Investigation Help

[karldenton]

Without going into details, I basically need to check a computer out. The user has files stored on an external hard disk. They have access them on the computer but there isnt a copy of it on the computer. Is there any way to check when they have been opened and will there be a cached version ?. Some are pictures .jpg too.

Thanks

[kmount]

The "Recent" folder in their profile might provide you with some file names / paths.

 

Not sure if there will be a cache but some data recovery software would be my port of call.

 

Slave the disk up or you will risk ruining the data chances.

 

Also, if this is being done for anything even remotely disciplinary/legally you shouldn't be doing it without guidance(or at all in some cases).

[powdarrmonkey]

Take a forensic copy of any disk you want to read and only use the copy. Don't even spin the original drive up (except to do this).

 

Don't mount or boot the disk, use a live CD to examine the files in isolation of any operating system installed, Windows particularly is terrible for clearing some clues up during boot and periodically.

[karldenton]

I'm not sure what you mean mate? I cant get access to the original USB disk. The only disk I have access to is the hdd on the PC hoping there is a cached version of the files been opened via the disk

[kmount]

Don't fire up the PC, treat this as a case where you are trying to recover data.

 

Recovery software & navigate through the profile's Recent, & Temp dirs but I suspect you may not yield a good result.

[karldenton]

Ok cheers. All my data recovery software requires booting up PC. Is there any that you can put ona live cd?

[pritchardavid]

Try ubuntu, it's what we use for recovery

[kmount]

Ok cheers. All my data recovery software requires booting up PC. Is there any that you can put ona live cd?

 

Really? That's some pretty awful software if it insists you boot FROM the disk you want to recover from?

 

I suspect what you mean is that it runs inside windows so you should take the disk out of this PC and slave it up if you want to go that route or try the ubuntu live cd.

[karldenton]

Thanks I will try the ubuntu live cd.

If there will be a cache of the images and files where would they be ? Would it just be the shortcut in recent documents ?

Thanks

[karldenton]

Anyone able to help me on where cached files might be in ubuntu ?

[Martin]

Can you do a search of "all files modified in the last X days" or similar? That way you would find any more recent activity/residue.

 

mb

[somabc]

Are you expecting to find anything 'illegal' because if so don't touch it. You are not qualified and you will only tamper with the evidence. Give it to the police.

[jcollings]

Are you expecting to find anything 'illegal' because if so don't touch it. You are not qualified and you will only tamper with the evidence. Give it to the police.

 

Totally agree with this. Also depending on the nature of what you are looking for you run the risk of committing criminal offences of your own.

[russdev]

As pointed out if this might even got slightly into legal side then stop (as you could void any use of that evidence by evening touching it). If you have looked at it.

 

Stop

 

Seal it in envelope sign the seal put in safe. Document in great detail any work you have done so far (I mean to point of I clicked this and then clicked that etc). Then contact LA if your are a state school etc.

 

This really is something you should not be doing if this could become a legal case.

 

Russ

[karldenton]

THanks.

I can't go into detail but I know there is nothing of an illegal nature.

[karldenton]

How can I do a search in linux to find any files opened in last 20 days ?

THanks

[somabc]

find / -type f -mtime -20 > modified.txt

 

Then you can grep the output

Edited November 2, 2010 by somabc

[powdarrmonkey]

find / -type f -mtime -20 > modified.txt

 

Returns files modified in last 20 days. Accessed time is -atime (though for FAT/NTFS filesystems, results may vary).