Printable View
Yes,
I guess that the professionals found a contaminated forensic environment with no clear division of ownership? not much you can do there?
True, but we wouldn't have let it happen in the first place? When redeploying you always wipe and reinstall?Quote:
I mentioned sleuthkit as anyone with half a brain in IT could have done a much better "forensic" report. But as far as I know this hasn't been done.
With a proper forensic analysis you should be able to tell if the files were on that disk before or after he got it (file ownership, creation dates etc). You might also be able to tell if it really was caused by the malware or by a person using the machine.
You carefully gather all evidence. Subpoena Google to get those searches? ISP data? You go over the HD with a fine toothed comb. Order everything chronologically. And if you eliminate all possibilities, whatever is left however improbable, must be the truth..
But perhaps I've been watching to much CSI :D
Well SD~, maybe rcgreen needs this:
http://zapatopi.net/mindguard/
:lildevil: