Looking for evidence of ZDelete being used

Hi all, was wondering if you could help me out with a query.

I've recently started as a digital forensic analyst, and am undergoing training in Encase, FTK and several other forensic tools. I'm currently asssisting another analyst with regards to a case where we have a hunch that the suspect used a disk-cleaning utility (most likely ZDelete) to erase certain files.

We can't find any solid evidence to say whether he has or not, but doing a keyword search revealed some deleted files that aroused suspicion regarding use of ZDelete. Could anyone recommend what to look for to see if ZDelete had once been installed on the suspect's hdd?

Thank you for your time

I think there might be some stuff in the registry left (most software leaves crap in the registry)

Don't have any experience with ZDelete though..

Nope, unfortunately not, already checked there and couldnt find anything like ZDelete or LSoft Technologies (the company that makes ZDelete).

Thanks for your suggestiong though :)

I know that Encase has a selection of scripts you can download and use. One of which will show Installed software.

The scripts that I have seen are quite old now, have not looked at what is available for some time.
Have you checked out what they have to offer?

In any case if you run the correct script you maybe able to find some traces of Zdelet in unalocated area, perhaps.

Anyway good luck.

Well,

Whatever the guy used could have been on a CD, then you wouldn't find anything because it was never installed.

You might get the trial of ZDelete and load it onto another machine and find what traces it leaves. At least you would then know what you were looking for and where to look.

Just a thought :)

Both good ideas, cheers gentlemen, will try them after lunch :D

You are working on forensics. So you have other choices as well. Well, try to look for names of deleted files from the FAT/NTFS. If that doesnt helps. Recover everything that you can recover in raw mode. I mean any bit/byte you can recover. After you have recovered the raw stuff try run a search on that raw data for the strings used by Zdelete. Strings that they use in their text for menus, Dialogue boxes or anything else. Well windows supports unicode. So you may have to try many strings. And try those strings wich will firmly ensure these are from Zdelete only.

Download Zdelete, Open one of the files in IDA Pro, and then under strings tab , right click->setup and unselect unicode. Now refresh(right click). This may prove to be the starting point for what strings to be searched for.

Hope this helps.

Thank you NullDevice, that sounds pretty useful :)

Hi,

This looks somewhat relevant to what you are trying to do?

http://archives.neohapsis.com/archiv...3-q4/0036.html

:)

Wether or not files have been deleted, the chances are, there will be traces of those file in unalocated sectors of the suspect hdd.. If you could be more specific about what you are looking for.............I may be able to point you to the best enscript to run against your evedidence file.

Yes Jinxy, we looked in the unalocated sectors and found what we needed. At the time, we weren't told what to look for (not a criminal case, but a contract from a large business), apart from net activity within a certain date range. Later on we were contacted and given more info, and we're now done with the case :) Thanks for the help guys, was very useful