|
-
June 22nd, 2012, 04:57 PM
#11
Junior Member
What's properly? How do you know if those have been used properly?
Should i use Roadkil, Recuva and Disk invest? What should i do with these tools? What the "wipe free space" option would do, what software?
#1. Provided that the files have not been overwritten or corrupted then this should be possible, although you can never guarantee "ALL"
What software would recover the picture? Can i choose to recover the specific folder the pictures were in?
#2. Can't really say as I don't use IM. The usual rules regarding overwriting and wiping will apply, but I suspect that the Page File might leak this information, unless you have it set to be wiped on shutdown, which is not the Windows default setting. I think that your application settings would also influence what got saved.
What's Page File? Where is it? What software would recover these?
#3. Depending on browser settings, wiping and overwriting, I believe that you could retrieve many of the website addresses, but I don't think that you could find the exact pages to view as an image. 3 years.......... that's a long time for temporary data to be held, or for a web page to still exist? I would say that it is theoretically possible in part at least.
What software would recover these? Where should i look for it with the software?
#4. No, I don't think so. Cookies and history shouldn't contain the password, although the Page File might?. The way it should work is that the e-mail site will send you a "session authentication" "cookie" which is valid for that session only, and is not reusable; nor can the password be derived from it, as it is not used in generating it. When you close the session or the host closes it due to inactivity, it will no longer work.
Is the password in the Page File ? Where is the Page File?
#5. It would depend on the type of file and the application used to open it. For example, opening a file in a hex editor would generally not create a usage record, and using a Linux live CD would go totally undetected by Windows  . I think that "date last accessed" is a much more common metric. The first place I would look is in the file's metadata.
Where is the file's metadata? Is there any other place to look?
The file hasn't been opened in a hex editor or a Linux Live CD.
I am basing these answers on using commonly available tools rather than professional evidence gathering applications (I think that EnCase is still the classic?). As you will no doubt appreciate, a lot of this information is stored in temporary files, so you cannot guarantee anything other than to say that it is possible in part at least.
What software would recover these temproary files? What professional evidence gathering applications would recover that commonly available tools wouldn't?
My personal view is that the two critical areas to look at would be the Page File and System Restore, as these are generally ignored by conventional housekeeping applications. Cluster tips and alternate data streams can also be quite interesting.
Where's Page File? Is everything in that Page File?
What would System Restore recover?
What are cluster tips and alternate data streams?
Thanks for your help
Similar Threads
-
By cheyenne1212 in forum Miscellaneous Security Discussions
Replies: 7
Last Post: February 1st, 2012, 02:51 PM
-
By ThePreacher in forum Miscellaneous Security Discussions
Replies: 17
Last Post: December 14th, 2006, 09:37 PM
-
By -DaRK-RaiDeR- in forum Newbie Security Questions
Replies: 9
Last Post: December 14th, 2002, 08:38 PM
-
By Noble Hamlet in forum AntiOnline's General Chit Chat
Replies: 1100
Last Post: March 17th, 2002, 09:38 AM
-
By E5C4P3 in forum Miscellaneous Security Discussions
Replies: 5
Last Post: March 7th, 2002, 07:35 AM
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|