◆ SpookStack

= FD-302 Rev. 10-6-95) ~ ~ b7C Investigation on 5/4-6/99 edit File # DNS 7405 — , /= Dawe dictated py _CART Field Examiner - s| b7C eo oe -1- FEDERAL BUREAU OF INVESTIGATION Date of transcription 5/6/99 ee Computer Analysis and Response Team (CART) Fie miner (FE), conducted the following computer examinations as outlined below. These examinations were completed using the procedures and tools approved by the FBI Laboratory. The following computers/computer hard drives were Wester Digital 4310Mb - AC24300L The following forensic evaluations were accomplished: analyzed: Image copies created Directory Listings Recover deleted files Recover unused space (slack) Text string searches Logical files copied On 4/23/99, an image copy of the original hard disk was temporarily stored on a portable computer. After the image was created, it was verified for write accuracy (Safeback Verify), copied to Magneto Optical Disk (MOC) and verifiéd again for accuracy. “The date and time stamp of the original computer was noted to be approximately the same as the actual date and time. This computer uses the Windows 95 operating system and was partitioned into two drives. Only the first partition contained a logical file structure, therefore it:was the only one analyzed. This partition contains 9,855 active files contained within 1,893 directories. 1,261 previously deleted files were recovered. . % at Oakland, California This document contains neither recommendations nor coschusions of the FBI. It ts the property of the FBI and is to your agency; 127638 Of. PD its contents are not to be distributed outzide your agency. / f AON: 67HIa- 48 «ib cbeee art fed bse} baa taemks. & iil agia | etare 5/6/99 a etter - eh oek