
lyze its contents. Among the tests that were conducted using ILook was
a search for the keywords “boatingct” and “boatingct.com”, which was
conducted on the free space and the slack space of the imaged hard
drive. Data related to the intrusion at BoatingCT.com were recovered
from the free space on the imaged hard drive. Samples of the recovered
data are shown in Figures 6-8 through 6-11. Evidence that he had tried
to sell the stolen customer credit cards also was retrieved from the
imaged drive. Figures 6-12 and 6-13 show e-mails sent by the student
(using the e-mail address daspang24@yahoo.com) for the purpose of
selling the stolen cards.
Arrest and ...