74 䡲 Cyber Forensics Field Manual, Second Edition
File slack can help uncover lost or hidden data or help identify network logon names, pass-
words, and other sensitive information. File slack can also contain e-mail and word processing
document fragments. A thorough computer forensic investigation can help uncover fi le slack data
and more, helping you determine the “who, what, when, where, and how” of computer related
activity in your case [21].
Renaming Files
Potential system abusers and suspects may attempt to conceal their actions (e.g., uploading unau-
thorized fi les or programs) or even hide data by altering the fi le extensions of illegal or unauthorized
fi les (e.g., changing the fi le extension .EXE or .JPG to .DLL).
A dynamic link l