Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm getting my hands on a system (one laptop, one hard drive) that were in custody of a LEO for a fairly significant period of time. The laptop runs windows XP professional, with a recovery partition, and the hard drive is a 2.5 inch 40 gb drive that has an NTFS file system

Entirely for academic reasons i'm thinking of forensically imaging the drives with a forensics fork of DD (i'm thinking if dcfldd) then working off a copy of that.

Considering i have some idea how long the system has been out of our hands, i'm also considering mounting the registry to check for devices that have been plugged into the system during that time (assuming they didn't do everything offline like good pandas) and checking for files that have been modified during that time (is there an easy way to do that?).

Am i missing anything? is there anywhere else i should look?

share|improve this question
    
Pardon my ignorance, what is a LEO? –  makerofthings7 Sep 30 '11 at 19:09
    
law enforcement organisation –  Faileas Grey Oct 1 '11 at 10:42
add comment

1 Answer

up vote 5 down vote accepted

You could begin taking some look at :http://www.mcafee.com/us/downloads/free-tools/index.aspx , the Forensic Toolkit, to examine the NTFS filesystem.

In the same page there are tools for playing with the trash bin, IE, etc.

About registry: take a look at this site: http://www.eptuners.com/forensics/Index.htm and http://www.blackhat.com/presentations/bh-asia-02/bh-asia-02-leibrock.pdf , you'll find some indication of interesting tools.

share|improve this answer
1  
In the time that has intervened, the organisation in question basically didn't really take any action involving the hard drive, and we didn't find anything at all digging up the drive. The system in question died of old age and while we're keeping it . Amazingly, the organisation actually turned on the system themselves to check something, and probably didn't have trained forensic examiners. –  Faileas Grey Mar 25 '13 at 11:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.