ࡱ> k jm_} [ bjbj55 `__}Z""ee8=<=D""V$ 9";";";";";";"$~$ 'Z_"!|!!_"eert"ggg!ee83g!9"ggg2tTg"0"gz'Uz'gz'g!!g!!!!!_"_"g!!!"!!!!z'!!!!!!!!!" +:  MACROBUTTON DoFieldClick [Court name] Submitted by:  MACROBUTTON DoFieldClick "[Examiner Name]"   MACROBUTTON DoFieldClick [Plaintiff's name], Plaintiff, vs.  MACROBUTTON DoFieldClick [Defendant's name], Defendant) ) ) ) ) ) ) ) ) )Case No.:  MACROBUTTON DoFieldClick [Case number]   MACROBUTTON DoFieldClick "[REPORT ON DIGITAL FORENSIC EXAMINATION]"  Dated this  DATE \@ "MMMM d, yyyy" April 28, 2008  MACROBUTTON DoFieldClick "[Examiner's Name]"   MACROBUTTON DoFieldClick "[Examiner's Company Name]"   MACROBUTTON DoFieldClick "[Company Address]"        MACROBUTTON DoFieldClick "[Report on Digital Forensic Examination]"  -  PAGE \* MERGEFORMAT 1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 ()*-.=>klnst  , 7 8 9 ? @ ξ|vkh9 hHOJQJ h3l!0J h9n 0J ht"0Jjh,0JUhKohhhMoh8kh9n 5\jh8kh,U h8kh9n h3l!h9n 5h3l!hO75jh3l!h,5U h{T5 hY5hfh3l!hf0Jjh3l!h,0JU)*+,-mnopqrs $IfgdI $Ifgd9n $Ifgd9n $Ifgd9n gd9n $a$gdf   : ; < = > ? ~~vvtt$a$gd3l!gd9n ikd$$IfF$$    4ap $Ifgd9n $IfgdI : l m n o p q d^gdI d9^gd9n ud^ugd9n ed9^egd9n gd9n $a$gd3l!gdxdbd  8 9 : ; j k l m } ~ 䴧yuyuyuyuquh;wh'.jh'.U h8khI h/b5jh,5UhTh9n 5hThT5jhTh,5U h|5 h8kh|h|h9n hFmHnHuh,jh,U h8khBh h8kh9n h3l!h3l!0J h3l!0J hF0J(q r s t u v w x y z { | }  dgd9n  X Y Z [ \)|)}) *-*5*;*Q+R+S+\+j++++++++++,X,\,-------..%.).2.4.>.@.A.H.K.z...»h("hI h;XVhI h8kh9n h'.mHnHuh,h3l!jh,Uhfh;wh'.hnA0jh,UmHnHuF            ! $ ' * - 0 $a$gd}H  HJgdf0 3 6 9 < ? B E H K N Q T W X Y Z [ |)})+-- 2 25577gd9n $a$gd}H6&P1:p!(/ =!"#$% $$If!vh555#v#v#v:V $555/ 4 p^ 666666666vvvvvvvvv666666>6666666666666666666666666666666666666666666666666hH6666666666666666666666666666666666666666666666666666666666666666662 0@P`p2( 0@P`p 0@P`p 0@P`p 0@P`p 0@P`p 0@P`p8XV~_HmH nHsH tHN`N WfNormaldq CJEHOJQJ_HmH sH tH DA`D Default Paragraph FontRi@R 0 Table Normal4 l4a (k ( 0No List >O> WfSingle Spacingd9*W@* 3l!`Strong5\NN |0 Balloon TextdCJOJQJ^JaJ6O"6 Wf Attorney Name222 Wf Firm Namea$RAR |0Balloon Text CharCJEHOJQJ^JaJ4@R4 WfHeader !4 @b4 WfFooter !ROrR 9n Signature block date d ^HCJZOZ 9n Signature block lined $^pCJPK![Content_Types].xmlj0Eжr(΢Iw},-j4 wP-t#bΙ{UTU^hd}㨫)*1P' ^W0)T9<l#$yi};~@(Hu* Dנz/0ǰ $ X3aZ,D0j~3߶b~i>3\`?/[G\!-Rk.sԻ..a濭?PK!֧6 _rels/.relsj0 }Q%v/C/}(h"O = C?hv=Ʌ%[xp{۵_Pѣ<1H0ORBdJE4b$q_6LR7`0̞O,En7Lib/SeеPK!kytheme/theme/themeManager.xml M @}w7c(EbˮCAǠҟ7՛K Y, e.|,H,lxɴIsQ}#Ր ֵ+!,^$j=GW)E+& 8PK!Ptheme/theme/theme1.xmlYOo6w toc'vuر-MniP@I}úama[إ4:lЯGRX^6؊>$ !)O^rC$y@/yH*񄴽)޵߻UDb`}"qۋJחX^)I`nEp)liV[]1M<OP6r=zgbIguSebORD۫qu gZo~ٺlAplxpT0+[}`jzAV2Fi@qv֬5\|ʜ̭NleXdsjcs7f W+Ն7`g ȘJj|h(KD- dXiJ؇(x$( :;˹! I_TS 1?E??ZBΪmU/?~xY'y5g&΋/ɋ>GMGeD3Vq%'#q$8K)fw9:ĵ x}rxwr:\TZaG*y8IjbRc|XŻǿI u3KGnD1NIBs RuK>V.EL+M2#'fi ~V vl{u8zH *:(W☕ ~JTe\O*tHGHY}KNP*ݾ˦TѼ9/#A7qZ$*c?qUnwN%Oi4 =3ڗP 1Pm \\9Mؓ2aD];Yt\[x]}Wr|]g- eW )6-rCSj id DЇAΜIqbJ#x꺃 6k#ASh&ʌt(Q%p%m&]caSl=X\P1Mh9MVdDAaVB[݈fJíP|8 քAV^f Hn- "d>znNJ ة>b&2vKyϼD:,AGm\nziÙ.uχYC6OMf3or$5NHT[XF64T,ќM0E)`#5XY`פ;%1U٥m;R>QD DcpU'&LE/pm%]8firS4d 7y\`JnίI R3U~7+׸#m qBiDi*L69mY&iHE=(K&N!V.KeLDĕ{D vEꦚdeNƟe(MN9ߜR6&3(a/DUz<{ˊYȳV)9Z[4^n5!J?Q3eBoCM m<.vpIYfZY_p[=al-Y}Nc͙ŋ4vfavl'SA8|*u{-ߟ0%M07%<ҍPK! ѐ'theme/theme/_rels/themeManager.xml.relsM 0wooӺ&݈Э5 6?$Q ,.aic21h:qm@RN;d`o7gK(M&$R(.1r'JЊT8V"AȻHu}|$b{P8g/]QAsم(#L[PK-![Content_Types].xmlPK-!֧6 +_rels/.relsPK-!kytheme/theme/themeManager.xmlPK-!Ptheme/theme/theme1.xmlPK-! ѐ' theme/theme/_rels/themeManager.xml.relsPK] Y[Y\[ ~(=ks8?8:j[333333333^by{3!`, # AA@2 (  bB   LeftBorder1#" bB   LeftBorder2#" bB   RightBorder#"   TLineNumbers#"  0(  B S  ?2a$$=ipp=i=i AttorneyNameParties CaseNumberSummarys\s\)=ls9?9:k|\)=ls9?9:k|\)=ls9?9:k|}}\hMo,Vra 9n 'TUdF7G@e %|3l!a'4Q'E)a,'.nA0S46O73\</= >*k@"B'BrH}HyY@5Z^b/bxdbWfg i7k8kto\=oboo\p@r;w;Bf PuBI:&{TeFTZ!(.cFA;3}H5YQ9Bh#KoHTgKSe[. H J;Gw |2J:mq-OOt"45} AttorneyNamej=CaptionBoxStyle8@CourtAlignment B CourtName, FirmInFtr`BFirmInSigBlkStyle\B FirstLineNumpBFirstPleadingLineBFont? FSigBlkYesj= FSignWithA FSummaryInFtrk= IncludeDatek=IncludeLineNumbersk= JudgeNameALeftBorderStyleALineNumIncByOne ? LineSpacingtB LinesPerPageh= PageNumsInFtrxh=RightBorderStylelB-100~0011 Courier New-1 -1-1-102-1232-11@mm(mm[p@UnknownG*Ax Times New Roman5Symbol3. *Cx ArialU Myriad ProCourier New?= *Cx Courier New5. *[`)TahomaA BCambria Math"1h&&;eF__$Z0||2HP  ?Gw2!xx ChopOMaticJerry Hatchettj 666666666vvvvvvvvvOh+'0$j    ( 4@HPX` ChopOMatic(DIGITAL FORENSIC REPORT TEMPLATE.dotJerry Hatchett2Microsoft Office Word@@d@@,^T@,^T_GhVT$m N4 &" WMFCY H,HLl VT$m EMFHL \KhC    % %  Rp@1Courier NewT WdTL8UdTL Q_LT L/Q_-,?=*Cx Courie New+P_x:H_8yF_Ldv% % %  TT,BAEA,L P ! "  TT, ? AEA,6 L P sTP f? AEA6 +L "[Report on Digital Forensic Examination]" TTg }? AEAg6 L P TT~ ? AEA~6 L P-TT ? AEA6 L P TT ? AEA6 L P1TT ? AEA6 L P ! " F(GDIC !b $$>>_888% % W$  g% % $$AA( " FGDICF(GDIC  !b $$>>_888% % W$  llg% % $$AA( " FGDICF(GDIC !b $$>>_888% % W$ LFLFg% % $$AA( " FGDICF(GDICZ, !b $$>>% % V0Y+ \ ]|]|\ \ % % $$AA" FGDIC!Z,  TTIpAEAgLZ, P1TTAEAgLZ, P  TTAEALZ, P2TTAEALZ, P  TTAEA LZ, P3TTAEA LZ, P  TTBiAEA`LZ, P4TTAEA`LZ, P  TTAEALZ, P5TTAEALZ, P  TTAEALZ, P6TTAEALZ, P  TT<cAEAZLZ, P7TTAEAZLZ, P  TTAEALZ, P8TTAEALZ, P  TT AEALZ, P9TTAEALZ, P  TX5\AEASLZ, P10TTAEASLZ, P  TXAEALZ, P11TTAEALZ, P  TXAEALZ, P12TTAEALZ, P  TX.UAEALLZ, P13TTAEALLZ, P  TXAEALZ, P14TTAEALZ, P  TXAEALZ, P15TTAEALZ, P  TX(OAEAFLZ, P16TTAEAFLZ, P  TX{AEALZ, P17TTAEALZ, P  TXAEALZ, P18TTAEALZ, P  TX!HAEA?LZ, P19TTAEA?LZ, P  TXtAEALZ, P20TTAEALZ, P  TXAEALZ, P21TTAEALZ, P  TXBAEA9LZ, P22TTAEA9LZ, P  TXnAEALZ, P23TTAEALZ, P  TXAEALZ, P24TTAEALZ, P  TX ; AEA2 LZ, P25TTAEA2 LZ, P  TXg AEA LZ, P26TTAEA LZ, P  TX AEA LZ, P27TTAEA LZ, P  TX 4 AEA+ LZ, P28TTAEA+ LZ, P  TX` AEA~ LZ, P29TTAEA~ LZ, P  TX&" WMFC H HL AEA LZ, P30TTAEA LZ, P  TX . AEA% LZ, P31TTAEA% LZ, P  TXZ AEAx LZ, P32TTAEAx LZ, P  TTAEA LZ, P "  Rp@1Courier Newt WdtlXUdtl Q_lt \ /Q_-,?=*Cx Courie NewhqI_:H_8yF_\ dv% % %  Tt%OAEAtE L d[Court name]TT%OAEAEL P  % % % TT,PBwAEA,nL P  TTzAEAL P  TT,BAEA,L P  % % % TT,PAEA,L P % T,}AEA,L lSubmitted by: T~AEA~L p"[Examiner Name]" TT)AEAL P  TT,BHAEA,>L P  % % % TT,IBpAEA,gL P  TT,sBAEA,L P  TT,BAEA,L P  TT,BAEA,L P  TT,BAEA, L P !, % % % TT,:BaAEA,XL,P[% % % TC8bAEACXL,lPlaintiff's name% % % TT:aAEAXL,P]TT:aAEAXL,P,TT:aAEAXL,P  TT,dAEA,L,P 9TTe{AEAeL,PPTp|AEA|L,XlaintiTTAEAL,PfTT/AEAL,PfTT0EAEA0L,P,TTF\AEAFL,P !,"  TT,AEA,L,P T`AEAL,Tvs.TTAEAL,P !,"  % % % TT,4B[AEA,RL,P[% % % TC2\AEACRL,lDefendant's name% % % TT4[AEARL,P]TT4[AEARL,P,TT4[AEARL,P  TT,dAEA,L,P 9Te/AEAe L,`DefendantTT0FAEA0L,P !," " ! % % %  TT?AEA6LP)TT ?AEA6LP  TTBiAEA`LP)TTB iAEA`LP  TTkAEALP)TTk AEALP  TTAEALP)TT AEALP  TTAEALP)TT AEALP  TTAEALP)TT AEALP  TT8AEA/LP)TT 8AEA/LP  TT;bAEAYLP)TT; bAEAYLP  TTdAEALP)TTd AEALP  TTAEALP)TT AEALP " ! % % %  T?AEA6 L`Case No.: TT?AEA6LP[% % % T@AEA6 LdCase number% % % TT?AEA6LP]TT4?AEA6LP  TTB.iAEA`LP  TTk.AEA:&j WMFCH HLLP " '% Ld))!??%  % % %  TT,BAEA,L P  TT,/BVAEA,ML P  % % % TPAEA+L "[REPORT ON DIGITAL FORENSIC EXAMINATION]" TTAEAL P ^c TTAEAL P  % % % TT,)BPAEA,GL P N] TT,|BAEA,L P  TT,BAEA,L P  TT,"BIAEA,@L P  TT,uBAEA,L P  Rp @0Courier New`E_5{ vMXQ_IXQ_ Q_TM\M /Q_-2d ?=Cx Courie NewMM8yF_Mdv% % Rp@1Courier NewMM\MM Wd\MTMM@MUd\MTM Q_TM\M ,/Q_-,?=*Cx Courie NewgM:H_MM8yF_M,dv% % % % % ( 6 6 6 66 6 6 66 6 6 66 6 6 66 6 6 66 6 6 66 6 6 66 6 6 66 6 6 6  c."System???????????????--@1Courier New---  2 2Hd ,d' 2 Hd YL2 +d"[Report on Digital Forensic Examination]"  2 d  2 d- 2 d  2 d1 2 d ,d'--%DD--'--%AA--'--%--'--$H99HH--',:H 2 V4H:1 2 V:H:  2 j4H:2 2 j:H:  2 ~4H:3 2 ~:H:  2 4H:4 2 :H:  2 4H:5 2 :H:  2 4H:6 2 :H:  2 4H:7 2 :H:  2 4H:8 2 :H:  2 4H:9 2 :H: 2 /H:10 2 :H: 2 /H:11 2 :H: 2 1/H:12 2 1:H: 2 E/H:13 2 E:H: 2 Y/H:14 2 Y:H: 2 m/H:15 2 m:H: 2 /H:16 2 :H: 2 /H:17 2 :H: 2 /H:18 2 :H: 2 /H:19 2 :H: 2 /H:20 2 :H: 2 /H:21 2 :H: 2 /H:22 2 :H: 2 /H:23 2 :H: 2 !/H:24 2 !:H: 2 5/H:25 2 5:H: 2 I/H:26 2 I:H: 2 \/H:27 2 \:H: 2 p/H:28 2 p:H: 2 /H:29 2 :H: 2 /H:30 2 :H: 2 /H:31 2 :H: 2 /H:32 2 :H:  2 :H: '@1Courier New--- 2 N d[Court name] 2 NRd --- 2 XHd  2 b2d  2 lHd --- 2 vHd "2 HdSubmitted by: &2 d"[Examiner Name]"  2 d  2 Hd --- 2 Hd  2 Hd  2 Hd  2 Hd  2 Hd ,#+H--- 2 HH+#[---#2 MH+#Plaintiff's name--- 2 H+#] 2 H+#, 2 H+#  2 HH+# K 2 H+#P2 H+#lainti 2 H+#f 2 H+#f 2 H+#, 2 H+# ,#+H' 2 HH+# #2 kH+#vs.n 2 {H+# ,#+H'--- 2 HH+#[---#2 MH+#Defendant's name--- 2 H+#] 2 H+#, 2 H+#  2 HH+# K2  H+#Defendant 2 H+# ,#+H'',#9+---  2 ++9#) 2 0+9#  2 ++9#) 2 0+9#  2 ++9#) 2 0+9#  2 ++9#) 2 0+9#  2 ++9#) 2 0+9#  2 ++9#) 2 0+9#  2 ++9#) 2 0+9#  2 ++9#) 2 0+9#  2 ++9#) 2 0+9#  2 ++9#) 2 0+9# ',#9--- 2 9 9#Case No.:  2 o9#[---2 t 9#Case number--- 2 9#] 2 9#  2 99#  2 99# '- @ !#G----  2 2Hd  2 EHd ---L2 Y+d"[REPORT ON DIGITAL FORENSIC EXAMINATION]"  2 Yd  2 n2d --- 2 Hd  2 Hd  2 Hd  2 Hd  2 Hd  @0Courier New--@1Courier New- - - --ddccccccccbbbbbbbb՜.+,D՜.+,@ hp  Microsoft Corporation|  TitleX 8@ _TemplateIDTC060869891033 n !"#$%&'()*+-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`acdefghilopqrstuvwxyz{|}~Root Entry FuT Data 1TableݭWordDocument`SummaryInformation(,TjDocumentSummaryInformation8bCompObjy} (.wbjbj55 `__.Oz'z'S:S:S:S:S:g:X=h==<=Dg:D@>@>@>@>@>444xxxxxxx$;ݭS:4"444S:S:@>@>i4444S:@>S:@>x44x44C=4@>2tTg:44dǨ04ݭ4ݭ4ݭS:404444444444444444ݭ444444444- 9: Exploit scanners are applications which allow the user to identify potential security vulnerabilities in a target system. These applications actively seek out, report upon, and even instruct the user as to how to exploit discovered vulnerabilities. Once vulnerabilities have been discovered, the target machine is open to attack from a wide range of malicious pieces of software. File splitters are used to break large files into smaller pieces so that they can be transmitted via email or hidden in free hard drive space. In addition to legitimate uses, they are often employed by trojan writers, worm writers, child pornographers, and people looking to sneak information out of a company. Due to the fact that the physical file itself is altered during the file splitting process, hash values and file signatures are altered. This makes signature- and hash-based detection of such files very difficult. Anti-Forensic software is software that thwarts digital forensic examinations. Common examples of anti-forensic programs include drive wiping, cache and history erasers, file property and time alterations, and e-mail and chat log erasers. Modern versions of these applications can run based on a schedule allowing automatic unattended operation. In addition, execution can be triggered by an event such as system shutdown or startup. While privacy control is in some cases a legitimate use of such programs, it is also possible to use them for the express purpose of destroying evidence. Keyloggers are tools designed to covertly monitor and record keystrokes typed on a computer. Software keyloggers may be installed either locally or remotely. Most software keyloggers leave some sort of residual information on the computer being monitored, rendering them detectable by forensic analysis. There are some software keyloggers, however, that will run in memory and do not write to the file system, making them extremely difficult to detect. Hardware keyloggers are small devices that are connected between a keyboard and computer. These devices leave no trace of their actitivy on the target computer and can only be detected by visual inspection. Keyloggers may be used nefariously (unauthorized monitoring of an individuals personal computer) or legitimately (businesses may legally install keyloggers to monitor employee activity on company machines and company time), so context is important. Software keyloggers are also left behind at times by Trojan horses or other types of malware, reiterating the need for a quality and contextual forensic examination. Password Crackers are designed to gain access to password-protected files and accounts. There are commercial reasons to have such a tool from a system administrative perspective, such as the need to access computers for which users have simply forgotten the passwords. Forensic examiners may need to legally access password-protected files during examinations. Not all use is honorable, however. Passwords are used to protect private information, and these tools may provide a means to obtain unauthorized access to such private information. This could be a login to a secure server that runs a companys entire e-commerce website, or simply someones personal login to their laptop. Password crackers not only try to crack user account passwords but also specific application-based files. There are an abundance of crackers, for example, that specifically target Microsoft Office files, PDF files, financial software databases, etc. Trojan horse programs are planted on a system to cause damage or to open backdoors on systems. (A backdoor is a secret method that can be used to gain partial or full control of a computer and/or its software.) As with other types of malware, a Trojan usually gets installed due to poor security practices by a user; these practices include opening unsafe e-mail attachments, etc. Suspects have been known to use the Trojan Defense to argue that a Trojan was somehow installed, thus allowing someone else to use their computer to perform illegal acts. Active files are normal files available for use during standard computer operation. Most active files can be created, copied, opened, modified, moved, etc., by anyone with basic computer skills. User files are the files created and/or managed by a computer user. Typical user files include documents, e-mails, images, audio or video files, spreadsheets, presentations, etc. System files are files that contain instructions, configuration information, and/or software for a computer. They are not directly created or managed by users, and they are usually of no interest in a forensic examination. When this is the case, hash technology is used to remove system files from the examination processes, making the processes more efficient. The action of "deleting" files in modern operating systems is something of a misnomer. In Windows, for example, a standard deletion action (executed by highlighting a file and pressing the Delete key, or dragging the file into the Recycle Bin) actually just marks the file for possible deletion in a subsequent step. The action only hides the file from view; even then, the file is still visible inside the Recycle Bin, and the file can be easily recovered from the Recycle Bin. Deleting the file from the Recyle Bin (either individually or by "emptying" the Recycle Bin) will make the file completely inaccessible through standard computer use, but it can still often be recovered through the use of forensic retrieval techniques. "Unallocated space" is an important term found frequently within discussion of a digital forensic examination, and is thus worthy of explanation. When a new file is created, the computer's operating system finds available space on a hard drive (or other data storage medium), and dedicates that space to the storage of that file's data. That space thus becomes allocated to that file's data. If the file is deleted, the operating system removes the allocation and marks that hard drive space as available for re-use, transforming that area of the hard drive into unallocated space. The operating system does not, however, actually delete the file's data. In fact, it doesn't touch the data at all; it remains on the hard drive exactly as it is, until that space is actually re-used for new data. Depending on how congested the hard drive is and how the computer is used, this residual data can remain untouched in unallocated space for long periods of time, thus rendering it forensically valuable. Consider this analogy: Assume that a certain library places a red "X" on the index cards of books that are no longer wanted. A library worker goes to the library's card catalog and locates the index card for WAR AND PEACE. She uses a red marker to draw a large "X" across the face of the card, then places that card in a separate drawer, accessible only to library employees, labeled "Available Shelf Space." She does not actually remove WAR AND PEACE from the shelf, however, until that particular shelf space is actually needed for another book. Until that time, the actual book and all its content remains in place on the shelf. It's not as easy to find since its index card has been removed from the card catalog, but WAR AND PEACE is still there. It can be found by a library user who is willing to walk the shelves and find it and, once found, it can still be pulled from the shelf and read. This simple analogy is illustrative of the way residual data can remain in a hard drive's unallocated space for long periods of time. It also demonstrates the critical importance of preserving critical hard drives via forensic imaging as soon as possible once it becomes known that the information may be relevant to a legal proceeding. Hashing is a method of file identification that is roughly analogous to fingerprinting. A special software program examines the contents of a file and uses a sophisticated algorithm to calculate that file's hash (digital fingerprint). Hashing is performed strictly against content without regard to filename, so two files with precisely the same content but different filenames will still have matching hash values. Conversely, two files with the same filename but different content will have different hash values. By using established lists of hashes, digital forensic examiners can efficiently locate files that have no forensic relevance, such as the thousands of system files that are present on every computer running a particular version of Windows. By removing these "known" files from the search-and-analysis process, examination of computers becomes much more efficient. A computer can also be quickly scanned for the presence of files of interest, if the hashes for those files are known. Availability and affordability have made the use of removable data storage devices extremely popular. Such devices include thumbdrives (aka flash drives), external hard drives, iPods and other digital music players, digital cameras/camcorders and their various memory cards, CDs, DVDs, and floppy diskettes. Because of their ubiquity in today's computer environment, removable devices are frequently of interest in forensic examinations. While certain information regarding the past use of removable devices can be ascertained, there is usually no way to provide a complete list of the occasions on which removable devices were used. In Windows, for example, it is usually possible to learn the different types of removable devices that have been connected to a particular computer. It may not be possible, however, to learn all the dates and times and occasions on which a particular removable device was connected to that computer. In the most typical scenario, the time and date of a particular removable device's last connection to the computer can be retrieved, while the existence/time/date of any earlier connections cannot be established. In addition to the text, attachments, and sender/recipient information commonly seen by users, e-mails contain another set of information known as "headers." This information, usually not visible in the default views of modern e-mail clients, contains detailed information about the origin, journey, and delivery of e-mail. An e-mail's journey across the Internet typically takes it through several different segments of the Internet, in much the same way it may be necessary to use several different airports, streets, and highways during a personal trip. As the e-mail passes through these segments, it passes through "network checkpoints." At each of these checkpoints, the e-mail is "stamped" to record its passing, just as a passport is stamped at a customs checkpoint. These stamps can be found in e-mail headers, and they can be used to more accurately reconstruct when and where an e-mail originated, how it traveled, and when and where it reached its final destination. In typical computer usage, the actual data of deleted files remains in place on a hard drive (or other type of storage media) until that data's space is needed by the operating system for other data, at which point the new data overwrites the residual (old) data, permanently destroying the residual data. This kind of data loss is known as loss by attrition. Residual data can also be intentionally overwritten to render it permanently irretrievable. This intentional overwriting is accomplished via the use of software known as "wiping" or "shredding" software. In some cases it is possible to definitively establish that wiping has taken place, because some wiping programs leave behind artifacts that can be discovered during forensic examination. In other cases, the wiping software is designed specifically to not leave behind evidence of its use. In the latter, ascertaining intentional data destruction become much more challenging. Link files, or "shortcuts," are small files that serve as pointers to other files, and they are used extensively on the vast majority of modern computer systems. Link files make computer usage significantly more convenient, by providing easy access to files that are spread across many locations. Every icon on a Windows desktop, for example, is in reality a graphic representation of a link file. These desktop shortcuts allow the user to, from a single location, access programs and files that can be spread not only across the computer's hard drive, but literally across the world via networks, including the Internet, which is the world's largest computer network. Link files can be extraordinarily valuable in forensic examinations because they contain important information about their target files (files the link files point to), even if the target files themselves are no longer available. By extracting this information from link files, it is often possible to establish when a file was opened or changed, whether or not the file was on the hard drive or a removable device, etc. Forensic imaging is the creation of an identical copy of a data storage device, be it a hard drive or other type of media. Special forensic software and hardware are used to protect the evidence from even the slightest alteration; the integrity of the evidence is paramount. The forensic image contains everything from the original device, not only active files, but deleted files, unallocated space, system files, slack space, configuration data, absolutely everything, so that the result is essentially a clone of the original. Any information that can be recovered from the original, can also be recovered from the forensic copy. The Windows registry is a set of data that contains information about the configuration and use of a Windows-based computer. Through registry analysis, it is often possible to determine the files most recently opened by a particular user, whether or not removable devices (thumbdrives, external hard drives, etc.) have been connected to a computer, types of software installed, and much more. While complex, the registry can be a valuable source of forensically important information. File slack can be thought of as "extra space" that often occurs at the end of a file. When a file is written to the hard drive (or any other data storage medium), a certain amount of space on the hard drive is allocated to storing that file's data. If the file's data does not fill that entire space, the extra space at the end of the address is file slack. This space can be used to hide data. It can also contain residual data left behind from files that previously occupied that space. Consider this analogy: If you set aside a dresser drawer for white socks, and your white socks don't quite fill the drawer, you might use the extra space at the back of the drawer as a hiding place for something else. Or, if the drawer was previously used for black socks, a pair of black socks might have been left in the back of the drawer unintentionally when you reorganized. This analogy roughly illustrates the concept of file slack and why relevant data can sometimes be found there. Metadata is data that contains information about other data, and metadata analysis is an integral part of many forensic examinations. A common type of metadata on modern computer systems is the collection of timestamps that show when a file was Modified, Accessed, and Created (hence the acronym "MAC" data). This type of metadata may also be referred to as "external metadata," because it is created and maintained by the operating system and it is not stored within the file itself. "Internal metadata" is created and maintained by the software that creates and uses the file, and it is stored within the file itself. Microsoft Office files make extensive use of internal metadata. A Word document, for example, can contain dozens of fields of internal metadata, providing information on authorship, ownership, time spent editing, time last printed, word count, and much more. One metadata element worthy of separate elaboration is the "Created" timestamp, because its misinterpretation can lead to faulty conclusions. In the illustration below, notice the timestamps for the file entitled DIGITAL FORENSIC REPORT.DOTX:  You will see that the "Created" timestamp is 4/27/2008 @ 12:15 PM, while the "[Last] Modified" timestamp is 4/25/2008 @ 1:27 PM. The obvious question that results is, "How could a file be modified before it was created?" It could not, of course, have happened that way. Fortunately, once the true meaning of the "Created" timestamp is understood, the conundrum vanishes. The meaning is this: The "Created" timestamp records the date and time at which a file comes into existence at a particular location. Thus, the DIGITAL FORENSIC REPORT.DOTX file was obviously created earlier at some other location, then copied to its current location at 12:15 PM on 4/27/2008. Peer-to-Peer applications such as Kazaa, Limewire, and others, are designed to allow file sharing over the Internet. This can be very risky because, in addition to both legitimate and illegitimate file sharing, people can anonymously share worms, Trojans, and malicious software. Peer-to-peer software can also be used to try to covertly smuggle proprietary data out of a company. People associated with child pornography may use the tools to share pictures and website locations with other people interested in this crime. Once more, the need for contextual examination is affirmed. Remote access programs are designed to give the user control over a particular system from a remote location. In many cases, this control is complete, giving the remote user the power to do everything from viewing files, to running applications, to downloading or uploading illegal material, etc. This type of program is especially dangerous as the intruder needs no physical access to the target machine in order to control it. Spyware applications monitor, and may act upon, the actions of a user. For example, a spyware application may pop up an ad or redirect a users search to a specific page based on the search terms entered by the user. Spyware typically gets installed on a users computer through user actions such as opening email attachments, web surfing, failure to maintain updated anti-virus protection, or participating in file sharing via peer-to-peer networking. Much spyware is used for marketing purposes; these purposes include collecting information about a users spending and web-surfing habits as well as collecting information about installed computer hardware and software. It is also possible, however, for spyware to collect very specific private data, including personal, corporate, or classified information. Software is readily available that will clandestinely record all keystrokes entered on a computer, after which those keystrokes can be retrieved by the installer. Similar software takes screenshots of the computer at predefined intervals, ranging from a few seconds and up, and plays back the recorded images for the installer, essentially providing a video recording of everything that took place on that computer. These types of programs are useful for parents who want to protect their children from the dangers of the online world by monitoring their activity. They can also be used nefariously by those who wish to covertly spy on the activities of others or obtain information they are not authorized to have. Steganography programs are used to hide information inside computer files. Very few (if any) legitimate uses of steganography are documented. Typically, a user would employ steganographic programs to communicate covertly by hiding text messages inside other files. Data can also be stolen by hiding it inside other files, making it easier to transfer. Image, audio, and text files that on the surface appear normal and harmless can have hidden information embedded within them via steganography. These files can then be transmitted to others, passing through corporate firewalls in benign-looking attachments to e-mails, for example. In the aftermath of the 9/11 terrorist attacks, it was discovered that terrorists had used steganography as a global communication tool. Steganography is also used to hide evidence of other illicit activity, such as financial or pornography-based crimes. .....//3/P///k0v0000000c1e1o1q1r1}11111 2 22=2E2F2233333333334/494p4z4444455(5+5D5R5X5e5}555555555666177777788V9h("OJQJh9 h("OJQJh_ h;XVh("h(" h;XVhIhIS788W9X9::==AA[F\F`HaHEJFJKKNNRRDVEVXXZZ]V9W9X9:::==2> ????AAAABBBBC CC C[F\FdIeIjIkIEJFJxNNNNRRRCVDVEVZZ]]]}^^^^bbbcccccc e eg gʺʺʺʮʢh[h4[`6OJQJhch4[`6OJQJh#h4[`5OJQJh?[h4[`OJQJh9 h4[`OJQJh9 h("6OJQJh("OJQJh_h9 h("OJQJ@]]^^bb.f/f"g#g%g&g'gii l lmmZp[pss,w-w.w$a$gd?[ g#g$gggiiiij l l lyl2mmmmmmmmmmFnHnPnRnlnnnnoo3o?oCoeoiojolomooooop pIp]papfpnp}ppppppppsss˹˹h7kh4[`OJQJh4[` h;XVh4[`h3h4[`OJQJh?[h[h4[`OJQJh[h4[`6OJQJ"jh?[OJQJUmHnHuh4[`OJQJ?s{tu+w,w-w.wh?[CJaJh?[h9 h4[`OJQJh4[`OJQJh7kh4[`OJQJ,1h/ =!"#$% n*K8?d[#mIPNG  IHDR\]m;sRGBgAMA a cHRMz&u0`:pQ< pHYs&?yIDATx^U=NsDETEHA 9s9s99ϩ}ݏw¾7Mpoݪ:Uuvç @x#G <@xr~ݝV8?7| ,a@X2 e ,2C̽d/_G#<a@X2 e ,adL-ָȷvWqX2 e ,aߡ ̾/к#`u#?e ,a@X2 eٿ`XAF?YC+ ex,2 e ,a@X |W \}WuOw_Gx 2 e ,a@X2ד X~qWvtO< e ,a@X2 o_\hjo5{z衟e ,a@X2 e G};o|}W RR[foٺSuɸd$kAX2 e ,a@Xrdn}}[[awu@[M&nF-| ,a@X2 e ,92p>|ܾ/QN܃{sO&n#<a@X2 e ,aȑo vwuOVn4wX]yYAX2 e ,a@Xrdn}[b|.uwA׭2Zd垜[M'#<a@X2 e ,a2p;_?/; #|rkF+7?j2op (#<a@X2 e ,a2p;_?/drc}_M2^w}g_Ӌ$.AU&+ _o;81@X2 e ,a|o>{nV@SsOם^쎀֭2Y`j<3y7O?_#<a@X2 e ,2p7~rwofw |;9c;xN2]?}hxL?$qIw9^x_e ,a@X2 _?볷sO+ x/42[h*h ` xg>c e ,a@X2Y(vO|[헲^tݪ=tv\-o'ß[+_r/f~s㥗^ e ,a@X2 |'}u΀ WU˯kZ?O$3N!Gg]{ѕ-я~=уѓы1@X2 e ,a |/^b3gXh&L+w2^\/< e ,a@X2 edj(fKoxDhso h7e€+ :2 e ,a@X2o1;Bq+4lWVwR nҵ/f#u/˽˕XW\ʕ[_&"b}2K6-UrC2exPD eJXVG˔-T2K+dM#"6EDl*SJQrsٲvDR:䖲eKm(Tw-e;e*]jkD2[#""(ÿ[Ko%JDl-]?K-]zki']:g+e[ߦKs5n:3<=K_7Gwz7_͗9=G=[⏵1˙}&w7qzw>AiROw~[;UoZ9:mwi|3c2^5W/11s8_+.ԽޜgR&!fzGqʢlؚ}\xtg^s>/]Rxh`2{:>|RYg_TcE|͗ >6is|:&x^KZs?ϳ=R|l)]$R#x߇q}H=u ,)Z/w}Pu]k7|4C^ːl h!9+iiHM@\f࿃q@l$f"#1Y@tYHJD44$df!4! HEJJ"2yN@qHόGj0 OͷR3,$eHA -<x -=ϐ'"̬ HӵRxot^3 {gY|&^;5+sٹ222x+.cH f 62yg 7HO8L>^ALkeru=_x4_L󧹼١1ȤdRheQ&,4JHLD\btʝ?F]}^uȅDx~Vk'#:9 !єu70ÿ] :w6y_\\/HDy.3\\C Y''I͸sFRN2yY\s~2F Sk>˿SQS#=:@dEBMsR $px"Mdd&ޒFQ[/q&qh=;njJ%ݖFJdPߧKcԻ%YY/ڒ$aX3c3賲d*(;(|M;o^ԯAiY|F ى;]WL^±G㝩9f/W*@!}JKOsl22c;9|&>2D@9JЎ$f\0`z6 [Eeg Y/~Cf |eI/QfCuC:iSxe^+cd1Jxo6tN|0#{r>SyoTγxu/c\twWمd~GfYs@5|#6:ϞAJ#D1Qo 7HZ5Pνg%K,>֊'f:/ϔ~B,sq/EMz`(Ӧkpq^Y]΅ wmxreKy~ICr5tW#ɟԦ֮)4g;G>9}ʏn\ +oJαNɊF|0ב\i>dp]^8\QbyOZ'qϦR9/K}SQS4~n:FzCUf#]sHLɈ3+A}$QhAM _//QoP \?\Wif8 R$TS\T1t))\, Nbj"bqeS'h<锤p-1W]d$9dr|bh^봊re -= AR 3feHunsɋ1N: e|ҩg sI2D} GPŜpzh y49WҵOkBi^*W  J9}T-qtX >˃/Cr(8gY/0*u<$75ԁ^"e1I:-ADP!ZkFE (x }HP(A L׹& oÇu*9BLݳP]:RIc9,El<9iHnOx,fr8o*tB^W4>Wr ٽm!_u ,7i^~]3^]] g{Q 07r.Qkp$1ʔ(BE1C" N'7޲$4^DsLnQOR9)p@9 &S3pstʖhB2-E.iPJ@LߏJȥN(r RrSZp*%pc疒M%3ؚdx~ pIsI&䤤REPև-%(j{u)D/LQLDE [R,3X#q oR~~@.n)4q*:.dKPͱgbid2= KNBLU1@xxNEY I-;ec Pl.3xCsGgff^K Okќ[P`JXH`BKΣ"I\gQH\V&StH2\PaNeеiqt&i~\8)K4S:`rzrc~m"鴽 "q.4 );I2ĈI(VdtM[b4fRyɊl!r*SH;,`G?'P`c Цƙc( <볺'4m% ()p16`Kw>/BS6I0'S:>KLUFJ>BBrs>lr/@9J`25QYM( YOjN$C~axH"- pd3֥֖dGae3_)\7Dqep(+ߐu%^dudU a!-A=bɓ8y9Cܙ8vl܃]bN)'L1*T+h"CFcc{b02BZ<LϝBuPQt N:}Q+%#"as2\8&j4B4 Y)#FZT2f"?-h]7 ͨ|x. Q>́MQY4~'hA3lJI'E¢Җ ZT2" ^1eɌFP"1Lc*DFEMS6$MctdR%ESZ^:{"ΣO4V ^=eB]6$QYϦ}=zE;\wo#p聊.f}2,K"Q$RiU`z Ldp)()@c "Gŵs%y+eAQbi MaKY4I^P.(E^HL13'( F]5XYb,Zқ|e0,|X їM5!QX|Ͳ^JCz%l$[%%.Wlm=Tc9 orBq ddRD97zh`/@gS%ELIg.6=@N,\@L#%N-ƆM *k+ɜ Hucȍ,lf}xvY Iy=ݤ,:گHTGe+G(Ь$fgc li 6U:bˤS3(PWR=*70,}[1/H.T"@A )żWf@%'K8QZynֺ1%,IbCtkwE+sR҂6'U&hKQm$$lIF8D (˶2M` P,iyG!߱ ńð`x?F džas$YWoön.03.C,@/.t+f ia+aXrF 0i@Z '@΂P 't¢UYO,WVsཬVOG2@%\JUʃj\iZDBV2L Em cWD4#s$r'(hDED- ʍh<{\I(D ( z>,%z{>-!c#dz_5FU0Pk)H2ϗ̤X_ (g(r=Jf$Ɋ[']7J s#"8;3ٔ > Oߑw9z9_R T+`mM1t(ߊʊ%͏F p)+KyP$:0h-~-J L}əcGEc(גh4:U})䥈.HCi3Yj\;bAQpCFt9g1dʲpPs$h21|dڀjaи\P(p)˥ "qr#Yj$Ǭ O"A :`[}jd+GT)\heTgjNucPQLP_r~2t;?l 7.WFĭKi͟_=&JAh3 -&x RV'Ns#i XR&Kw8^ɲ=iʲ$6Z ɬXlT!~ez8&r &R^"C%HQw c8Rh< Db)+ 5!:wlfX!{$rN)@&UlޞdT6SG|B ,dJl1)S`e1]2Lbe- Z U&EtL=QWwu1oQxquspj,,CzRBm z`:UI_PJ^aVϙN:)jJ @Qq* S&T+n#C8ң__1rc ). 1ϡ.F=|BW?eФWE'h{M{jyE#UQcI<-#h+|.e$ 0ԃ1 +{0$kr,.T_H%e Wliэ5/gɻĔgK>H<OJc@l'PV$]Dϴ%l|^Qp'3֕ȿ"h=AP8i_|.u+ᝂ.?T[ep+^QTE tҡx[qq( ktª{7'uǙn]Y\ڸ" RBN_jFh7DSIӚFBPi^PX=%$™C2Tj-()$:"IP]`IU-jx $d6v6ˤ^2Ȑ+JA0#^k^dQ\EƧ2~Nrq3ZLQEGLKq0z ET T 3>\:{uUa/41Re"Pc 4M"JU!PuZ4NZdKUVR[KtD0)E39AєKES@!eD5Tgh!`A R5PUhutRIٽNc^N )q2i p0@\,3b(\^&V%c5~,h5~ 8!HZW] ;CY,dDv RY_ O/$&ZAL"GѡwCe,%PaJ/T lt 77C}gvcſ[KCp\M@ pR+'jE eJ rl ƐSɿ)C:W„uT 6m j̾u*RFA0 XfHlD:N㞤5z0wGW5ObDIQMӫOS*.=.F t- Y40(.J;.ѳ]FLH$ 8:XLV&-5nȤLuiQ(9s7[5J$ê,emV`C8: O}EP&m++~ ~b0DUI8^clɳKXMzj=J=AM)T㚤AR<*7GkA5> }2Y}ր跜 5P$qn&6@U }8UA=$Q8OeO%%K C@~F[RXDj4õ@hJ_r-zqԯGT,Tk{" PGA5:R"_uuA5u']&ߎT!go+y4G5Q/_" pI6ZV]H URzy4o@p|\]^8e]5@+Nw4e2,^E%U SVX8L3p %z@)'orwnviM ̖귄 u.~ܠ4bR" ގ 3ؘN83.8k2ROE)H9յ8c*ɋј0{%FLX[cʌI^J%Pm&\R%pDn_Ktm)̚1JR7`2< +pբuii.qeXKC)3إ+##_FK]|݄rMKP텊}'^{"Ξ?bӰȒsEu{Ɠw $Cd]DW4Ξ@%㍉~Z{cRwrY=V0#ر T~ֹѪ_ dH J +3š`U$^T,[FH*E qE#T'96j 9hQŐ(\ݍ!)GͩrQ seq ZƷn~4\)A%m^FIQHbYͦҚ.L[z_N'5 bS^JoȹQCUé֪PvAEfGY:tR[̗*'N.^֘QmuQTK ^Y]۾#`2т{.dukrL.bhGe)KxVL461}f=I20 |&WIvz=/KV R묁N zbNN[T eΛ+}A=P,hQ֘H#䌘ӯwWeuvœRWϤ@jy$q4jINjg(c lqpDΦ alOs,ihԱ6^|ycXt2ոAe5+@YYëjL\2WVw6-5j@c QW]ݎY(ׂ N\Nkɝ '+pe ʑ h6#/N{| :'BM-Ykm5ejANY5AWUrYg4roDaŕAzjTɒCf:0 eULټgh{Aseor&!b=S_"1 ez,CDg8k'"#.̴ j֭1׬25 WfM(;(:&N)w+v@3OKr(.r`Fax+2>^nΣ5 !|px]DGIT#{!Jaj&}iA=?3`mC~CBQn@1MٕDIN3`[͋8`0 gϲNi6F ixOXuj$RJ*1!Z6)ԫ +Hـ__h#= U˧u^~s x}S C;~[MW({&w>W, ~$Zrftl9Oyr5pe7pa?p C-ٲ )WOcמz`/γ#WѳyxrxX,\Ҕ.XQ*R*V7_~)jdmED~KŶxeD}PZJ%wolAZoi* "z?.xznv(畡bxF=RE/9#fc\5Tr22|H'YUNcY ҍR"M@uD#9:4oXd!}X.rVu7 TAzZũs5\%ʿ'QdU9%+&g!+ Ü9r^a9N{={ΤA:ҩ⺢p5"8IJNSUwjJ[ T2?/sX/Otk2r3}GRBN/k4T ?M:%凉uA'pIKTkuj_#E7Wu_4m|Vq^Y&WY4aelg9Դ%T?pO<},}xKۮBI4 {"hѶd艔3=0iTtڋG7 :G2|8AWҩf͚}bI2lFm\{AnСs̜ք)QB5fpEpDu=2B#(Ϧ51 ]t@>8s|?ƱGg=C_t'LC40}ӗN|i #TEQWUGvs\W s' C8R,o^ܲK;CS{S}{`˜Xl N{b8mzNvݹ#0W>esW!""nvl݅:>;kn4j<;c RXQk$[ҫFvDH952i,.E[̲1P`srs xdD, Β6e Kֽ ӥ2QX,^80jG`֪$aܽ:wqg!iFCV_ѳGOC#G؁K,/hC%u\ V,ڀWp ݺ°q묧y4fL._8y撧buϤ=b۾S&zs'ENѶCO\4>cE>d)jC:|lnΘ:)#yS,Ѓ:`H!~g_Rc;S2Ο='clJ\9u ǍDoKLh:s3-kh,7HO8Ǡٵ;u+fkX,3N16u @mEQϓ-N6,\&+pArMDϱv<@9pi:vj$(H:f&+֬ߙe&>J"v:"V[q;(SНiԘauEW,_ڢlB{_8p6ohfe АdJ=|W_Cеst:MpjY0=:A=a1$rؘiy4:S/Xg$;J֮X^FOHJ^n1+2q/[͎̪z  mЈQqy r\G5Kѣpt7cla)w@|ٮ .\<A?#Qo`sSwbْuelU& [bXy2%RYfgᣱuV:*a EU 2RQQV>g,ysc6Jae?&mρXr#i)ضa:`:K.Xj޴I־5zPv =BѣMi@H,N9y ?dRu {é}G՘=g:Zt錎}鳖~ {WG=ъ~L?VN:ߛ3w1̤pM&u:cM[2E-u^jLdB;Su눹XCD~ ,{+cۻ/:u5KWKg#ߝ:q*;e% SmǦ0u=vcfU"&_.+a5E |^~˯k] ~ [e4ZE:wV] *FЦ)k{{Xٰ .oӺ"5j+A\\?z~"xt;s0bH|Դ1ڌ般=΢zݶ\V䍊y:CyēO୷ a/$`úx#~9g"ʗO_x|7w96&kEͪu3σ`Oy b._ Pe{T! I.U.MUaEs%׹N>xa<۠8cnθx}E^)ԩ/\?;oae@CTEΎ?z~8wJnj3H/r(/ɏ'} OZ}G fśo?#~~ ?>cU{ТMǿCMLjIeHgkp`a/ԓyx'# `E)NZ+ @Z.x$2C#괥yN=k" -ZFTt.tYEt.ye%D%,0uJa,I[{wolktIϝ60eXćz#rYUt:ymXڔ3Э]3cba?.]gusM><<~Iww}bA5R#đ PFfPcYxｗyGv=poz 3fNB/ч} KڎEnLT,SiǧU>H'9?|A<_cOdzX0A軪; Qёؽkn 55ZoIcgC]uxGQ>qQJTmgTeݻ]:{h'V͚g#y%At޵64LL~߯ƣqO <2'L5% U'׎5P|x|V%F6Jk-.z˶Yu/[qek0E 'Hv D?e+JbݖӦTb͵r=`[k{7,}zРmG Gǟ8y8 .[~cL37oAe%W}{vX-KPL)<蓸Pqg\Œ{Qfy"+Q.LAVmw7ペxWpf|R '=kcǞch1uvMq\m[CvūM!]7?1*W"iL̜hK]9͚_yDď.Q\ &ث&pYE^BA9}-Tީ^} V=~ؕY̒NEѬm7>qA3xO`P8H ?ͱ~:#=׿Fӌ=`/F\2揚bѦb6 {d?=.uZꑓF]h6 =$~#YL6}m+P*x.syd*/:|Qb}U1 FGñk1r@7:uk1yջ?v _5ly<^.mu{zÒ(Oce <ߠaaH^QrO\ tlg3p)} Xe߭kM7z "kB:A(c '0r}EgRQ:K]*TBO?j ҙ3Y^/f,Z#;u(AEL_ѵ'yРv}>t ;w4wU>q'g(Hpqڕ33^z/;r(2֨eGۿ W+XPv^b9|R׎ɪNT+֮ݳu .`qs__mӕ0s͵}6j(JzPy@\@}TSf&ƧxNj3J_bcl/JA' `Hf¤bbiQx?bđ8pv=tm(H98f,8dFeʣiAڃNgw|eE6L19z??᡿w0`hST%Rmm,FC|5\<60nU0!5/Y0wZyJؼm@x֮ێsqʹغifSϽ׮_ûx!֡DASJ4>/ЭW/%`fi=5dD)hݐi/S]Gtz̜:{1{xX?m )|\'āю,{BrEw'5Ÿ~{4mКL~whZ<;6,¾]kиis<\ql瀷2[ڥ-Q=L[gOL>L{4h5rAC'჈h4fNah(A9L^Sf/C*0nD]<][Ӻՙ_2Umd56Ϧ .2ğ8zdbwA ;>|QW,YXj1jW*yu%8\dxQ8A=x틗/2ق*)ܭ2{kx069){EpSyW?ujZ0=ſ˿`t6S_ i6mPt!k ֫|R\ovv+4%z᭚hlSd|wO)UlɍQTi83I`O`cŷ}.veŁp8+ 0zP%l?e/,yhV{g3qrF ￅ!z?ǍDCL9_E \,72I;=w퉗^ȇiϗcǠBݼ˗CMpE:*by@vujyciB+6_7 'bv*䵓 Xg0k\cZwƛGcf|WϞ]_!x*8 20edwT\N ; HaTJ].I鰚[y.v&W su.GGѷK1ՇTHEiL4[wau;NՁT !j+e@˩{ݿ~0UWϬbtgބ*YF}+֯Afciy>kNq]sjvklv:zå@a41G-4w֌|/Nm믾`Î#X0,zpjT,W ;Ql2]ݲ^5y8Cz;x 0gQ|Lyk\^ڱڙ'4x&_ jЭXt sgmo\S̘2 o=_6\fE: P8s: U(?8}7YM&WؿE[3"]'a1BgBX. \)kFl{Q6I=;c{Z{a/m^5G]i@:#ko]rL@O VY޻yö|N ^CS21kdQ 6v$@%$Z5Ԟhިj::nj̵ɁTCj݆miOk@ǯZ27e@թ5xrp{)%1ǹ^ Ȼǟ~ر.+$*+P5^p)ӯZ350!ڷʵW]_7hNƗ/@G|}И]n+7߿;6kҝkY1g SXr'LGB%teZ'黨ۣ9gD`^{ ]EпWccgsxu@ ωm QZIWT.Z|MgxjjUȹSx^5xJG]#yAYxn/V.S/@Sq=h^Һs:4g%R ^En'5È0&,'z0+f]k[cxװZ,^Szn籾)ԡ%~3^oGpY*/p#H*LmW^XC]K] E/ te|&>op] ΄J)3\],Z,U(+rR_ꄱyiV~`KFJ^~M|u.<&W*Kjwe{NcՁ+s>˶]Gu@ڵxܻDqSҢ^3PPa,/mg..c]ｃt8,"5xO.ih Q۬:^D7 MR\"[5V)ל9wf?^~=ߢ_+Pe۱?>r{ 7=1i: W,Ƶ+qU|^yL+a}GmQF]FLpʅ^Ő>TؼE̘{Ȥ8ubBR)̟bHZaD#?{:Q##?UiS kBjm=#{Q$3?Ǚh&s&76)3ZIc32KYtZl߼۴F떭xWGcl2o88y} V8W_Bt%tVO=4^::`صsE5 ,ro: [s`n pYY;\I#`g}0+F?xf Ak1j^Pq!0aW:8_'N&U-ظ F3K,E 0xjg͓ NR'5Y:kQfÔkx%ʽga(Y:2'7x`scr$cPYŖ{йE3t."u'Ц\WWAmnqCP7ѯ(ޤnH@ag,Xw.`h~NڿW.ä rx-d}7Ju\<_mڒ[a•FDZz&udD75́tnxٵK)ء^.TG#4uTZ#%6ĮzPE͘-Db(z^WV^G2\ԙkfQ\#(DVll[:>SLk@f˘?v,iбHqrҋ>##YuW<)QMdg)&V R$d~ͬMsf^j'عm˾ѿgtiHر'piu+tgS}Zu9+|s3Úc%y ƘFwʡp4_~[Mۂ}cF5 ўN7f5juԦQ\it7G鑎TV/j<6[A3di!%_ӻK`uDF|?ءVWݚC±8KVkв}sl.&b-9EҬ:Js 5-5mi#>J'FafxKƦpsf``=D]gvka˃a͢,y>mLF, b`PIe{p-k0_c A/aU85~FTCm^p.FETB%ln,@Z W>^~6 M7n!4CkgTmK UϕO-w

m9k<+GO˦Kq˲X P'̚at /Mk?ʒ߱U;{ I'塨+(U_ IӽcEDQV`$_1LOZC4[*2e8J`F}wD}nu}@6oљٻ4܀Ƀi{`vI?ZçٞB Al&j0PV=R_k4DO<ks͗5q_Żeň #;xj*O.f͚zOфudHZn+3}NtR_%0tp2WSpiRe̘R+pn rѨz-&}VJ'Lk=m;uš,VoW1{4d=A6/PE@V+lX3yWZjJ®К@h%&FYGlX|Iu,޹_vJ]W'H;%`+G+hO*Vϛ]%܀' h! Vd2mZR*`|OxXFZ"8o>~k>@"1o'VZ3ъsejLYԤxzx6 *=zuG_tBO5q4mXlDZ*s{rz5 fufۯ1XӦk+ 4耺dOY_6AX-j5ÆiMze,ؼ2hh&K`bNx1af/dÎ)zw^]Kp6ۨLIZMpcO`uϖo/QLԨق, N koH"Z7qO'eþ ^"8[I,NaZA֣ )x#,}D[1s .P#. u'\?UMYedԌ(Fw!;8 !jD1QPB53*c1X cӚ3\~_G |d*8*ٻ͵EgK^{|{PK# ;*8tFT4V,Y/Eq$;+)tL ѿ}KlfT{I'h%txvɧ8sXR-K6 Oݴ ?ٴ;OZ@ݳ9N<+/plz oSm8yQR |Y>tW{6X]Fz-Q8w,t=r&(Z" <_ؔT3 2e?.Mx`i?m7cqz؆A9 H-@pՍMy4Je?ΪF~aX;p}e ~9Z˂X=y0 f\c:x7woRF4>M{Z:8sFG6۶zrl+!7q̬%6 gT|ӟt"Aѻm Wܭgqj:n;Cڦr/SٕʐQkIʩ+k"_#yOYaO^Fi@N"Ivrj`z_NF7 ׿G/ +;|8-%cՊy̢ÄWRJtI94˓Jx<{6l" loOGpV4M)13Y?3wy:Ə)ߣ8'#`qDZqjj j3آn+gM~c!qF#H'(n1>#8}-|Ů\}[0SDYfVAfY[+-Q( s0GYq;}J=Kk,=Ǹ0o44^gwD/ڣz{@ǚFMR:V[Icg,+ءmU`-/q8. w"bIfLC113O%q%: Ra]X:2'IQ`TW)sg؋pG/FW+mvz 5,5 l`{ܡn|,A~1k ꃈBOaɈ>C+ ~_4͆h܄t^2RR.أt+V햴l/Fr!=cPvR~Le:b414^ j 5]1y< } cg4(ĒQ1i665 38wl?"j5+l\5ͫ W#yU3(]YwrF$H9A `ea:8IIbl٠KS>=\nPĹ-: (r 2M KbqU#n9i(JΟ267ޤ66m@NA䖡NÔCPlYt"U?eQ$Q)Lf>n>y&?e T)Ҥvى*ks!5 oՒMY*2lY)='E#ѧ?$vb$&7lXrì'+ϠzP3qM:DZ`\<3-Ma ptJ2kܡX\s-할&(Q!ݥwvoGџk7mcc@?eUe]|۾G^ae,Ed&#lk_1exaL'"`jT,VWp.8ԋ+Ƭ@:mh":k@f%gMǬXYv9qf2,F=2,kE ^~Ƌ_ߥlם.5]~KKs6иۺޤk̀W27ͱ8(lBv 2eQ8. # ]w~oˆԓ.ritMgPvhiJ$g Jx^pk@ZX2l+f姞AFm0gPmFgj˙DWÆZ_PIe?Wag+Ue$#?sk1vsZ4zhO%}tTxL]9Gʍ (;*Cj| ZXǶޛMsڹ it%'Jh>qƏţO*,:=wNmIƟ13ʲqoT=nl9XӨiX7o ^'"x/=:U <β#VUbaD[fk G^-K!aMW(mCG82>Rje+LX"ͤhrkd-h٠)VNT1j|9t%NnD0`sgaB;֯A 7jk$:'ְ!Hɮ[&; >?]׸hRg;uhΈ&7R*u1th%9N:fmLZPZSl܎+G՗lpFUbCWt,-\Sڡ=f2iרHMq⪅y\YʆA4۱_z6JLj~. ûE'kaGF_Ė}qr$ˁ -2ߎUdSgХ30́krklصt"FuS503oC^/DžYB̑(ke~QX q1>th vcf 8E1]fҙxᰋ pf>0rceߕ74Qtiv㞘Iz,DBJ!,F۵:=[au5 :|i5=MGVkinU7v0Vevwuˊf  g]>+ NWż}ɐp2VAIc/㴵~f JoGұ#n:a. l(5c 2^NW`cLl־){1s[4d#dy|kز{[1ӱY3E;veZljкM7ase߸[eRKHyVf^Q #0kKRHdgP9m-Y:rd=uI 6i`=4EC͘`Vqő[r9MZ0#ZQNԫ5b*n/!y{\<ꕖH,rmtEVʵͷs9s|cJ`p u뎗XW?Am ޿kX۴u]p }Y0_ j|n:Kch?Raqf"kh)mF1l4k* Zt`xTu[2su~Hy|ݘ8@=kd⽶o(w70)aMƖcϿcjS(x1f+`mJiDѦq\ɝxQY5h_1qE( ari}-ud5>!p?JUAQ1x,}lWnaL߽0ٯ\,j 14u-ă pEd$bhX)5aQޘ֖348wX,zfكaktZhn V케I-9Π|hJÕ.V_4cTKdKk©x;AlY1GV€㘹JB^Q)}XQ,Zj$Ue˶T@]FmBjv: % TicQ 6ѣ^Kv"OyG Ț(}(ZaF.nƘ:cfG"OWe6hY}DGRidty]ODjy-WGE^eOA5v'v |&I2KE-T(k_-Sӿs:?i֋ ݯ~yQb6HB`գXLwGʙ=x_м} tUEE^gy_bqbG $ߺjM|V1/`?[vzUΌ 3yOh(#xK  BO 7G?*Wq즤 (鸨mM3€\9n4\2*dy54K |ԶJt =(;aG] ^$3kų˽ŗ?Eؕk\CdkƺΨQ Vng4Xh0l1Hj%Kp13W1[>T9b ҟueMq}l e»yѳB*]+x ^AZUaL]ro?nv> / +\f&\E:OTtn6T|e5.SItٌ?.m";-'l3.}YWV56a iׁcѰ"7^ؾGtY+לXjiQWюT#0vl|b3 ujqc nM Un؄ j2/hSzUL)-sPY;Ph[x&-tb&>(.6(ARj%/~ j¾#lyr0t>o9ڗSF(~q>HQ-]e%xD%5]CNl[5ÐSpԩgHM^A1ΦHz5ar+t(}="}0dٝ白J>|ˬ\,_ L.in:sݏ eˣItʻi+GQZMds} q[nD*RW1 oudjT+U#'8fWH.\燕LVvj=-~XugAa3k Qᵂ$:*Ubu} _tN,)WjhKF$=nKTo\#.thk=oPػu+1z[g7c0OjX gџOؽ{5qR(Ghʘ4o .Vvt^8 ݾh N_XfA3 Ox>4vID9_0!~tFl{m>k O[Ŋa^ 0Hޑ殫Te; 1Hӳ8D1q Ξ؈:uJ^q~{fw@{1{~Vݣ,uitFijT3CS&v`Yl<{Ad&Msڱ(Zh­x[&Fmfr-,ՅbESᵗ"p.4HFmߤ~ **UD(FUX/VflO1T'PЕK{u ts@׭f~Z;pؤ4FS@1CQ,J06]ƴW>4r*#pk? 5FM>C`ʣ,3]i JUjmz{J^0Ecؐx{j Zk`p}3NBض$߸x<&o"WzTˮ GS9IG =]._# 2lw]S]UpN Ba4A^S/٧ФBOʬ^:&i֊CZjWs gSYcRD.@vX,&3ͶW ~E{P tO?#X(j~Z"笼3ZL'z ݫ9žyQ6z<='wGMp -7X1뮨W#wK]ާϱen Rفۤ(Q5g}v \ IC")I4pedN=q^w%޿Gn (~Ĥ( 4o]JV$F${r{# 2Cs[ pi$4 -<;v3[oZ3$&_BE?I;d@e 2?ioB,BSѻ G1$ ģMTlLL9'h9x,3ML: Qu4FMOݽE=h:-'a̹O2iY_} +ygq4O۱5xb,|I1Gs)XJ/İ~3}NM:}k`vvοSc#Ỳ;^#QwJ|#ǯZִ{M7mdlnfk>v aX#U{sی&$[L4 `PŒzn\l(tlـ+FtT*YfwPI/BGЃ?+{#lݶh_~ލ8Knڴ_A Rj޽L'%`pAx@IMl'b_:R+,ڐgE5tәl赓4*cآ)HE_4g'cVV]t`}!9; @.M+&qoG}ml?_tv\=82͢xXOޯIL_ZI34Û<ۉٸ]? @]pvƊM{pv@UiF"]Y.Mb 0ms;/dL=DblK/py36)g!DEkkfvL^&]56p%axvlbv%^؏wHYmެ"Ef{okGੲOcr5zp792qC~h4vx5Uᐦ38We|ɰ.~'Dߣ+wBM_pݬvK+wVhgBe}g~ W2b'gfExD{IjzEGJ|4;ر-L? f d i310\ޣ؅'N%b$l<0gYڂu}OsV-F /qGi8ɧOnd-cgR64h=.K?}0MKSہHR)O= I困q~R dAe #3bw=c/Y{ UjOk:&A^*TGXp+@Q65)')'X$B ߞ Ø:+%p\#*Ք[w?j*{etӧOozB^U.wN{)7X(\ZhCj4Fg%}]L˽~Lq7.OonSW92Y+܄-z{㤱x'y"bIC9-,)3ΰY\bMYu:[k*\X]GKKY8vm/!&4::slSEr.E~7V~42VyiS%oA&,MWgxtz5<7n:V˛C2J6?D(@S6O).k!V Ki"^GA,mk֣j΍ϳ&6{9=?7TݱyJq簗r?c+jn8\8_9zGĀAlGנut^_ 㝢|AuMܭ1JU)aܜ5f0r 9V@sf>4c;Ac-G1@lQڛEqלPY@%^kj-Y ՇHdm!v[~V-<4ml\q9!f?sA܋,;᪀V`ܟ'`elU[& <@ݺvi+ d igmwW'ðI_@/r=&=[@"f>Ilv1l߸WGZr %& 2p))w2p8lVs$ ƶ, ㉛o+ĥxRY+vp~e܊~VeThEe|@!ZtmJll,$+ϙJHu> o ި@mq2b^[Kfv%ңb_*A}\+G|3 *8/#B]>P 5nk2^\x+janZjaB\]4ϸy^p%Ed9I=mOMe'E+k?O=b?Uֳl< IpP uc{U{z48j3 ^G~ҕyntf'Kl>]O r?<\OEp9,=6o\"o./7K"=J8{L_=Z"F_X:5lX=DKgTGэ??0ruRXd 38svFnR)_|مt3yO㦲pE+^pAg1˔j0L {6kr %}*rfXo֚ckWqX0o3\lZ0kk`U! dTD'`m8mn~Q p-t餑eWk8u^~.27{lz봅 o7r2mPgGkڕch{~nntA|:EioQ=u)-Fm0zGD{1h2yX7L~^ Wޱ8Qm_gPݢo<)^ E<:"Cym1fW/E xK|)HYP mTT!k69|h˧B3]%tU=\ߟ?mqN[B3\6:!kK\vūc_rv1̬%Σ6_v:rߐY[D)XhR"^Y-mM֣w3pIew.Y3Ѳ~;`{Xf)ƲP^Y0]<31?[6nmn`JkF!%mi(ƜG26~̈́sdq{ȥ dSjj({mޱ46hٺ%ڳvvS!^>.ciغiծSEi[O8i^͘G\ddÌ0GwvbyRIXGE{O! ):xxElȉƋ]{-][}iK:8]8x &gW)Fe9~_0b[bx|6xm`;Cܣ4ܫWo|7s3lkCGH!=3:3W{@թs/K#:JҀ+a<ã=(L"<\>XIR=ӦTxd $in|v߽Tdu =| s=*?rWޡ_\V17j יsX⯟G]wckgh&F9Ha{Fx'K=   !гz#G]fG䘋?/SǴ2y.gL 3*eܵ12F :<$E+;~V:g0c↧;evlZԆ0'1^?Ё]EyQ{AԓݙXa؁ x/mп=z3yKrmouOGa"f-CM.j= r<q ̚N~Y""9.;ؠ(&Z:/? .fau[kP ź3pg`N5͐t,3Nnض˙؄Pֱi ,t6IML-~}snfGe?Zt|%ľôIs$#ڏiҨ!Œyf@&ejݡ##r~Ǐ,3xNfM^9G*=1hj:u¶McΜhZ6.8̭X ֩&M?_„1Ё6`G>ܡ7`iO@]ТmW,grBl_F荗Mfm|t؁ړvl?df`Vc:RU9Hb-S:([~UV9su< aBn[q껙=;#]lؼ שod=@Z{^k_AGZYJJTcɵW/G;Y 7mu c}V1NMhNa:b>iDn?s{ݍŀ޽ўkEG0}fˤ.&Ez:7P>os5ɽzvCWkv> yO+QM"PFQҙ +Zҷjl>2(lQcѵmgfXMfبH AΝЁ;[pcM6hE;*&4ۃJ}1؏6ѣ>:wpR$MZ'ԃx>c̾e"c=t0zCcWn]ѺG{vw2;mݖ>Wݣ7 u Aաi.=`)Hd2(z^[Nrcٹzzc糝9| O-8+G{?XB+dɒB*[ x]F1|Х.u/['?r\>o͐s7\~,﮺I; o JDۥ5gĠ)D5`ːt2v-s̔z6Xu"~yR1kw2",mBca) xwָ {zux:QrNI~/ PYGy֒UmU$p&gRCuÊroT!W^nt$LESTQT;heQ fy9On7̍uyZi{e|^8Lk9z u+r =>*[u~k֮91)\ 6Fn5};2'7Ȱ9`J=R*H΍>ã Z"\mrI0nz2`2a&A샺~ Q ѓ\X#Uˤl"#;;;\ ܰWie#-2x73 B l^ EHIїlFPfiSb1fI2m1n̴U͗ךme l5,nM5;nhy!7=>nleQm=1]R̍+\l5aAd+Cϧ,CR8:pmjy/\j?xd/'"^K -6h̹?C7A2-AA[\t:+n?l+=us| OdQhVjgZtɍ_&1|їWMZXmEKOg|O3 ~H8ɋt_wt.ͱE2 |!SdSt'EnYeu+:XdD su!ٶ<>t =+g/Y`$6%c:]ƭ^CAԐsiyTf'Kٻ x dn%o&Qޚ}Wq>MtZ |fo3!rp7ʋ`L7'd{Yur5Jx:_6׼CY3ř>yXxTv˯ ty׽V⿟\kiKu0T3x~3XSF@L\M0k G,GW :n 4BAzHz/F*_2IgB[#i!D<&GHD+.%j-6='e`>7ߜnQ(%HJ_LNVKN 5XsvKڐ9*̐CssΙ XV˒<CP)x {f,sun)l#A7@u3zxC]=ܗDsZfsxJH˸Q ͓SrH2Fy 2pKgrdǕEkqd c:t ?_0 TP!G|l\2~U}\tfP^TC(2Y4%p9a BA:\nwr0tXw)2}ړ[#\7uRsnS8i Hqx`Ib+Ut-C`d>?В1/`2ZK׵/ ~48kп}YT19Vov踺Dm_-m|c&w1[_ԍx}x(:=]ͺjQCs~.5a@1".nAT<ˁW~2 *wGPC5s}}ra,m~w_r&mڭ_$ʥWUԽ4 @RO[cXAE .ӲE:u0&\z;[KԜ$;AD^we1_OlنʳK H5DzE7s9fk{+oo2fs ݰRݫȨX q|l+L\nɑN,0a*]ChMHγ\{$ Z3\|lTȞyǐ9}$#VO 6Je#AOquɑO%P*) ꌭ)ӱ1V+/5>C2a +/CXWZ,M$臄u ͗hӉ'C4ٺ4DU!Fn{:WNRD[3vIk,׬lYhHɁa@b L=Mc*C-]*@]zkJ`G`Kz\\C|bO x u]w2)&>rB5\>P-oF+ݭ0wWhIJVh?;߇+t\e#nաE,Ke!5D-E5k: o+WmK^ts)97E+[]eRuPjKG/Т[I@ErKQe)<)DW#79pH^].2Z :\ѿ T)jsɱ-ARK+8 ѶE[}TA&Wd4?p pN_â{..VvS%f+\^-?2Kr @L`9e&#\tQٻ:$ԨA*+YL. 4F+)2pR^L׳.r\ݢiBu]+c3`FZ&nXy eP{}Ao=e!;u /@WpټKH)̝7k)W  r_dlN/xC񴽏$ J%Q)@)@ ]6SXEm.Xrc㗜7[Ɉ[֭9[^NX,Q9D'&nM pIi Tdxu˼*azӭO|ƀ NM7JPyuW'6r#a gmiiC(h6bsJ'hcT}9ot9h.D5<&$.S&9/3+fIOʃM5@ r jYf_8ʥC,Sd)fWfKGuY:)a_y&z_f7kfeC̮MLܞof eZߓl)КqRNeZטAwt4=縺 z7=}@5\O4$jD2`Maur%jyu J`֧Z"FzU8 RU@FUST$c@˝b7.k>p~u\04d?$dM$ttfyWy|'dև>>B\ā=?K_5K&;駓?RLpjژ9u"$õ&^>Yk_L-sQ orF,/QY;Vx/Yp)u ߝЧGhlٲUSKPWXK_S`5E| ]S` h-&^} M/^nܟ@"촁LosU("ZΉvQ!`y5&%-k얨Fp+RN9qMڙZ ODy8Q\..:> +1&RGμxtykitgPB:q 8 h I(kr)ky+4UౌLF"8PC;A']z桍O$~Q#۶\|VQ)zˑ?+|@m3^|Lc d/ڲH5y%[t?~ɮ'pA*M=t@],)LK|76zK< ddMβp,YdZDpFm/.C3]\jS o;;1onϜ WtU+]xf2 >r.\ peS{~p(o[޼;Gد i9wB) pYvK2vg.6D,Ne6A(@({$b$)b E]oᒘ7PX>#_O; @Pr\n 8SNe-JJS LiK\Y.t k0 |\&ϢI'ʠ\@IU\6ȠR pRoes.ILP*)m1tWS"#h+3#]VIO899>O̷ּ]y2gͲ (|s.b\@ɛz_={([Ŀ)kh Ћ+Io(2i^9C/akzMu?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^`abcdefghijklmnopqrstuvwxyz{|}~a>ɬtTneN6'C/g:yv';9r&ƃrD9MBuG:? \Ne)] yu( t&5s ѯ3anv> >)̃E~ Ξ.J[,a'w^?lfպv5j~= y'1Kg6boozZ./fk<( JJ8@ο35c r> *u \K _Ϻ. FeM\7PY.u+0wpkzNW).1Xm>SrArToyJ3YMŒq4p.l *kXrFr]R<2%''x./0w\]3ʎJy[W|q}e<)m?5g(thO r mk,ؒZpJEW]Wa Qi J7J{AMϭ&ZWF[;oX_fNWoc1w`96}sR͊g+r*GTi9UXrxKN$س)R5RfmBpH+`Yd(cP{.Y!G7fȮSDNMM&,\7!qt h]q=ɢQ!hP0"/ 0=\u;%*}wqԋj" sr8ix]Ee@AALJR[:vzN9wpRHD P$%^)˩ KW=9Z 4Iovp9ƉN:e~te\NoYـg3{x-