I'm getting my hands on a system (one laptop, one hard drive) that were in custody of a LEO for a fairly significant period of time. The laptop runs windows XP professional, with a recovery partition, and the hard drive is a 2.5 inch 40 gb drive that has an NTFS file system

Entirely for academic reasons i'm thinking of forensically imaging the drives with a forensics fork of DD (i'm thinking if dcfldd) then working off a copy of that.

Considering i have some idea how long the system has been out of our hands, i'm also considering mounting the registry to check for devices that have been plugged into the system during that time (assuming they didn't do everything offline like good pandas) and checking for files that have been modified during that time (is there an easy way to do that?).

Am i missing anything? is there anywhere else i should look?

  • Pardon my ignorance, what is a LEO? Commented Sep 30, 2011 at 19:09
  • law enforcement organisation Commented Oct 1, 2011 at 10:42

1 Answer 1


You could begin taking some look at the Forensic Toolkit to examine the NTFS filesystem.

In the same page there are tools for playing with the trash bin, IE, etc.

About registry, take a look at this and this, you'll find some indication of interesting tools.

  • 1
    In the time that has intervened, the organisation in question basically didn't really take any action involving the hard drive, and we didn't find anything at all digging up the drive. The system in question died of old age and while we're keeping it . Amazingly, the organisation actually turned on the system themselves to check something, and probably didn't have trained forensic examiners. Commented Mar 25, 2013 at 11:43
  • 1
    Cops messing up the carefully laid plans of Forensics? Why that NEVER happens! Commented Dec 11, 2017 at 19:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .