Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm getting my hands on a system (one laptop, one hard drive) that were in custody of a LEO for a fairly significant period of time. The laptop runs windows XP professional, with a recovery partition, and the hard drive is a 2.5 inch 40 gb drive that has an NTFS file system

Entirely for academic reasons i'm thinking of forensically imaging the drives with a forensics fork of DD (i'm thinking if dcfldd) then working off a copy of that.

Considering i have some idea how long the system has been out of our hands, i'm also considering mounting the registry to check for devices that have been plugged into the system during that time (assuming they didn't do everything offline like good pandas) and checking for files that have been modified during that time (is there an easy way to do that?).

Am i missing anything? is there anywhere else i should look?

share|improve this question
Pardon my ignorance, what is a LEO? – LamonteCristo Sep 30 '11 at 19:09
law enforcement organisation – Faileas Grey Oct 1 '11 at 10:42
up vote 5 down vote accepted

You could begin taking some look at : , the Forensic Toolkit, to examine the NTFS filesystem.

In the same page there are tools for playing with the trash bin, IE, etc.

About registry: take a look at this site: and , you'll find some indication of interesting tools.

share|improve this answer
In the time that has intervened, the organisation in question basically didn't really take any action involving the hard drive, and we didn't find anything at all digging up the drive. The system in question died of old age and while we're keeping it . Amazingly, the organisation actually turned on the system themselves to check something, and probably didn't have trained forensic examiners. – Faileas Grey Mar 25 '13 at 11:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.