I'm getting my hands on a system (one laptop, one hard drive) that were in custody of a LEO for a fairly significant period of time. The laptop runs windows XP professional, with a recovery partition, and the hard drive is a 2.5 inch 40 gb drive that has an NTFS file system
Entirely for academic reasons i'm thinking of forensically imaging the drives with a forensics fork of DD (i'm thinking if dcfldd) then working off a copy of that.
Considering i have some idea how long the system has been out of our hands, i'm also considering mounting the registry to check for devices that have been plugged into the system during that time (assuming they didn't do everything offline like good pandas) and checking for files that have been modified during that time (is there an easy way to do that?).
Am i missing anything? is there anywhere else i should look?