Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 1 of 44 PageID #: 1002
`
`
`
`Exhibit ZTE-CC-CMU
`
`
`
`O’Hallaron, David R., Ph.D.
`Lecture 3, 20-755: The Internet Summer 1999
`
`
`
`
`
`
`
`Exhibit ZTE-CC-CMU
`
`
`
`O’Hallaron, David R., Ph.D.
`Lecture 3, 20-755: The Internet Summer 1999
`
`
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 2 of 44 PageID #: 1003
`
`20-755: The Internet
`Lecture 3: Computer Systems II
`
`David O’Hallaron
`School of Computer Science and
`Department of Electrical and Computer Engineering
`Carnegie Mellon University
`
`Institute for eCommerce, Summer 1999
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`1
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 3 of 44 PageID #: 1004
`
`Today’s lecture
`• Input/Output (I/O) (50 min)
`• Break (10 min)
`• Copenhefer’s blunder (50 min)
`– Case studies in computer crime and forensics
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`2
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 4 of 44 PageID #: 1005
`
`The I/O subsystem
`(except the network)
`
`Keyboard
`
`Mouse
`
`Modem
`
`Printer
`
`Processor
`
`Interrupt
`controller
`
`Keyboard
`controller
`
`Serial port
`controller
`
`Parallel port
`controller
`
`Memory
`
`IDE disk
`controller
`
`disk
`
`Local/IO Bus
`
`SCSI
`controller
`
`SCSI bus
`
`disk
`
`cdrom
`
`Video
`adapter
`
`Network
`adapter
`
`Display
`
`Network
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`3
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 5 of 44 PageID #: 1006
`
`Bus
`• A bus is a shared medium
`that connects the processor,
`memory, and I/O devices
`• Consists of control and
`data/address wires
`– control: requests, acks, type of
`data (address or data)
`– data lines: data, addresses
`– address lines (optional): address
`• Only one device at a time
`
`control
`address/data
`
`OR
`
`control
`address
`data
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`4
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 6 of 44 PageID #: 1007
`
`Bus types
`• Processor-memory bus
`– short, fast, proprietary
`– fixed number of devices with known performance
`• I/O bus
`– longer, slower, open
`– unknown number of devices with different performance
`» disk: 5 MB/s
`» 4x CDROM: 640 KB/s
`– Examples: SCSI II, PCI, ISA, EISA
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`5
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 7 of 44 PageID #: 1008
`
`PCI bus layout
`
`processor
`
`bridge/memory
`controller
`
`PCI'local'bus
`
`cache
`
`DRAM
`
`sound'
`card
`
`LAN
`card
`
`SCSI
`card
`
`Bus
`interface
`
`graphics
`card
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`6
`
`ISA'bus
`
`ISA'card
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 8 of 44 PageID #: 1009
`
`Display
`
`column
`
`Display screen
`
`row
`
`diagon
`al
`
`pixel
`
`Each9pixel9is
`painted9with9a
`color.9
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`7
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 9 of 44 PageID #: 1010
`
`Display
`
`control9grid
`
`electron9beam
`
`vertical9
`deflection
`
`heating
`filament
`
`focusing9
`system
`
`phosphor
`coated
`screen
`
`horizontal
`deflection
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`8
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 10 of 44 PageID #:
` 1011
`
`Raster scan
`
`horizontal'retrace
`
`vertical'retrace
`
`vertical:'
`
`horizontal:
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`9
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 11 of 44 PageID #:
` 1012
`
`Frame buffer (grayscale)
`
`frame'buffer
`
`1
`
`1
`
`0
`
`0
`
`1
`
`1
`
`1
`
`1
`
`display
`
`Key ideas: The frame buffer is just an area
`of memory that can be read and written.
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`10
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 12 of 44 PageID #:
` 1013
`
`The RGB color space
`
`blue
`
`cyan
`
`magenta
`
`white
`1
`
`black
`
`0
`
`green
`
`red
`
`yellow
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`11
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 13 of 44 PageID #:
` 1014
`
`Frame buffer with color map
`
`frame'buffer
`
`1
`
`1
`
`0
`
`0
`
`1
`
`1
`
`1
`
`1
`
`color'map
`R''G''B
`
`111
`
`111
`
`000
`
`111
`
`000
`
`000
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`display
`
`yellow
`
`red
`
`12
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 14 of 44 PageID #:
` 1015
`
`Display performance
`
`• The quality of a display is measured by its
`resolution, which is the number of rows and
`columns of pixels.
`– e.g., 640x480 (640 rows, 480 columns)
`• Modern displays support multiple resolutions.
`• The size of a display is measured by the size
`in inches (like a TV).
`– e.g., 17”
`• Each pixel requires 1-4 bytes of display
`memory on the display controller.
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`13
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 15 of 44 PageID #:
` 1016
`
`Magnetic Disks
`
`Disk'surface'spins'at
`3600–7200'RPM
`
`The'surface'consists
`of'a'set'of'concentric
`magnetized'rings'called
`tracks
`
`Each'track'is'divided
`into'sectors
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`read/write'head
`arm
`
`The'read/write'
`head'floats'over'
`the'disk'surface'
`and'moves'back'
`and'forth'on'an'
`arm'from'track'to'
`track.
`
`14
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 16 of 44 PageID #:
` 1017
`
`Disk Capacity
`
`• Parameter 18 GB Example
`– Number Platters : 12
`– Surfaces / Platter: 2
`– Number of tracks: 6962
`– Number sectors / track: 213
`– Bytes / sector: 512
`• Total Bytes
`
`18,221,948,928
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`15
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 17 of 44 PageID #:
` 1018
`
`Disk Operation
`
`• Operation
`– Read or write complete sector
`• Seek
`– Position head over proper track
`– Typically 6-9 ms
`• Rotational Latency
`– Wait until desired sector passes under head
`– Worst case: complete rotation
`10,025 RPM ⇒ 6 ms
`• Read or Write Bits
`– Transfer rate depends on # bits per track and rotational speed
`– E.g., 213 * 512 bytes @10,025RPM = 18 MB/sec.
`– Modern disks have external transfer rates of up to 80 MB/sec
`» DRAM caches on disk help sustain these higher rates
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`16
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 18 of 44 PageID #:
` 1019
`
`(1) Initiate Sector Read
`
`Processor
`Reg
`
`(3) Read
`Done
`
`Memory-I/O bus
`
`Disk / System Interface
`• 1. Processor Signals
`Controller
`– Read sector X and store
`starting at memory address Y
`• 2. Read Occurs
`– “Direct Memory Access”
`(DMA) transfer
`– Under control of disk
`controller
`• 3. Disk Controller
`Signals Completion
`– Interrupts processor
`– Can resume suspended
`process
`
`(2) DMA Transfer
`
`Memory
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`disk
`controller
`
`Disk
`
`Disk
`
`17
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 19 of 44 PageID #:
` 1020
`
`Disk performance
`• Disk size is given by the diameter of the surface
`– e.g., 3 1/2 “ or 5 1/4”
`• Disk capacity is given by number of bytes
`– e.g., 500 MB, 1GB
`• Disk speed is given by seek time and throughput
`– seek time: average time for the read/write head to move from
`one track to another track in milliseconds (1/1000 seconds).
`» e.g., typical seek time is 10 milliseconds.
`– throughput: once the read/write head is positioned correctly,
`throughput is the number of MBytes that can be transferred
`each second.
`» e.g., typical throughput is 1 MByte/second.
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`18
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 20 of 44 PageID #:
` 1021
`
`Storage Trends
`
`SRAM
`
`metric
`$/MB
`access (ns)
`
`1985
`1980
`19,200 2,900
`300
`150
`
`DRAM
`
`1980
`metric
`8,000
`$/MB
`375
`access (ns)
`typical size(MB) 0.064
`
`1985
`880
`200
`0.256
`
`1990
`320
`35
`
`1990
`100
`100
`4
`
`1995
`256
`15
`
`1995
`30
`70
`16
`
`1999
`100
`3
`
`1999
`1.5
`60
`64
`
`1999:1980
`190
`100
`
`1999:1980
`5,300
`6
`1,000
`
`Disk
`
`1999:1980
`1999
`1995
`1990
`1985
`1980
`metric
`10,000
`0.05
`0.30
`8
`100
`500
`$/MB
`11
`8
`10
`28
`75
`87
`access (ms)
`9,000
`typical size(MB) 1
`10
`160
`1,000
`9,000
`(Culled from back issues of Byte and PC Magazine)
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`19
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 21 of 44 PageID #:
` 1022
`
`Storage Price: $/MB
`
`1.E+05
`
`1.E+04
`
`1.E+03
`
`1.E+02
`
`1.E+01
`
`1.E+00
`
`1.E$01
`
`1.E$02
`
`1980
`
`1985
`
`1990
`
`1995
`
`1999
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`SRAM
`DRAM
`Disk
`
`20
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 22 of 44 PageID #:
` 1023
`
`Storage Access Times (nsec)
`
`1.E+08
`
`1.E+07
`
`1.E+06
`
`1.E+05
`
`1.E+04
`
`1.E+03
`
`1.E+02
`
`1.E+01
`
`1.E+00
`
`1980
`
`1985
`
`1990
`
`1995
`
`1999
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`SRAM
`DRAM
`Disk
`
`21
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 23 of 44 PageID #:
` 1024
`
`Processor clock rates
`
`metric
`
`1980
`
`Processors
`1985
`1990
`
`1995
`
`1999
`
`typical clock(MHz) 1
`processor
`8080
`
`6
`286
`
`20
`386
`
`400
`150
`Pentium P-II
`
`1999:1980
`400
`
`culled from back issues of Byte and PC Magazine
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`22
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 24 of 44 PageID #:
` 1025
`
`The CPU vs. DRAM Latency Gap (ns)
`
`1.E+03
`
`1.E+02
`
`1.E+01
`
`1.E+00
`
`SRAM
`DRAM
`CPU9cycle
`
`1980
`
`1985
`
`1990
`
`1995
`
`1999
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`23
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 25 of 44 PageID #:
` 1026
`
`I/O Summary
`• Key concept:
`– data travels between the processor, memory, and other
`I/O devices over a shared medium called a bus (not too
`unlike an ethernet)
`• For both DRAMs and magnetic disks, cost per
`MB is decreasing much faster than access
`times.
`– falling way behind processor speeds.
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`24
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 26 of 44 PageID #:
` 1027
`
`Break time! (10 min)
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`25
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 27 of 44 PageID #:
` 1028
`
`Today’s lecture
`• Input/Output (I/O) (50 min)
`• Break (10 min)
`• Copenhefer’s blunder (50 min)
`– Case studies in computer crime and forensics
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`26
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 28 of 44 PageID #:
` 1029
`
`Copenhefer’s Blunder:
`Case studies in computer crime
`and computer forensics
`• Copenhefer capital murder case
`• Steele mail fraud case
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`27
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 29 of 44 PageID #:
` 1030
`
`Copenhefer capital murder case
`• June 17, 1988 (Erie, PA)
`– Sally Weiner, wife of bank executive Harry Weiner, is
`kidnapped, held for ransom, and then murdered before
`the money can be delivered.
`• June 27, 1988 (Erie, PA)
`– State trooper notices computer-generated sign in the
`window of a bookstore owned by David Copenhefer that
`looks similar to the ransom note. Becomes the basis for a
`search warrant.
`– Police obtain warrant, and the FBI finds deleted versions
`of the ransom note and the murder plan on the disk
`drives in the PC’s in the bookstore and Copenhefer’s
`house.
`• May, 1989 (Pittsburgh, PA)
`– Copenhefer sentenced to die.
`– Still in the appeals process (1997).
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`28
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 30 of 44 PageID #:
` 1031
`
`How did he get caught?
`• He didn’t understand the PC’s DOS
`filesystem.
`– The data in a deleted file is still on the disk!
`• The FBI knew this and searched the tracks of
`the disk for the character string “exactely”, a
`misspelling that appears several times in the
`ransom note.
`• In 1994, I examined both of Copenhefer’s
`computers as an expert witness to the
`Commonwealth of PA , “undeleted” the
`ransom note, and printed it out.
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`29
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 31 of 44 PageID #:
` 1032
`
`DOS File System
`• The disk is treated as a linear sequence of n
`“logical sectors”, each 512 bytes in length:
`– sector 0, sector 1, sector 2, ...., sector n-2, sector n-1
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`30
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 32 of 44 PageID #:
` 1033
`
`DOS Disk Map
`
`Logical9sector90:
`
`Reserved9area
`
`File9Allocation9Table9(FAT)
`
`Files9area
`(files9and9directories)
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`31
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 33 of 44 PageID #:
` 1034
`
`Directory entries
`• The eight parts of a directory entry
`– filename (8 bytes) e.g., report.doc
`– filename extension (3 bytes) e.g., report.doc
`– attribute (1 byte) e.g., file or directory, read only or
`read/write
`– unused (10 bytes)
`– time (2 bytes)
`– date (2 bytes)
`– starting sector number (2 bytes)
`– file size (4 bytes)
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`32
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 34 of 44 PageID #:
` 1035
`
`File Allocation Table (FAT)
`• The FAT is a sequence of 16 bit entries. The
`ith FAT entry corresponds to the ith logical
`disk sector.
`• The values of the entries form a chain that
`shows which logical sectors contain the
`data in a file or directory entry. “9999” ends
`the chain.
`
`Directory'entry
`
`report
`
`doc
`
`size
`2K
`
`starting9sector
`0003
`
`FAT
`
`4
`3
`
`5
`4
`
`6 9999
`5
`6
`
`2
`
`7
`
`8
`
`9
`
`10
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`33
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 35 of 44 PageID #:
` 1036
`
`Deleting a file
`• When a file is deleted, the first word in the directory
`is changed to a special character (we’ll call it ‘α’) and
`the fat chain is cleared. However, data is intact.
`
`Directory9entry
`
`αeport
`
`doc
`
`size
`
`2K
`
`starting9sector
`0003
`
`FAT
`
`0
`3
`
`0
`4
`
`0
`5
`
`0
`6
`
`2
`
`7
`
`8
`
`9
`
`10
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`34
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 36 of 44 PageID #:
` 1037
`
`Recovering a deleted file
`
`• Look for occurances of ‘α’ to find
`deleted directories. Use starting sector
`and size fields in directory and assume
`contiguous sector allocation to recover
`the file data.
`
`Directory'entry
`
`αeport
`
`doc
`
`size
`2K
`
`Starting'sector
`0003
`
`FAT
`
`0
`3
`
`0
`4
`
`0
`5
`
`0
`6
`
`2
`
`7
`
`8
`
`9
`
`10
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`35
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 37 of 44 PageID #:
` 1038
`
`Steele mail fraud case
`• March 6, 1993 (Pittsburgh, PA)
`– Phil McCalister, disgruntled associate at Pgh law firm
`Steele & Hoffman, after watching the movie "The Firm",
`copies school board billing records from firm's laptops
`onto some diskettes, then resigns.
`• July 29, 1993
`– McCalister hands over 4 diskettes to postal instpectors
`as evidence of systematic overbilling of school systems
`by Charlie Steele, managing partner of Steele & Hoffman.
`• September, 1996
`– I'm asked by defense to determine if the 4 diskettes are
`the originals from March 6, 1993 (they weren't).
`• December, 1996
`– Despite brilliant testimony by the computer expert
`witness, Charlie Steele convicted of mail fraud and
`sentenced to 3 years in federal pen and $80,000 fine.
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`36
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 38 of 44 PageID #:
` 1039
`
`Internal fragmentation in DOS files
`
`Files'allocated'in'fixed'size'logical'sectors
`
`abc
`
`cluster
`
`data
`
`slack'(internal'fragmentation)
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`37
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 39 of 44 PageID #:
` 1040
`
`How slack takes a picture of a
`disk when a file is copied (1)
`
`1.''read'source'directory'("DE"'is'directory'entry)
`
`DE1
`
`DE2
`
`DE3
`
`DE4
`
`disk'buffer
`
`abc
`
`source'disk
`
`destination'disk
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`38
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 40 of 44 PageID #:
` 1041
`
`How slack takes a picture of a
`disk when a file is copied (2)
`
`2.'read'file'into'disk'buffer'(notice'that'old'slack'is'not'copied'into'
`disk'buffer!)
`
`
`
`DE1abc
`
`DE2
`
`DE3
`
`DE4
`
`disk'buffer
`
`abc
`
`source'disk
`
`destination'disk
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`39
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 41 of 44 PageID #:
` 1042
`
`How slack takes a picture of a
`disk when a file is copied (3)
`
`3.'write'file'to'destination'disk.'Notice'that'slack'now'contains'a'
`snapshot'of'the'files'on'the'source'disk'when'the'file'was'copied.
`
`
`
`DE1abc
`
`DE2
`
`DE3
`
`DE4
`
`disk'buffer
`
`abc
`
`
`
`DE1abc
`
`DE2
`
`DE3
`
`DE4
`
`source'disk
`
`destination'disk
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`40
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 42 of 44 PageID #:
` 1043
`
`Federal diskette F1 is not an original
`
`Cluster 1,789, Sector 1,820 [F1:1991-$.IN C1638-1789]
`Name .Ext Size Date Time Cluster Arc R/O Sys Hid Dir Vol
`-----------------------------------------------------------------------------
`... YS 33430 11-11-91 5:00 am 2 R/O Sys Hid
`MSDOS SYS 37394 11-11-91 5:00 am 5419 R/O Sys Hid
`CONFIG SYS 57 10-26-92 8:47 am 8998 Arc
`AUTOEXEC BAT 24 10-26-92 8:47 am 8997 Arc
`DOS 0 3-22-93 4:40 pm 19 Dir
`WININST 0 3-22-93 4:41 pm 597 Dir
`WINDOWS 0 3-22-93 4:43 pm 3042 Dir
`COMMAND COM 47845 11-11-91 5:00 am 5429 Arc
`SCAN 0 3-22-93 4:50 pm 5570 Dir
`WINA20 386 9349 11-11-91 5:00 am 14
`HARCHLRD REG 1492 6-14-93 12:50 pm 5859 Arc
`ASP 0 3-23-93 11:59 am 6242 Dir
`DO 0 3-23-93 12:01 pm 6295 Dir
`GOLF 0 3-23-93 12:01 pm 6361 Dir
`LOTUS 0 5-07-93 4:32 pm 5341 Dir
`NORTON 0 3-23-93 12:04 pm 6977 Dir
`
`Source:9Norton9Utilities9Diskedit9program
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`41
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 43 of 44 PageID #:
` 1044
`
`Federal diskette F2 is not an original
`
`Cluster 501, Sector 532 [F2:CRIMALDI C498-501]
`Name .Ext Size Date Time Cluster Arc R/O Sys Hid Dir Vol
`-----------------------------------------------------------------------------
`...
`WP51 0 3-23-93 12:05 pm 7242 Dir
`XTALK 0 3-23-93 12:13 pm 8910 Dir
`KATHY REL 2239 6-14-93 1:20 pm 5869 Arc
`FRECOVER DAT 101376 3-24-93 11:29 am 8951 Arc R/O
`GO BAT 198 10-26-92 8:47 am 8966 Arc
`MENU BAT 947 10-26-92 8:47 am 8967 Arc
`SD INI 2497 10-26-92 8:47 am 8968 Arc
`XMENU EXE 5521 10-26-92 8:47 am 8969 Arc
`XMENU PIF 296 10-26-92 8:47 am 8971 Arc
`FRECOVER IDX 29 3-24-93 11:29 am 41442 Arc R/O Sys Hid
`?UMMINGS 4763 5-20-93 2:45 pm 6617 Arc
`?UMMINGS BK! 4664 5-19-93 8:18 pm 5895 Arc
`
`Source:9Norton9Utilities9Diskedit9program
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`42
`
`
`
`Case 2:15-cv-00225-JRG-RSP Document 60-4 Filed 09/28/15 Page 44 of 44 PageID #:
` 1045
`
`Summary
`• Computer programs leave traces of
`themselves.
`• These traces can be recovered using simple
`understanding of systems basics.
`
`Lecture'3,'20,755:'The'Internet,'Summer'1999
`
`43
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
