I have Encase. and I'd like to know where can I find if someone ran CCleaner Or CleanUp software to erase evidence.


You could look through either the UserAssist registry entries for each user (located in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist), or check the prefetch files (located at %SystemRoot%\Prefetch).

Both maintain a list of run programs on the machine including the last time they were run and the number of times said program was run.

Further reading:

| improve this answer | |

Some times the lack of evidences is evidence in it self. If you find sectors with absolutely nothing in them, it is possible that the Cleaner Tools have been used. Almost all disks will have left over data in the unused sectors. You might be able to use this method to determine if large chunks of Data were removed.

| improve this answer | |
  • One could easily argue that the sector is containing random data because it used to be part of swap. – forest Oct 30 '18 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.