can I find on which machine was a zipped archive created?

Question

I have the following security issue. A zipped archive of emails was found on a machine (A) by using an undelete program. The claim made by the subject of the investigation is that they made the archive on another machine (B) to transfer files TO A from B. Management suspects that the archive was made on A with a view to taking a copy off site.

Is there any way to prove that the archive was or was not created on A? This is XP Professional.

Answer 1

If the ZIP was claimed to be created on system B, the system is accessible and it didn't happen too long ago, create a forensic image of said system B. If it doesn't contain traces of the ZIP file (and the original files), it probably wasn't created there. If it is there, check timestamps, logs etc. to try to find out where the file was first.

Ask them exactly when, where and how they created the file, then disprove as many parts of the story as possible. File was created last year? Then why does it contain timestamps from this year? File was created with WinRAR on machine B? Then why is there no trace of WinRAR on said machine, and why is the file structured like format X, which matches what 7zip creates, and not at all like WinRAR?

Answer 2

NTFS can mark files with "zone information" in a hidden stream associated with the file. If the file was created in a different zone (as defined in IE zones) then it's possible that the IE + windows explorer integration present in windows may be of interest to you.

I'm not sure if 1) that zone information contains information about the source machine, or 2) if that zone information was recovered from your undelete utility

I haven't personally explored this detail of zone information beyond this but would appreciate it if you share your learnings.

Answer 3

ZIP file itself doesn't hold any information in relation to where it was created, as @longneck already pointed out before me. That doesn't mean you're out of luck, though. The file in question would still contain created, modified and accessed time-stamps, even if it doesn't tell you where it was created. The last modified time-stamp is the most relevant here and tells you when it was created on machine B, or copied to media used to transfer the file. If created and modified date-stamps match, chances are your subject is telling the truth, though. Either case, you could use this information in a cross-examination of the subject you're investigating. Would the time of when the subject claims he/she made a copy at least approximately match the last modified date-stamp? Another thing is this file was either transferred (subject is telling the truth), or it wasn't transferred (subject is lying). There is no middle-ground here, it's either-or situation. The transfer itself might have left some footprints on your network or the media used to transfer the file. You didn't mention however how this file was allegedly transferred. Was it a network transfer, a copy through an external drive, some other form of transfer? Would the subject be able to transfer the file in question by using techniques he/she is claiming to have used? Would there be any log file involved (network logs, CD/DVD recording software logs or saved user sessions, does undelete/unformat of the external drive reveal existence of any temporary copies used to transfer to a new location,... and so on). Is it probable that the subject would choose such mode of transfer, given of course there's more than one available? Even questions such as, if the subject remembers what the desktop background on the machine B looks like can give you hints weather he/she is lying or possibly telling the truth. Our truth is however, that without disclosing a bit more information, possibilities to investigate your subject are indeed limitless, including the cliche investigative techniques, such as subject's response to an intentional fabrication of the truth. But these 'good cop - bad cop' techniques are, I guess, beyond the point here. Could you at least disclose if the subject is of the fairer sex, and if so, did she cross her legs and swing in the chair? :)

Answer 4

Looking at the ZIP file only, almost certainly not. ZIP files don't include any interesting information like the computer it was created on or the program used to create the ZIP file.

Now if the ZIP file was created using a feature available on the ZIP program on computer A that doesn't exist on computer B, then you might have some evidence. For example, if the ZIP file uses AES256 encryption but Computer B only has Windows and no third-party ZIP program, then it's likely the ZIP was not created on Computer B. (But don't forget that the ZIP program could live anywhere on the network but be run on Computer B.)