10

I'm getting my hands on a system (one laptop, one hard drive) that were in custody of a LEO for a fairly significant period of time. The laptop runs windows XP professional, with a recovery partition, and the hard drive is a 2.5 inch 40 gb drive that has an NTFS file system

Entirely for academic reasons i'm thinking of forensically imaging the drives with a forensics fork of DD (i'm thinking if dcfldd) then working off a copy of that.

Considering i have some idea how long the system has been out of our hands, i'm also considering mounting the registry to check for devices that have been plugged into the system during that time (assuming they didn't do everything offline like good pandas) and checking for files that have been modified during that time (is there an easy way to do that?).

Am i missing anything? is there anywhere else i should look?

Improve this question
2
  • Pardon my ignorance, what is a LEO?
    – makerofthings7
    Sep 30, 2011 at 19:09
  • law enforcement organisation
    – Faileas Grey
    Oct 1, 2011 at 10:42

1 Answer 1

Reset to default
5

You could begin taking some look at the Forensic Toolkit to examine the NTFS filesystem.

In the same page there are tools for playing with the trash bin, IE, etc.

About registry, take a look at this and this, you'll find some indication of interesting tools.

Improve this answer
2
  • 1
    In the time that has intervened, the organisation in question basically didn't really take any action involving the hard drive, and we didn't find anything at all digging up the drive. The system in question died of old age and while we're keeping it . Amazingly, the organisation actually turned on the system themselves to check something, and probably didn't have trained forensic examiners.
    – Faileas Grey
    Mar 25, 2013 at 11:43
  • 1
    Cops messing up the carefully laid plans of Forensics? Why that NEVER happens!
    – Monica Apologists Get Out
    Dec 11, 2017 at 19:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .