CONTACTS 
0201 - Robin Hood Software LTD
020101 - Mr. A.S. Churchill
020102 - yourname@organization.xxx

SUBJECTS
Disk Maintenance, e.g. Speed Disk
Purchased, Order: 195885
Removing Unneeded Files/Programs
Clean Disk of Unnecessary Files and Temporary Folders Created by W2K
Acquisition EE Clean-up Program
Evidence Eliminator
CPU #13

1009 -    ..
1010 - Summary/Objective
1011 -
101101 - Follow up ref SDS 1 0001.
101102 -
101103 - Ordered a program from.....
101104 -
101105 -                      Evidence Eliminator.com
101106 -
101107 -
101108 -        http://www.evidence-eliminator.com/main.shtml?A1878
101109 -
101110 -
101111 -        Robin Hood Software Ltd.
101112 -
101113 -        Registered in England & Wales #3998601
101114 -
101115 -        Directors: Mr A.S. Churchill, Mr R.H. Ride
101116 -        ..
101117 -        Bankers: Barclays Nottingham #20-55-68 80965006
101118 -
101119 -        Registerd Office:
101120 -
101121 -           181 Queen Victoria St,
101122 -           London, EC4V 4DZ UK
101123 -
101124 -        Robin Hood Software Ltd. is a privately-held UK Limited company
101125 -        specializing in providing complete, one-click anti-forensic
101126 -        software solutions for end-user Microsoft Windows
101127 -        installations. We are based in Nottingham, England,
101128 -
101129 -      ..
101130 -     Product:  Evidence Eliminator
101131 -
101132 -     License Type:  Single-User License delivered to your E-Mail
101133 -     address
101134 -     ..
101135 -     Special Discount Price:  [Promotion Code A1878]
101136 -
101137 -     Total Price in US Dollars:  $ 67.45
101138 -
101139 -
101142 -
101143 -     Conversion in GBP:  œ 45.90
101144 -
101145 -     Payment Method:  Online [Instant Delivery, Credit Card
101146 -
101147 -
101148 -  ..
101149 - Received confirmation......
101150 -
101151 -     Thank you for ordering Evidence Eliminator.
101152 -
101153 -     Here is the result of your order:
101154 -
101155 -     Order Accepted OK.
101156 -
101157 -     Please write down this number now!
101158 -
101159 -     Your SWREG Order Number is: 195885
101160 -
101161 -     You must quote this number in any correspondence.
101162 -     ..
101163 -     Please print this page as a record of your order.
101164 -
101165 -     Order Date/Time GMT: Tue Mar 6 04:36:53 2001
101166 -
101167 -     The Vendors currency is: USA Dollar $
101168 -     ..
101169 -     Price in that currency is: USA Dollar $ 67.45
101170 -
101171 -     The amount shown above has been billed to your card in US Dollar.
101172 -
101173 -     Please note your card statement will show WWW.SOFT-SHOP.COM
101174 -
101175 -     An e-mail has been sent to you. Please check your e-mail in a few
101176 -     minutes for your License Documentation. (On large ISPs like AOL
101177 -     you may have to wait a few hours for your ISP to deliver your
101178 -     e-mail.)
101179 -
101180 -     Please Note: Your E-Mail will contain download instructions - or
101181 -     press the Downloads button at the top of our main Website.
101182 -     ..
101183 -     Thank you for choosing Evidence Eliminator!
101184 -
101185 -     Warning: Please DO NOT use the back button in your browser
101186 -     as this could cause you to be billed twice.
101187 -
101188 -
101189 -  ..
1012 -
1013 -
1014 - 2244
1015 -
101501 - Received ref DRT 1 0001 from Robin Hood Software, based in London
101502 - England.  Order seems to have been processed by a firm in Hong Kong.
101503 - ref DRT 1 467I
101504 -
101505 - Confirms purchase of disk clean software EE.exe for $67.45, ref DRT 1
101506 - YM8J
101507 -
101508 - This letter has a lot of information that is repeated several times,
101509 - which is confusing because there are no evident differences in the
101510 - repeated information to differentiate or expand on prior meaning.
101511 - ..
101512 - It includes a serial number, key code....
101513 -
101514 -  ..
101515 - Order Number:  195885
101516 -
101517 -     [On 010406 paid BOA. ref SDS 3 6K5F
101518 -
101526 -
101527 - We have to enter the keycode for something.
101528 - ..
101529 - Can get help using keycode system....
101530 -
101531 -
101532 -           http://www.evidence-eliminator.com/support.shtml
101533 -
101534 -  ..
101535 -
101536 - ....as shown in the letter today. ref DRT 1 456F
101537 -
101538 - The letter says it has an address for downloading the program.....
101539 - ref DRT 1 IF3G
101540 -
101541 -     However, this space is blank.
101542 -
101543 -     Further in the letter it says....
101544 -
101545 -        Where to download the software:, ref DRT 1 FO4N
101546 -
101547 -        If you have not already downloaded Evidence Eliminator,
101548 -        please visit this URL now, and in the future, for the
101549 -        latest versions:
101550 -
101551 -        http://www.evidence-eliminator.com/downloads.shtml
101552 -
101553 - ..
101554 - An alternate download address is...
101555 -
101556 -
101557 -            http://hotfiles.zdnet.com/cgi-bin/texis/swlib/hotfiles/info.html?fcode=0012R3
101558 -
101559 -  ..
101560 -
101561 - ....where the software can be downloaded. ref DRT 1 QG3N
101562 -
101563 - Need to look for a "download button."
101564 -
101565 -  ..
101566 -
101567 - The letter says this is a 30 day trial package of Evidence Eliminator
101568 - which you can activate to full registered version using your Keycodes.
101569 - ref DRT 1 JH4M
101570 -
101571 -      [On 010306 notified vendor requesting clarification. ref SDS 2
101572 -      M87K
101573 -
101574 - We got version  EE v5.053.
101575 -
101576 - Installed ee in.....
101577 -
101578 -
101579 -                     h: 00 22
101580 -
101581 - ..
101582 - Put downloaded file in.....
101583 -
101584 -
101585 -                     h: 00 22 install
101586 -
101587 -
101588 -  ..
101589 - Ran the EE program.....
101590 -
101591 -     It asks for User name and password, which are shown above,
101592 -     immediatley below the order number. ref SDS 0 DQ5K
101593 -
101594 -     Vendor failed to disclose that the User name is the first string,
101595 -     and the password is the second string, also, called a serial
101596 -     number or key code.
101597 -
101598 - Eventually, through trial and error got the User name and password
101599 - entered.
101600 -
101601 - Program reported it is successfully registered.
101602 - ..
101603 - It appeared to operate without error, and reported recovering
101604 - considerable disk space.
101605 -
101606 - Have to specify areas to process.
101607 -
101608 - Initially selected all drives, but d clearly does not require
101609 - processing, and it takes a long time.
101610 -
101611 - Changed Netscape directory to h: 00 07.
101612 -
101613 -  ..
101614 - The EE program puts a picture on the task bar, and it runs when the
101615 - computer is powered up.  This is a mistake, since we want it to run
101616 - only when called.
101617 -
101618 -      Looked for an option in the program to avoid this, and examined
101619 -      the Start Start Up menu.
101620 -
101621 -      There does not seem be a direct way to do this.
101622 -
101623 -         [On 010306 notified EE technical support for solution.
101624 -         ref SDS 2 0001
101625 -
101626 -
1017 -

SUBJECTS
Directories and Files to Clean-up Specify Custom List

1304 -
130401 -  ..
130402 - Configuration EE for Disk Clean up
130403 -
130404 - Configured following drives for maintenance.....
130405 -
130406 -                 c, g, h, i
130407 -
130408 -
130409 -
130410 - When EE runs, it creates a log of activity.
130411 -
130412 - There is an option shown at the bottom of the screen bar for saving
130413 - the log.  Clicking this option, puts an icon on the desktop which can
130414 - be opened with notepad.exe.
130415 - ..
130416 - Moved this this to....
130417 -
130418 -                       h: 00 22 logs eelog.txt
130419 -
130420 - This file can be examined with the editor to develop a custom list of
130421 - files to examine by ee.exe during run time, using the Custom option
130422 - in ee.exe configuration.
130423 -
130424 - The log shows it looked for following on c: drive....
130425 -
130426 -
130427 -           I:\Program Files\Opera\cookies.dat
130428 -           C:\Program Files\Opera\vlink.dat
130429 -           C:\Program Files\Opera\opera.dir
130430 -           C:\Program Files\Opera\Opera.win
130431 -           C:\Program Files\Opera\global.dat
130432 -           C:\Program Files\Opera\CACHE
130433 -           C:\Program Files\Opera\cookies4.dat
130434 -           C:\Program Files\Opera\vlink4.dat
130435 -           C:\Program Files\Opera\opera.dir
130436 -           C:\Program Files\Opera\Opera.win
130437 -           C:\Program Files\Opera\global.dat
130438 -           C:\Program Files\Opera\CACHE4
130439 -           C:\Program Files\SureThing\STCD\STCD.app
130440 -           C:\Program Files\Yahoo!\Player\yplayer.ypl
130441 -           C:\windows\internet logs\
130442 - ..
130443 - Since w2k program files are on i: added the above list to Custom
130444 - for i: drive.
130445 -
130446 -
130447 -
130448 -
130449 -
130450 -
130451 -
130452 -
130453 -
130454 -
130455 -
1305 -

SUBJECTS
Regclean, 010305
Regclean Fixes Errors and Removes Unnecessary Entries in W2K Registry
Regclean, 010305
Regclean Fixes Errors in Registry

180601 -  ..
180602 - Regclean
180603 -
180604 - Information from Robin Hood Software about system maintenance shown
180605 - in the prior record segment, included notice of a program from
180606 - Microsoft.....
180607 -
180608 -
180609 -                            regclean.exe
180610 -
180611 -
180612 - ....which can be downloaded.
180613 -
180614 - This was done and the program was placed in.....
180615 -
180616 -
180617 -                           h: 00 24
180618 -
180619 - ..
180620 - Put it in the menu for disk maintenance along with defragment
180621 - and EE, per above.
180622 -
180623 - After installing, ran the program and it reported a lot of problems
180624 - to fix, which are in a log.....
180625 -
180626 -
180627 -                   undo c13 20010308 220305.reg
180628 -
180629 -
180630 - ....which is approximately 35K, and 200 items that seemed to have
180631 - been corrected.
180632 -
180633 -
180634 -
180635 -
180636 -
180637 -
180638 -
180639 -
1807 -