10

I'm getting my hands on a system (one laptop, one hard drive) that were in custody of a LEO for a fairly significant period of time. The laptop runs windows XP professional, with a recovery partition, and the hard drive is a 2.5 inch 40 gb drive that has an NTFS file system

Entirely for academic reasons i'm thinking of forensically imaging the drives with a forensics fork of DD (i'm thinking if dcfldd) then working off a copy of that.

Considering i have some idea how long the system has been out of our hands, i'm also considering mounting the registry to check for devices that have been plugged into the system during that time (assuming they didn't do everything offline like good pandas) and checking for files that have been modified during that time (is there an easy way to do that?).

Am i missing anything? is there anywhere else i should look?

  • Pardon my ignorance, what is a LEO? – Christopher Sep 30 '11 at 19:09
  • law enforcement organisation – Faileas Grey Oct 1 '11 at 10:42
5

You could begin taking some look at the Forensic Toolkit to examine the NTFS filesystem.

In the same page there are tools for playing with the trash bin, IE, etc.

About registry, take a look at this and this, you'll find some indication of interesting tools.

  • 1
    In the time that has intervened, the organisation in question basically didn't really take any action involving the hard drive, and we didn't find anything at all digging up the drive. The system in question died of old age and while we're keeping it . Amazingly, the organisation actually turned on the system themselves to check something, and probably didn't have trained forensic examiners. – Faileas Grey Mar 25 '13 at 11:43
  • 1
    Cops messing up the carefully laid plans of Forensics? Why that NEVER happens! – Adonalsium Dec 11 '17 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.