Forms and Guides - Electronically Stored Information - page 349

camera.(and.if.so,.the.type.of.camera),.and.the.date.that.the.
photo.was.taken.and/or.uploaded.to.the.computer..By.com-
paring.the.metadata.of.the.photos.in.the. . . . . . . .folders.
with. other. photos. taken. as. part. of. the. user's. work,. I. was.
able. to. establish. that. they. were. taken. with. the. same. cam-
era,.a. . . . . . . ..I.bookmarked.the.photos,.and.exported.
them.for.future.reference..I.also.discovered.a.group.of.photos.
taken.with.a.different. . . . . . . .camera.(a. . . . . . . )..
I.bookmarked.and.exported.them.as.well..I.then.went.through.
and.bookmarked.and.exported.a.sample.of.all.the.photos.that.
were.taken.with.either.of.those.cameras.
As.a.next.step,.I.bookmarked.and.exported.all.deleted.picture.
iles.for.reference.purposes..I.then.analyzed.some.e-mail.iles.
and.saved.one.of.them.for.reference.
The.next.step.was.to.analyze.the.user's.Internet.usage..First.I.
looked.for.and.saved.any.html.(Internet).iles..Next.I.extracted.
all.index.dat.iles.from.the.image.(index.dat.iles.contain.Internet.
cookies,. temporary. iles,. and. history).. I. analyzed. those. iles.
using.X-Ways.Trace.version.2.01..X-Ways.parses.out.the.index.
dat.iles.and.allows.you.to.export.them.to.Excel.spreadsheets.for.
further.organization.and.analysis..I.did.so,.and.saved.the.Excel.
spreadsheets.for.reference.in.the.report..I.found.only.minimal.
Internet.activities.that.were.not.organization.business.related.
Next,. I. used. FTK. to. do. a. search. of. the. hard. drive. for. key.
words..I.searched.for. . . . . . . ..I.found.little.new.infor-
mation. via. this. search.. I. was. able. to. establish. that. graphics.
iles.had.been.saved.to.an.external.device.(CD.or.DVD.drive).
labeled.E:..I.also.found.evidence.of.graphics.iles.being.saved.
to. . . . . . . ,. which. seemed. to. be. a. legitimate. network.
folder.for.storage.of.work-related.photographs.
I.next.browsed.through.the.spreadsheets.and.documents.looking.
for.any.that.might.indicate.the.user.was.misusing.organization.
equipment.. While. doing. so,. I. found. a. document. referenc-
ing. . . . . . . ..With.that.information,.I.went.back.to.the.
Search. function. and. searched. for. the. word,. . . . . . . ..