Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have the following security issue. A zipped archive of emails was found on a machine (A) by using an undelete program. The claim made by the subject of the investigation is that they made the archive on another machine (B) to transfer files TO A from B. Management suspects that the archive was made on A with a view to taking a copy off site.

Is there any way to prove that the archive was or was not created on A? This is XP Professional.

share|improve this question
4  
Perhaps it's an idea to look at the file modification times on machine A, B, and the ones in the zip file. –  Luc Feb 1 '13 at 1:28
add comment

3 Answers

If the ZIP was claimed to be created on system B, the system is accessible and it didn't happen too long ago, create a forensic image of said system B. If it doesn't contain traces of the ZIP file (and the original files), it probably wasn't created there. If it is there, check timestamps, logs etc. to try to find out where the file was first.

Ask them exactly when, where and how they created the file, then disprove as many parts of the story as possible. File was created last year? Then why does it contain timestamps from this year? File was created with WinRAR on machine B? Then why is there no trace of WinRAR on said machine, and why is the file structured like format X, which matches what 7zip creates, and not at all like WinRAR?

share|improve this answer
add comment

NTFS can mark files with "zone information" in a hidden stream associated with the file. If the file was created in a different zone (as defined in IE zones) then it's possible that the IE + windows explorer integration present in windows may be of interest to you.

I'm not sure if 1) that zone information contains information about the source machine, or 2) if that zone information was recovered from your undelete utility

I haven't personally explored this detail of zone information beyond this but would appreciate it if you share your learnings.

share|improve this answer
add comment

Looking at the ZIP file only, almost certainly not. ZIP files don't include any interesting information like the computer it was created on or the program used to create the ZIP file.

Now if the ZIP file was created using a feature available on the ZIP program on computer A that doesn't exist on computer B, then you might have some evidence. For example, if the ZIP file uses AES256 encryption but Computer B only has Windows and no third-party ZIP program, then it's likely the ZIP was not created on Computer B. (But don't forget that the ZIP program could live anywhere on the network but be run on Computer B.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.