Having no experience in computer forensics, I'd like to know whether it's possible for someone to track if a laptop's HDD/partition has recently been formatted OR had a ghost image deployed.
Any ideas/tools/methods would be appreciated.
1
-
Maybe we could help you more if we understood what you are tyring to achieve. In my rough guess you are trying to determing if somebody attempted to conceal or remove data by reformatting or re-imaging. If the subject in question had complete control of the drive, this may be difficult to do. If they were trying to removed evidence of a particular action, it may be easier to get the evidence from a source other than the hard drive.– this.joshJul 7, 2011 at 18:34
Add a comment
|
4 Answers
There is a massive number of data recovery software including:
- Recuva
- Power Data Recovery Free edition
- TestDisk - CLI Only so a bit of a learning curve
- Undelete
I have used Recuva for many of recovery tasks. It's lightweight, powerful and best of all free! It is only short sight is that it may not recover full files. If it is really important information you could always seek out professional help which, while being incredibly expensive, is often the most effective way to recover data.
Hope this helps.
-
2Thanks for the answer, but you are referring to undelete/file recovery programs. I'm interested in finding tracks of hdd/partition manipulation, e.g.formatted partition and/or reinstall image from backup. Jun 30, 2011 at 2:13
You don't need any tools to see if a disk have recently been formatted. Most filesystems have creation date, modification date and access date for their files. Do a quick search for all files, and order by modification date, and you will have a good guess when the disk was last formatted.
When you say "ghost image deployed", I assume you mean they have installed a ghost image on a disk. If you check the system logs for login entries, you will be able to roughly guess when a ghost image have been deployed. If there is a ghost image, you can expect that there will be a gap in the log entries where no activity have occured, to when the user of the system regularly logs in. This is a good indication that either the system has been unused for a period of time, or if there has been deployed a ghost image.
answered Jun 30, 2011 at 10:41
-
I guess that if an image was re-installed on a disk, file timestamps would show the old (original) values. But then again, if the system would work for a few days, sorting by date would probably show a large gap between old files (from the image file) and newly created (after the deployment). So that could be of some help indeed. Thanks ;-) Jun 30, 2011 at 13:01
-
Another idea is to look for hardware changes in the log. I'm not sure how the images are created, but I suspect you will have some findings where suddenly all hardware identifiers changes. Jun 30, 2011 at 13:08
-
bear in mind that if someone is so inclined they can alter the mac dates on files, including the creation date.– SirexJul 1, 2011 at 6:58
-
1Since this is a forensics question, and the system may be compromised, you can't trust anything the system is telling you about itself. Nor can you trust file modification dates, etc. You'd have to examine the disk from a different, trusted system, and compare it to backups or known-good data.– nealmcbJul 1, 2011 at 17:12
my understanding is this:
'recently' formatted, no (perhaps unless the drive is in usage since then). formatted at some point in time, yes. Typically a 'quick' format will wipe the index tables of the drive partitions but leave the files intact, so you know there has been a format. A full partition format (in theory) will result in the drive being returned to a blank state but the partition tables will still be intact so you'd know the drive either hasn't been used since then or that a format has happened. You may also find data on areas left un-partitioned from previous usage. you may also be able to go on surrounding evidence, e.g: if this drive is known to have had a recovery partition on it when issued and is now partionless and blanked, of if the drive is totally blank but the SMART data on the drive shows it's been used.
a ghost image application is harder to tell. If you have the original image you can hash the drive and see if it matches the image exactly, which would be highly unlikely if not for an image being applied, but once data has altered on the drive you have little more than circumstantial evidence that the two just happen to be the same. You'd do best to look for data on the drive like product keys and timestamps on certain files at that point.
This is how i understand it and it may well be incorrect, I'd appreciate feedback.
Using software such as Encase or Autopsy might be of use, as it will allow you to check the unallocated cluster. This might potentially show you a large amount of information that has been "Formatted" or deleted. This is due to most quick formatting just hiding the information and allowing for it to be overwritten by new files on the drive.
