Table Of Contents:
Preface xxiii
Acknowledgments xxxi
Part One Discovering Maya 1(100)

Workshop 1 Discovering the Maya Interface 3(36)

The Keyboard 4(1)

The Mouse 4(1)

Looking at Your Scene 4(1)

The Default Screen 5(12)

The Central Part of the Screen 6(1)

The Left Part of the Screen 6(2)

The Upper Part of the Screen 8(5)

The Right Side of the Screen 13(3)

The Bottom Part of the Screen 16(1)

The Pop-Up Menus 17(9)

The Hotbox 17(4)

The Context Menus 21(1)

Some Possible Layouts with Maya 22(1)

The Object Visualization Modes 23(3)

The Manipulators 26(4)

The Main Menus 30(5)

The Outliner 31(1)

The Graph Editor 31(1)

The Hypergraph 31(1)

The Hypershade 32(1)

The Render View 32(1)

The Dynamic Relationships Editor 32(2)

Other Menus 34(1)

Choose the Correct Preferences for Maya 35(3)

The Preferences Menu 35(3)

Conclusion 38(1)

Workshop 2 Making Your First Animation 39(62)

Preparing Your Work 40(2)

Create a New Project 41(1)

Modeling Your Objects 42(21)

Make the Rocket Using NURBES and Polygon Primitives 43(17)

Model the Planet 60(3)

Animating the Rocket along a Path 63(8)

Choose the Length of the Animation 63(2)

Choose the Final Resolution 65(1)

Make a Path for the Rocket 65(6)

Animating the Planet and the Ring with Keyframes 71(4)

Place Keyframes on the Planet 71(1)

The Autokey Button 72(2)

Place Keyframes on the Ring 74(1)

Applying Material 75(14)

Organize Your Workspace 75(2)

Create a Light 77(1)

IPR 77(1)

The Hypershade 78(11)

Making Fire with Particles 89(4)

Add Color to the Output of the Reactors 89(1)

Use Create Fire 90(3)

Using the Correct Parameters for Rendering 93(6)

Animation Length and Image Format 94(2)

Image Resolution 96(1)

Batch Rendering 97(1)

Image Quality 97(2)

Conclusion 99(4)

The fcheck Command 99(2)
Part Two Modeling 101(172)

Workshop 3 Making a Devil's Head with Artisan and Paint Effects 103(38)

Preparing Your Work 105(5)

Discover Artisan 105(1)

Create the Devil's Head 106(1)

Use a Graphic Tablet 106(4)

Deforming the Devil's Head with Artisan 110(13)

Make Your First Deformations with Artisan 111(1)

Give Artisan the Correct Parameters 111(4)

Improve Your Workflow 115(1)

Finish the Devil's Head with Artisan 116(3)

Duplicate the First Half of the Head 119(4)

Model the Eyelids and the Eyes 123(1)

Refining the Devil's Head with Other Tools 123(10)

Apply Materials 125(2)

Converting Textures to Pictures 127(2)

Add Details to the Texture with the 3D Paint Tool 129(4)

Use Keyboard Shortcuts of Paint Effects 133(1)

Make a Background with Paint Effects 133(1)

Adding Effects with Paint Effects 133(7)

Create Hair and a Moustache with Paint Effects 136(4)

Conclusion 140(1)

Workshop 4 Creating the Little Devil's Body Using Polygons 141(36)

Preparing Your Work 144(1)

Place an Image Plane 144(1)

Choosing a Cube Primitive to Model the Hand 145(2)

Shape the Cube by Shifting the Points 146(1)

Generating the Fingers 147(7)

How to Make Selection Easy 148(1)

Divide the Polygons with the Split Polygon Tool 148(1)

Extend Polygons with Extrude Face 149(3)

Smooth Angles with the Smooth Proxy Function 152(2)

Curve the Fingers 154(1)

Completing the Model 154(3)

Place an Image Plane in the Side View 154(1)

Make an Opening to Link the Hand and Wrist 155(1)

Add Details 155(2)

Comparing the Smooth Function with the Smooth Proxy Tool 157(3)

Smooth Angles with the Smooth Tool 157(1)

Modify the Finger's Position in the Creation History 158(1)

Creation History Represented in the Hypergraph 158(2)

Making the Model of the Body from a Cylinder 160(9)

Generate the Trunk 160(1)

Form the Arm 161(3)

Form the Leg 164(2)

Integrate the Hand 166(1)

Duplicate the Right Side of the Body 167(2)

Applying Materials 169(7)

Optimize a Real-Time Display 170(1)

Modify the Resolution with Reduce 170(1)

Optimize the Reduction Factors with the Paint Reduce Weights Toot 171(3)

Standardize Normals Direction 174(2)

Conclusion 176(1)

Workshop 5 Modeling a Watch in NURBS 177(60)

Preparing Your Work 179(2)

Upload Background Images 179(2)

Generating the Watchcase 181(11)

Draw Perfect Curves 181(1)

A Reminder about NURBS Surfaces 182(1)

Draw the Watchcase Rails 182(4)

Generate the Two Profiles 186(2)

Generate the Watchcase Surface 188(2)

Adapt the Watchcase 190(1)

Organize Your Work into Layers 191(1)

Generating the Watchstrap 192(9)

Generate the Left Part of the Watchstrap 193(3)

Generate the Right Side of the Watchstrap 196(4)

Organize the Two Parts of the Watchstrap into Layers 200(1)

Shape the Watchstrap 201(1)

Simplifying the Surfaces 201(2)

Simplify the Watchcase 202(1)

Simplify the Watchstrap 203(1)

Cutting out Surfaces 203(18)

Make a Cutout with Trim Function 204(12)

Make a Cutout with Booleans 216(5)

Reorganize the Watchstrap Layers 221(1)

Applying Colors 221(2)

Finishing the Watch 223(12)

Make a Model of the Bottom of the Dial with Loft 223(1)

Make a Model of the Bottom of the Watchcase with Revolution Surfaces 224(5)

Make a Model of the Knobs 226 C

Create Fillets 229(1)

Make a Model of the Watchcase Fastener 230(1)

Enclose the Decorative Patterns of the Watchstrap 230(5)

The Finished Watch 235(1)

Conclusion 236(1)

Workshop 6 Modeling with Subdivision Surfaces 237(36)

Preparing Your Work 239(1)

Introduction to the Subdivision Surfaces Concept 239(2)

The Limitations of Subdivision Surfaces 240(1)

Subdivision Surfaces Generation Modes 240(1)

Prepare the Polygonal Model 241(1)

Improving the Four-Fingered Hand by Converting Polygonal Objects into Subdivision Surfaces 241(11)

Convert the Hand into Subdivision Surfaces 243(2)

Create the Opening of the Back of the Hand 245(1)

Make a Model of the First Fingernail in Standard Mode 246(5)

Delete the Levels in the Hierarchy 251(1)

Improve the Subdivision Surfaces Display 252(1)

Making a Model of the Shoes with Subdivision Surfaces and Its Polygonal Proxy Model 252(10)

Create a Primitive Polygonal Cube to Make the Subdivision Surface 253(1)

Transform Your Cube with Its Polygonal Proxy Object 254(1)

Give a Shape to the Sole 255(2)

Improve the Outline of the Shoe 257(1)

Make the Hole of the Shoe 257(1)

Round the Angles 257(1)

Generate the Sole by Increasing the Resolution of the Subdivision Surfaces 258(3)

Generate the Zipper of the Shoe 261(1)

Retrieving a Pair of Pants with NURBS Surfaces and Converting Them into Subdivision Surfaces 262(3)

Convert a Pair of Pants from NURBS Surfaces 263(1)

Problems Encountered when NURBS Surfaces Are Directly Converted into Subdivision Surfaces 264(1)

Applying Material to Subdivision Surfaces 265(7)

Apply Material to the Shoe 265(2)

Apply Textures to the Material of the Shirt 267(5)

Converting Subdivision Surfaces into Polygons or NURBS 272(1)

Conclusion 272(1)
Part Three Animation 273(184)

Workshop 7 Importing a CAD Model and Animating It 275(60)

Preparing Your Work 277(1)

Importing a CAD Model 277(11)

Prepare the Data 278(1)

Enhance the Model's Appearance by Changing Normals 278(2)

Separate the Objects for Animation 280(3)

Change the Scale and Orientation of Your Object's Database 283(2)

Group the Objects According to the Animation Logic 285(1)

Organize the Hypergraph and Assign Colors to the Object's Groups 286(2)

Compelling Movement 288(14)

Introduction to Constraints 289(1)

The Animation Scheme 289(1)

Place the Pivot Points to Rotate the Machine Parts Correctly 290(1)

Create New Pivot Points 290(12)

Creating a Locator and Giving It New Attributes 302(4)

Remove the Unnecessary Channels 302(4)

Set Driven Key 306(2)

Changing the Curves of the Driven Keys in the Graph Editor 308(2)

The Pliers 310(3)

Reorganize the Hypergraph 310(2)

Position the Pivot Correctly 312(1)

Parent the Robot Under Its Locator 313(1)

Create the Driven Key 313(1)

Placing the Robot in a Scene 314(20)

Import the Robot and the Rocket in a Set 314(1)

Animate the Robot 315(2)

Play the Animation and Enhance It 317(3)

Refine the Animation by Using the Timeline Tools 320(1)

Refine the Animation in the Graph Editor 320(3)

Use Constraints for the Rocket's Movement 323(4)

Make the Rocket Move when It Is Thrown in Space 327(1)

Transform Constraint Channels in Keyframes 328(1)

Duplicate the Robot/Rocket Set in the Spatial Base 328(2)

Reorganize the Hypergraph 330(1)

Shift the Time of the Animations in the Dope Sheet 331(3)

Conclusion 334(1)

Workshop 8 Animating an Articulate Character 335(56)

Preparing Your Work 337(1)

Writing a Storyboard 337(1)

Modeling the Robot with Polygons 337(9)

Model the Basic Shape 337(3)

Model the Robot Using Its Initial Shape 340(1)

Add the Head, Body, and Feet 341(4)

Import the Hand Modeled in Workshop 4 345(1)

Placing the Skeleton 346(6)

Draw the Spinal Column and the First Leg 348(1)

Skeleton Basics 348(3)

Finish the Legs 351(1)

Draw the Skeleton's Arms 351(1)

Connecting the Robot to the Skeleton 352(2)

Rearrange the Hypergraph Display 352(1)

Parent the Robot Limbs to the Corresponding Skeleton Joints 352(2)

Adding a Hand Deformer 354(4)

How the Bend Deformer Works 354(2)

Apply the Deformer to the Robot's Hand 356(2)

Adding IK Handles 358(6)

Use IK Handles with a Rotation Plane for the Arms 360(1)

Use Single-Chain IK Handles for the Legs 361(1)

Apply Rotation Limits to the Knees 361(1)

Visualize the Handles for the Main Joints 361(2)

Parent the IK Handles to the Robot 363(1)

Importing the Rocket's Animation and the Planets 364(4)

Creating a Character Set 368(3)

Define the Main Character Set 369(2)

Define a Subcharacter Set 371(1)

Animating the Robot 371(9)

Set the Preferences to Generate Keyframes 372(1)

Set the Robot Poses 373(1)

Fine-tune the Animation with Intermediate Keys and Stills 374(6)

Generate a Walk Cycle 380(1)

Using Nonlinear Animation for the Walk 380(6)

Repeat the Walk Cycle Using Nonlinear Editing 381(5)

Setting the Animation Details 386(2)

Animate the Foot Tapping on the Imaginary Ground 386(1)

Wave the Robot's Arms as the Rocket Flies Past 387(1)

Add the Arm Wave as the Robot Hitches a Ride 387(1)

Positioning the Robot and Delaying the Rocket's Animation 388(2)

Position the Robot Near where the Robot Passes By 388(1)

Determine the Precise Moment the Rocket Flies Past 389(1)

Conclusion 390(1)

Workshop 9 Making an Animated Skinned Character 391(66)

Preparing Your Project 393(1)

Create a New Project 393(1)

Preparing the Devil for Animation 394(13)

Import the Body and Head 394(1)

Resize the Head and Body 394(1)

Displace the Points on the Neck 395(1)

Import the Skeleton and Adapt the Devil's Body 395(12)

The Deforming Tools for Animation 407(11)

The Deformers 407(4)

Skinning 411(6)

The Bind Pose 417(1)

Linking the Devil's Skin to Its Skeleton 418(2)

Link the Skeleton to the Body's Proxy Shape 418(1)

Link the Head to the Skeleton 419(1)

Preparing Your Character for Animation 420(9)

Add IKs 421(2)

Parent the IKs to the Skeleton 423(1)

Animate the Feet Properly 424(4)

Make the Creature a Character Set 428(1)

Refining the Skinning 429(17)

Modify the Point Weight with Artisan 429(5)

Add Deformations to Bring Your Character to Life 434(12)

Animating the Character 446(9)

Use a Film as an Image Plane 446(1)

Use the Correct Preferences for Your Animation File 447(1)

Place Keyframes in Forward and Inverse Kinematics 448(1)

Start Your Animation 449(1)

Animate Expressions 450(1)

Add Secondary Animations 451(4)

Conclusion 455(2)
Part Four Dynamics 457(60)

Workshop 10 Apply Dynamics to Rigid Bodies by Making a Mobile 459(24)

Preparing Your Work 461(1)

Specify the Maya Preferences 461(1)

Creating Your Own Objects and Giving

Them Dynamic Characteristics 462(2)

Applying Force Fields to Put Movement into Your Objects 464(3)

The Force Fields 464(2)

Create a Gravity Field for the Cylinder and the Torus 466(1)

Activate the Dynamic Relationships Editor 466(1)

Creating Dynamic Constraints for Your Objects 467(5)

The Dynamic Constraints 467(2)

Apply Constraints to the Mobile's Pieces 469(2)

Reproduce the Cylinders 471(1)

Applying Wind to the Mobile 472(9)

Regulate the Bump Intensity Between the Cylinders 473(1)

Introduce Disturbances Inside the Movement 474(1)

Position Objects to Make the Threads Visible 475(3)

Export the Wind Chime Animation to the Web 478(1)

Shockwave 3D Plug-in Integration into Maya 479(2)

Conclusion 481(2)

Workshop 11 Carrying out an Animation with Particles 483(34)

Preparing Your Work 485(2)

Choose Animation Duration 486(1)

Apply a 3-D Model Face to Follow the Movements of the Actor 486(1)

Creating an Emitter 487(3)

Modify Particles' Emission Parameters with Manipulators 487(2)

Give Parameters to the Emitter Attributes in the Channel Box 489(1)

Hardware Render and Software Render 490(1)

Do Your First Line Test 491(1)

Particle Caching 491(2)

The Different Force Fields to Apply to Particles 493(1)

Adding a Gravity field 493(3)

Link Particles to a Gravity Field 494(1)

Duplicate the Emitter 495(1)

Modify Attribute Values of the New Emitter 495(1)

Changing the Particles' Radius 496(5)

Change the Particles' Life Span 497(1)

Change the Main Jet Stream Particles' Radius with Expressions 497(1)

Change the Extremity Particles Radius with a Ramp Texture 498(1)

Change the Big Particles' Radius 498(2)

Second Line Test 500(1)

Collide the Particles with the Face 501(1)

Making the Droplets Appear 502(2)

Make Some of the Emitted Particles Disappear 503(1)

Giving the Particles Some Speed 504(2)

Connect the Particles Resulting from Collision to the Gravity Field 504(2)

Allowing a Residual Liquid to Run down the Face 506(4)

Defining the Parameters for Rendering 510(4)

Define the Final Appearance of the Particles 510(4)

Define the Material of the Jet Stream Particles 514(1)

Define Resolution and Render Format 514(1)

Conclusion 514(3)
Part Five Rendering 517(114)

Workshop 12 Applying Materials to the Lips and Antennas of a Venusian Girl 519(34)

Preparing Your Work 521(1)

Loading the Venusian Chest 521(1)

Adjusting Your Materials in the Hypershade 521(2)

Choosing a Light 523(3)

The Different Types of Lights 523(1)

Edit the Lights 524(1)

Add Effects to the Lights 525(1)

Adding Materials and Textures 526(5)

Apply Materials 527(1)

Apply Textures 528(1)

Choose Utilities 529(2)

Making the Lips' Material 531(13)

Organize Your Screen 531(1)

Select the Lips' Region 531(1)

Assign a Color to the Lips 531(2)

Apply a Texture to the Lips 533(3)

Improve the Color of the Lips 536(2)

Improve the Reflections 538(6)

Making a Material for the Metallic Parts 544(7)

[Import a Scanned Image to Be Used as Texture 545(3)

Use the Texture as a Spherical Environment 548(1)

Make the Texture Black and White 549(2)

Conclusion 551(2)

Workshop 13 Projecting Textures on the Aerosol Can Label 553(26)

Setting Up Your Work 555(1)

Applying the Label on the Container 555(4)

Prepare the Texture 555(1)

Apply the Texture on the Aerosol Can 555(3)

Set the Resolution of the NURBS for the Final Render 558(1)

Putting the Aerosol Can in a Set 559(10)

Place the Set 559(1)

Make the Cast Shadows Visible 560(2)

Add Diffuse Lighting for the Aerosol Can 562(3)

Add a Point Light on the Walls 565(2)

Position the Lights 567(1)

Add a Reflection Texture 568(1)

The Resulting Shading Network in the Hypershade 569(1)

Creating a Camera Movement 569(2)

Generating an Animation for Video Output 571(3)

Set the Right Attributes to Render an Animation 572(1)

Set the Right Image Format 572(1)

Give the Image a Good Resolution 573(1)

Start the Render 574(1)

The Resulting Images 574(1)

The Rendered Animation 574(1)

Conclusion 574(5)

Workshop 14 Using Mental Ray for Hyper-realistic Rendering 579(32)

Preparing Your Work 580(1)

Importing the Databases 581(1)

Downloading Objects from the Internet and Importing Them into Your Scene 582(3)

Preparing the Scene 585(2)

Choose the Image Size and Resolution 585(1)

Changing the Camera Frame 586(1)

Put the Furniture and the Characters in the Right Place 586(1)

Preparing for Rendering 587(3)

Placing a Set and the Materials 587(3)

Choosing a Light 590(1)

Doing the First Rendering Test with IPR 590(1)

Adding the Vases and the Flowers in the Scene 590(7)

Modeling the Vases 591(2)

Making the Flowers with Paint Effects 593(3)

Converting the Flowers in Polygons 596(1)

The Last Bouquet 597(1)

Making the Bouquet of Roses for the Astronaut Girl 597(1)

Rendering with Mental Ray 598(11)

First Rendering with Mental Ray 599(1)

Making a Rendering Test with All Elements in the Scene 600(1)

Add Two New Lights and a Window to the Scene 601(1)

Improve the Astronaut Girl 602(6)

The Robot's Eyes 608(1)

Conclusion 609(2)

Workshop 15 Importing Vectors and Using Maya Vector Rendering to Create an Animation 611(20)

Preparing Your Work 613(1)

Importing the Logo 613(1)

Building the Logo Letters in 3-D 613(6)

The Bevel Plus Function Options 614(1)

The Case of the 0 Letter 615(4)

Importing the Other Elements 619(3)

Choose the Image Format and Resolution 620(1)

Make the Rocks, the Sea, and the Sky 621(1)

Put the Logo and the Elements in the Right Place 622(1)

Preparing for Rendering 622(5)

Choosing Lights 624(1)

Doing the First Rendering Test with IPR 625(2)

Rendering with Maya Vector 627(3)

Conclusion 630(1)
Part Six Scripting in Maya 631(44)

Workshop 16 Modeling and Animating Using the MEL Scripting Language and Expressions 633(42)

Preparing Your Project 635(1)

Reference the MEL Scripts Folder 635(1)

Creating Your First MEL Script 635(9)

Select the Interface Functions 635(3)

Link a New Button to a Script 638(6)

Variables 644(1)

Using MEL Syntax 644(4)

Operators 646(1)

Conditions and Loops 646(1)

Functions 647(1)

Procedures 647(1)

Comments 648(1)

Using the Script Editor 648(9)

Model Abstract Shapes Using MEL 648(9)

Using Expressions 657(8)

The Expression Editor 658(4)

Animate Your Shapes Using Expressions 662(3)

Creating a Menu to Drive Your Animation 665(4)

Applying Deformations in MEL 669(2)

Apply Textures to the Colors 671(1)

Preparing Your Scene for Rendering 671(3)

Animate the Textures 672(1)

Set the Attributes in the Render Globals 673(1)

Conclusion 674(1)
Part Seven The Tools from Maya Unlimited 675(96)

Workshop 17 Adding Hair, Clothes, and Fur 677(50)

Preparing Your Project 679(2)

Create a New Project 679(2)

Take the Devil's Body off the Animation 681(1)

Using Cloth 681(29)

Make the Devil's Shirt 681(13)

Model the Devil's Shorts 694(2)

Export the Shorts 696(1)

Incorporate the Shirt and Shorts in the Devil's Animation 697(10)

Add Materials to the Garments 707(3)

Adding Hair with Fur 710(16)

Create Attractors to Animate the Hair 717(7)

Prepare the Hair for Rendering 724(2)

Conclusion 726(1)

Workshop 18 Using Fluid Effectsin an Animation 727

Preparing Your Project 729(1)

Create a New Project 729(1)

Creating an Ocean 729(6)

Agitate the Ocean 731(2)

Create a Floating Boat on the Ocean 733(1)

Add Foam 733(2)

Creating a Sky with a 2-D Container 735(13)

Create a 2-D Container 735(5)

Apply a Texture to the Fluid to Simulate Clouds 740(4)

Place the Clouds in Your Scene and Refine Their Appearance 744(4)

Move the Clouds 748(2)

Making the Rocket Take Off and Simulating the Smoke 750(20)

Make a 3-D Container and Add a Volume Emitter 750(3)

Enhance the Visual Appearance of the Fluid Using a Texture 753(2)

Improve the Fluid Simulation 755(1)

Refine Fluid Material 756(1)

Integrate Fluid in Animation 757(2)

Generate a Disk Cache 759(1)

Prepare the Animation for Final Rendering 760(1)

Make a Second Shot with the Rocket Generating Its Wake on the Ocean 761(4)

Animating the Rocket and Parenting the Wake Emitter to It 765(3)

Fine Tune the Materials Before Rendering 768(2)

Conclusion 770(1)
Index 771
0619131209
Chapter 1
Computer Forensics and Investigations as a Profession 1(28)

Understanding Computer Forensics 2(7)

Comparing Definitions of Computer Forensics 3(2)

Exploring a Brief History of Computer Forensics 5(2)

Developing Computer Forensics Resources 7(2)

Preparing for Computing Investigations 9(11)

Understanding Enforcement Agency Investigations 10(3)

Understanding Corporate Investigations 13(7)

Maintaining Professional Conduct 20(3)

Chapter Summary 23(1)

Key Terms 23(2)

Review Questions 25(2)

Hands-on Projects 27(1)

Case Projects 28(1)
Chapter 2
Understanding Computer Investigations 29(44)

Preparing a Computer Investigation 30(3)

Examining a Computer Crime 30(2)

Examining a Company-Policy Violation 32(1)

Taking a Systematic Approach 33(9)

Assessing the Case 34(2)

Planning Your Investigation 36(4)

Securing Your Evidence 40(2)

Understanding Data-Recovery Workstations and Software 42(7)

Setting Up Your Workstation for Computer Forensics 43(6)

Executing an Investigation 49(12)

Gathering the Evidence 50(1)

Copying the Evidence Disk 51(3)

Analyzing Your Digital Evidence 54(7)

Completing the Case 61(1)

Critiquing the Case 62(1)

Chapter Summary 63(1)

Key Terms 63(1)

Review Questions 64(2)

Hands-on Projects 66(5)

Case Projects 71(2)
Chapter 3
Working with Windows and DOS Systems 73(52)

Understanding File Systems 74(6)

Understanding the Boot Sequence 74(1)

Examining Registry Data 75(1)

Disk Drive Overview 76(4)

Exploring Microsoft File Structures 80(9)

Disk Partition Concerns 80(5)

Boot Partition Concerns 85(1)

Examining FAT Disks 85(4)

Examining NTFS Disks 89(9)

NTFS System Files 91(1)

NTFS Attributes 92(3)

NTFS Data Streams 95(1)

NTFS Compressed Files 95(1)

NTFS Encrypted File Systems (EFS) 95(1)

EFS Recovery Key Agent 96(1)

Deleting NTFS Files 97(1)

Understanding Microsoft Boot Tasks 98(5)

Windows XP, 2000, and NT Startup 98(2)

Windows XP System Files 100(3)

Understanding MS-DOS Startup Tasks 103(10)

Other DOS Operating Systems 104(9)

Chapter Summary 113(1)

Key Terms 114(3)

Review Questions 117(2)

Hands-on Projects 119(4)

Case Projects 123(2)
Chapter 4
Macintosh and Linux Boot Processes and Disk Structures 125(36)

Understanding the Macintosh File Structure 126(3)

Understanding Volumes 127(2)

Exploring Macintosh Boot Tasks 129(1)

Examining UNIX and Linux Disk Structures 130(11)

UNIX and Linux Overview 133(5)

Understanding Inodes 138(3)

Understanding UNIX and Linux Boot Processes 141(1)

Understanding Linux Loader 142(1)

UNIX and Linux Drives and Partition Scheme 142(1)

Examining Compact Disc Data Structures 142(3)

Understanding Other Disk Structures 145(6)

Examining SCSI Disks 145(1)

Examining IDE/EIDE Devices 146(5)

Chapter Summary 151(1)

Key Terms 152(3)

Review Questions 155(1)

Hands-on Projects 156(2)

Case Projects 158(3)
Chapter 5
The Investigator's Office and Laboratory 161(42)

Understanding Forensic Lab Certification Requirements 162(7)

Identifying Duties of the Lab Manager and Staff 162(1)

Balancing Costs and Needs 163(3)

Acquiring Certification and Training 166(3)

Determining the Physical Layout of a Computer Forensics Lab 169(14)

Identifying Lab Security Needs 169(1)

Conducting High-Risk Investigations 170(1)

Considering Office Ergonomics 171(2)

Environmental Conditions 173(1)

Lighting 174(1)

Structural Design Considerations 175(1)

Electrical Needs 176(1)

Communications 176(1)

Fire-suppression Systems 177(1)

Evidence Lockers 178(2)

Facility Maintenance 180(1)

Physical Security Needs 180(1)

Auditing a Computer Forensics Lab 181(1)

Computer Forensics Lab Floor Plan Ideas 181(2)

Selecting a Basic Forensic Workstation 183(4)

Selecting Workstations for Police Labs 184(1)

Selecting Workstations for Private and Corporate Labs 184

Stocking Hardware Peripherals 183(1)

Maintaining Operating Systems and Application Software Inventories 183(3)

Using a Disaster Recovery Plan 186(1)

Planning for Equipment Upgrades 187(1)

Using Laptop Forensic Workstations 187(1)

Building a Business Case for Developing a Forensics Lab 187(2)

Creating a Forensic Boot Floppy Disk 189(7)

Assembling the Tools for a Forensic Boot Floppy Disk 189(7)

Retrieving Evidence Data Using a Remote Network Connection 196(1)

Chapter Summary 197(1)

Key Terms 198(1)

Review Questions 199(1)

Hands-on Projects 200(1)

Case Projects 201(2)
Chapter 6
Current Computer Forensics Tools 203(56)

Evaluating Your Computer Forensics Software Needs 204(14)

Using National Institute of Standards and Technology (NIST) Tools 204(3)

Using National Institute of Justice (NIJ) Methods 207(1)

Validating Computer Forensics Tools 207(11)

Using Command-Line Forensics Tools 218(3)

Exploring NTI Tools 219(2)

Exploring Ds2dump 221(1)

Reviewing DriveSpy 221(1)

Exploring PDBlock 221(1)

Exploring PDWipe 221(1)

Reviewing Image 222(1)

Exploring Part 222(1)

Exploring SnapBack DatArrest 222(1)

Exploring Byte Back 222(1)

Exploring MaresWare 223(1)

Exploring DIGS Mycroft v3 223

Exploring Graphical User Interface (GUI) Forensics Tools 221(12)

Exploring AccessData Programs 224(1)

Exploring Guidance Software EnCase 225(1)

Exploring Ontrack 225(1)

Using BIAProtect 226(1)

Using LC Technologies Software 227(2)

Exploring WinHex Specialist Edition 229(1)

Exploring DIGS Analyzer Professional Forensic Software 230(1)

Exploring ProDiscover DFT 230(1)

Exploring DataLifter 231

Exploring ASRData 132(101)

Exploring the Internet History Viewer 233(1)

Exploring Other Useful Computer Forensics Tools 233(5)

Exploring LTOOLS 233(1)

Exploring Mtools 233(1)

Exploring R-Tools 234(1)

Using Explore2fs 235(1)

Exploring @stake 235(1)

Exploring TCT and TCTUTILs 236

Exploring ILook 235(2)

Exploring HashKeeper 237(1)

Using Graphic Viewers 237(1)

Exploring Hardware Tools 238(6)

Computing-Investigation Workstations 238(1)

Building Your Own Workstation 238(1)

Using a Write-blocker 239(1)

Using LC Technology International Hardware 239(1)

Forensic Computers 240(4)

DIBS 244

Digital Intelligence 240(2)

Image MASSter Solo 242(1)

FastBloc 243(1)

Acard 243(1)

NoWrite 244(1)

Wiebe Tech Forensic DriveDock 244(1)

Recommendations for a Forensic Workstation 244(1)

Chapter Summary 244(1)

Key Terms 245(1)

Review Questions 246(2)

Hands-On Projects 248(9)

Case Projects 257(2)
Chapter 7
Digital Evidence Controls 259(32)

Identifying Digital Evidence 260(4)

Understanding Evidence Rules 261(3)

Securing Digital Evidence at an Incident Scene 264(4)

Cataloging Digital Evidence 268(3)

Lab Evidence Considerations 270(1)

Processing and Handling Digital Evidence 270(1)

Storing Digital Evidence 271(5)

Evidence Retention and Media Storage Needs 272(2)

Documenting Evidence 274(2)

Obtaining a Digital Signature 276(5)

Chapter Summary 281(1)

Key Terms 282(1)

Review Questions 283(1)

Hands-on Projects 284(5)

Case Projects 289(2)
Chapter 8
Processing Crime and Incident Scenes 291(36)

Processing Private-Sector Incident Scenes 292(5)

Processing Law Enforcement Crime Scenes 297(2)

Understanding Concepts and Terms Used in Warrants 298(1)

Preparing for a Search 299(9)

Identifying the Nature of the Case 299(1)

Identifying the Type of Computing System 300(1)

Determining Whether You Can Seize a Computer 300(1)

Obtaining a Detailed Description of the Location 301(3)

Determining Who Is in Charge 304(1)

Using Additional Technical Expertise 304(1)

Determining the Tools You Need 304(4)

Preparing the Investigation Team 308(1)

Securing a Computer Incident or Crime Scene 308(1)

Seizing Digital Evidence at the Scene 309(6)

Processing a Major Incident or Crime Scene 310(2)

Processing Data Centers with an Array of RAIDs 312(1)

Using a Technical Advisor at an Incident or Crime Scene 312(1)

Sample Civil Investigation 312(2)

Sample Criminal Investigation 314(1)

Collecting Digital Evidence 315(1)

Reviewing a Case 316(4)

Identifying the Case Requirements 317(1)

Planning Your Investigation 318(2)

Chapter Summary 320(1)

Key Terms 321(1)

Review Questions 322(2)

Hands-on Projects 324(1)

Case Projects 325(2)
Chapter 9
Data Acquisition 327(50)

Determining the Best Acquisition Method 328(1)

Planning Data Recovery Contingencies 328(3)

Using MS-DOS Acquisition Tools 331(13)

Understanding How DriveSpy Accesses Sector Ranges 331(2)

Data Preservation Commands 333(11)

Using DriveSpy Data Manipulation Commands 344

Using Windows Acquisition Tools 344(11)

AccessData FTK Explorer 344(11)

Acquiring Data on Linux Computers 355(7)

Using Other Forensics Acquisition Tools 362(2)

Exploring SnapBack DatArrest 362(1)

Exploring SafeBack 363(1)

Exploring EnCase 364(1)

Chapter Summary 364(1)

Key Terms 365(1)

Review Questions 365(2)

Hands-On Projects 367(8)

Case Projects 375(2)
Chapter 10
Computer Forensic Analysis 377(62)

Understanding Computer Forensic Analysis 378(1)

Refining the Investigation Plan 378(1)

Using DriveSpy to Analyze Computer Data 379(17)

DriveSpy Command Switches 386(1)

DriveSpy Keyword Searching 386(1)

DriveSpy Scripts 387(2)

DriveSpy Data-Integrity Tools 389(2)

DriveSpy Residual Data Collection Tools 391(1)

Other Useful DriveSpy Command Tools 392(4)

Using Other Digital Intelligence Computer Forensics Tools 396(1)

Using PDBlock and PDWipe 396(1)

Using AccessData's Forensic Toolkit 396(4)

Performing a Computer Forensic Analysis 400(17)

Setting Up Your Forensic Workstation 401(1)

Performing Forensic Analysis on Microsoft File Systems 402(11)

UNIX and Linux Forensic Analysis 413(3)

Macintosh Investigations 416(1)

Addressing Data Hiding Techniques 417(9)

Hiding Partitions 417(2)

Marking Bad Clusters 419(1)

Bit-Shifting 420(4)

Using Steganography 424(2)

Examining Encrypted Files 426(1)

Recovering Passwords 426(1)

Chapter Summary 426(2)

Key Terms 428(1)

Review Questions 429(2)

Hands-On Projects 431(7)

Case Projects 438(1)
Chapter 11
E-mail Investigations 439(48)

Understanding Internet Fundamentals 440(4)

Understanding Internet Protocols 443(1)

Exploring the Roles of the Client and Server in E-mail 444(1)

Investigating E-mail Crimes and Violations 445(18)

Identifying E-mail Crimes and Violations 445(1)

Examining E-mail Messages 446(1)

Copying an E-mail Message 446(2)

Printing an E-mail Message 448(1)

Viewing E-mail Headers 448(10)

Examining an E-mail Header 458(3)

Examining Additional E-mail Files 461(1)

Tracing an E-mail Message 462(1)

Using Network Logs Related to E-mail 462(1)

Understanding E-mail Servers 463(9)

Examining UNIX E-mail Server Logs 465(3)

Examining Microsoft E-mail Server Logs 468(3)

Examining Novell GroupWise E-mail Logs 471(1)

Using Specialized E-mail Forensics Tools 472(3)

Chapter Summary 475(1)

Key Terms 476(1)

Review Questions 477(3)

Hands-on Projects 480(5)

Case Projects 485(2)
Chapter 12
Recovering Image Files 487(54)

Recognizing an Image File 488(3)

Understanding Bitmap and Raster Images 488(2)

Understanding Vector Images 490(1)

Metafile Graphics 490(1)

Understanding Image File Formats 490(1)

Understanding Data Compression 491(2)

Reviewing Lossless and Lossy Compression 492(1)

Locating and Recovering Image Files 493(24)

Identifying Image File Fragments 493(1)

Repairing Damaged Headers 494(11)

Reconstructing File Fragments 505(11)

Identifying Unknown File Formats 516(1)

Analyzing Image File Headers 517(8)

Tools for Viewing Images 520(1)

Understanding Steganography in Image Files 521(3)

Using Steganalysis Tools 524(1)

Identifying Copyright Issues with Graphics 525(2)

Chapter Summary 527(2)

Key Terms 529(1)

Review Questions 529(2)

Hands-on Projects 531(7)

Case Projects 538(3)
Chapter 13
Writing Investigation Reports 541(46)

Understanding the Importance of Reports 542(5)

Limiting the Report to Specifics 543(1)

Types of Reports 543(4)

Expressing an Opinion 547(6)

Designing the Layout and Presentation 551(1)

Litigation Support Reports versus Technical Reports 552(1)

Writing Clearly 553(4)

Providing Supporting Material 553(1)

Formatting Consistently 553(1)

Explaining Methods 554(1)

Data Collection 554(1)

Including Calculations 554(1)

Providing for Uncertainty and Error Analysis 554(1)

Explaining Results 555(1)

Discussing Results and Conclusions 555(1)

Providing References 555(2)

Including Appendices 557(1)

Providing Acknowledgments 557(1)

Formal Report Format 557(1)

Writing the Report 557(23)

Using FTK Demo Version 558(22)

Chapter Summary 580(1)

Key Terns 581(1)

Review Questions 581(3)

Hands-on Projects 584(1)

Case Projects 585(2)
Chapter 14
Becoming an Expert Witness 587(34)

Comparing Technical and Scientific Testimony 588(1)

Preparing for Testimony 588(4)

Documenting and Preparing Evidence 589(1)

Keeping Consistent Work Habits 589(1)

Processing Evidence 590(1)

Serving as a Consulting Expert or an Expert Witness 590(1)

Creating and Maintaining Your CV 591(1)

Preparing Technical Definitions 592(1)

Testifying in Court 592(7)

Understanding the Trial Process 592(1)

Qualifying Your Testimony and Voir Dire 593(1)

Addressing Potential Problems 594(1)

Testifying in General 594(1)

Presenting Your Evidence 594(2)

Using Graphics in Your Testimony 596(1)

Helping Your Attorney 596(1)

Avoiding Testimony Problems 596(1)

Testifying During Direct Examination 597(1)

Using Graphics During Testimony 598(1)

Testifying During Cross-Examination 599(5)

Exercising Ethics When Testifying 602(1)

Understanding Prosecutorial Misconduct 603(1)

Preparing for a Deposition 604(2)

Guidelines for Testifying at a Deposition 604(1)

Recognizing Deposition Problems 605(1)

Public Release: Dealing with Reporters 606(1)

Forming an Expert Opinion 606(2)

Determining the Origin of a Floppy Disk 606(2)

Chapter Summary 608(1)

Key Terms 608(1)

Review Questions 609(3)

Hands-on Projects 612(7)

Case Projects 619(2)
Appendix A
Certification Test References 621(4)

IACIS Certification 621(1)

IACIS Computer Forensics Skills Expectations 622(1)

Looking up URLs 622(3)
Appendix B
Computer Forensics References 625(14)

Quick References for Computing Investigators 625(4)

UNIX and Linux Common Shell Commands 627(2)

Sample Script for DriveSpy 629(1)

Overview of FAT Directory Structures 630(6)

Computer Forensics References 636(3)
Appendix C
Procedures for Corporate High-Technology Investigations 639(10)

Procedures for Investigations 639(1)

Employee Termination Cases 639(2)

Internet Web Abuse Investigations 639(2)

E-mail Abuse Investigations 641(1)

Attorney-Client Privileged Investigations 641(2)

Media Leak Investigations 643(2)

Industrial Espionage Investigations 645(2)

Interviews and Interrogration in High-Technology Investigations 647(2)
Glossary 649(12)
Index 661