the English word, as distinct from the spelling. The phonetic transcription should reflect the careful pronunciation of the word. Spelling can often mislead as to what the pronunciation is. If there is any doubt, a dictionary will provide an accurate indication of what the sounds are. The letter x typically corresponds to two sounds (ks) and the digraphs sh, ch, and th each correspond to a single sound. The English sounds in the examples below are in the International Phonetic Alphabet. (See International Phonetic Alphabet for English and IPA chart for English for explanation of these symbols used for transcribing English.)

Step 2: Transform the vowels from English to Japanese
Japanese has a different and smaller sound set than English, so many sounds have to be changed to equivalent or similar sounds in Japanese. The Romanization system used here is a variation of the Hepburn system, where long vowels are represented by doubled letters (ii, ee, aa, oo, uu) and the moraic nasal is represented with capital N.

Vowels need to be changed to correspond to use the five Japanese vowels. Typically, the vowels used in a British Received Pronunciation are used as the base English vowels for transcription, using the following system, where doubled vowels mean long (2-mora) vowels:

In rhotic dialects of English, like American English, the letter r sounds at the end of syllables, but for the purpose of transcription into Japanese, this sound transcribes into a vowel sequence ending in a, except for the sequence, which corresponds to Received Pronunciation , and is transcribed as oo. That is, car becomes kaa not karu, and pork becomes pooku not poruku.

Step 3: Transform consonants
Some consonants require changing during transcription into Japanese. This process has three substeps:

Transform non-Japanese sounds to closest Japanese equivalents
First, English has a few consonant sounds that Japanese lacks or only contains in certain contexts, so they must be transcribed into other sounds that Japanese has.

There are other English consonants that Japanese lacks, such as, the closest equivalent being. And though both languages contain, in Japanese it assimilates to before. However these differences in pronunciation are small enough that they need not be considered different sounds for the purpose of transcription.

* It is possible to notate in Japanese kana, and it is done in the Japanese spellings of "Vietnam" (ヴェトナム vetonamu) and "Vicks" (ヴィックス vikkusu), but the sound does not exist in native Japanese phonology and is usually changed to "b" when transcribing English words.

Palatalize coronal obstruents
Next, Japanese requires coronal obstruents "s", "z", "t", "d" to be palatalized when they occur before the vowel i, so if these consonants occur before "i", either they change to their palatalized form or the vowel "i" changes to "e": In recent loanwords, "ti" and "di" are often preserved. In kana, this sound is represented by a full-sized "te" or "de" and a small-sized "i": ティ (ti), ディ (di).
 * "si" changes to "shi" (Remember "si" might come originally from "thi", as in thick).
 * "ti" changes to "chi" or "te"
 * "di" changes to "ji" or "de"
 * "zi" changes to "ji"

Double voiceless obstruents after short vowels
In Japanese, the voiceless obstruents "p", "t", "k", "s", "ch", and "sh" have geminate (doubled) forms, written using a sokuon (small tsu) character, and in English transcription these geminates are used after short vowels. Short vowels are vowels which are transcribed using the vowel table above using a single vowel ("a", "e", "i", "o", or "u"). This transformation is usually but not always applied in the middle of a word. Also, sometimes syllable-final "t" is transformed to "ts" instead of "tt".

Step 4: Add epenthetic vowels
Japanese has strict constraints on the structure of syllables, and any syllables that violate these constraints have vowels inserted until the constraints are met. These are called epenthetic vowels.
 * The only consonant clusters (sequences of consonants with no intervening vowels) allowed in Japanese are the geminate (doubled) consonants cch, mm, nn, ss, ssh, tch and tt. However, the sounds represented by the English digraphs ch, sh, and ts are considered single sounds for the purpose of transcribing into Japanese.
 * Japanese syllables can only end in vowels and N.

Any sequence of sounds that does not obey these rules must have epenthetic vowels inserted. The epenthetic vowel is usually "u", but there are a few exceptions:

 * "m" does not take an epenthetic vowel when followed by "b" or "p", but is instead replaced by "N" (which is pronounced the same as "m" in those contexts). For example, computer becomes "コンピュータ" (koNpyuuta). "N" is also pronounced as before "k" or "g", requiring no epenthesis after the "n" in words such as "ink", which becomes "インク" (iNku).
 * "t" and "d" take "o" as an epenthetic vowel. "t" can also take "u" in which case the "t" is affricated to "ts" (i.e. "tsu").
 * The rule for "tsu" described above is sometimes replaced by one where "tu", written in kana with a full-sized "to" followed by a small "u": トゥ, is used. This is more common in more recent innovative Japanese dialects. For example, the name of the film "The Truman Show" in Japanese is "トゥルーマン・ショー" (turuumaN shoo)
 * "ch" and "j" take "i" as an epenthetic vowel.
 * "k" and "sh" usually takes "u" as an epenthetic vowel, but sometimes it takes "i" or may vary between "u" and "i". "i" is the more conversative pattern.

Step 5: Break into morae
Japanese is divided into morae, with each mora containing one of the following:
 * A consonant and a single vowel (CV)
 * A consonant, "j" and a single vowel (CjV)
 * A single vowel (V)
 * Moraic (final) "n" (N) ン
 * Doubled (geminate) consonant ッ

Step 6: Transcribe rōmaji into katakana
Each mora corresponds to one or sometimes two katakana characters. The second mora of a long vowel is uniformly transcribed as ー in katakana. Moraic "n" (transcribed here as "N") is ン in katakana.

Inconsistencies
Though commonly used katakana spellings tend to be consistent with the above system of transcription, there are also many exceptions. Some transcriptions are apparently based on misinterpretations of the word's pronunciation based on its spelling. For example, the "u" in "studio" seems to have been interpreted as if it were (as in the word "study"), not, resulting in the transcription "スタジオ" (sutajio).

Though the basis for English to Japanese transcription is usually British Received Pronunciation, with its different short "o" sound and unpronounced rhotic "r"s, there are also exceptions. The words "cocktail" and "soccer" are transcribed as "カクテル" (kakuteru) and "サッカー" (sakkaa), and the Japanese name of the English letter "r" is "アール" (aaru), which corresponds more closely to a rhotic accent.

The final sound in English words is usually transcribed as "ト" (to), but it in some words such as "fruit" and "suit" it is transcribed as "ツ" (tsu), making the pronunciation of some singular nouns sound more like their plural forms, even though plural "s"s tend to be ignored when transcribing English nouns into Japanese.

Transcribing using the steps outlined above results in the English short "i" sound becoming the Japanese i sound, but there are also cases in which it becomes the Japanese e sound. Examples include "digital" and "sticker" becoming "デジタル" (dejitaru) and "ステッカー" (sutekkaa). Also, the "re" in the English words "report" and "reporter", which is pronounced as in Received Pronunciation, becomes re in "レポート" (repooto) and "レポーター" (repootaa), though they are sometimes alternately transcribed as "リポート" (ripooto) and "リポーター" (ripootaa)

Even within the common system of transcriptions, there are multiple possible ways in which a certain sound can be transcribed. This can result in multiple transcriptions of a single word, such as the name "David", which is written a number of ways in Japanese. Different pronunciations of the same word are sometimes used to show what meaning of the word is being used. For example, "ストライク" (sutoraiku) refers to a strike in baseball or bowling, while "ストライキ" (sutoraiki) refers to a workers' strike. Also, "ポンチ" (poNchi) refers to fruit punch while "パンチ" (paNchi) is used for other meanings of the word.

As mentioned above, many transcriptions (particularly those involving a non-final schwa) are non-fixed and are often based more on spelling than actual pronunciation. This often leads to words which sound similar to each other in English sounding radically different from each other in their Japanese pronunciations. While the pronunciations of the English words "pirate" and "pilot" differ only in the "l" and "r", the two words are transcribed respectively into Japanese as "パイレーツ" (paireetsu) and "パイロット" (pairotto), with the only difference between the original pronunciations disappearing and some new differences appearing in other places.

There are also some inconsistencies in Japanese between the way English words are transcribed, and the way words from some other languages containing the same sounds are transcribed. A final velar nasal consonant in an English word (spelled "ng") is usually transcribed as "ング" (Ngu), but the same sound in Korean and Chinese words is transcribed as "ン" (N). For example "Hong Kong" and "Kung-Fu" become "ホンコン" (hoNkoN) and "カンフー" (kaNfuu) respectively, and the "Yong" in Korean actor Bae Yong Joon's name becomes "ヨン" (yoN).

Exceptional transcriptions
The following are commonly used transcriptions which do not conform to the common system of transcription. This does not include Japanese abbreviations of English words or words which resemble English, but came into Japanese directly from other languages.

* in the case of James Curtis Hepburn, but not Katharine Hepburn or Audrey Hepburn, whose last name is transcribed as "ヘップバーン" (hepubaaN).

** "Holly" on its own is transcribed as "ホリー" (horii).

Transcribing multiple words
In some instances, such as language textbooks or song lyrics, phrases or entire sentences may be transcribed into Japanese.

Multiple word transcription is typically done on a word-by-word basis, with no account being taken of word linking. For example, "an engineer" would most commonly be transcribed into Japanese as "a.N.e.N.ji.ni.a" rather than "a.ne.N.ji.ni.a", with the linking between the "n" and "e" represented by the Japanese mora "ne". In some set phrases, such as "kaman" for "come on", this general trend is broken.

Example of transcribing a whole sentence
English: "My hovercraft is full of eels."

Step 1:

Step 2-3: "mai hobaakraft iz ful ob iirz"

Step 4: "mai hobaakurafuto izu furu obu iiruzu"

Step 5  "ma.i ho.ba.a.ku.ra.fu.to i.zu fu.ru o.bu i.i.ru.zu"

Step 6  「マイ　ホバークラフト　イズ　フル　オブ　イールズ」