EH-Net

Ethical Hacking Discussions and Related Certifications => Forensics => Topic started by: Joshsevo on July 15, 2011, 01:33:53 PM

Title: Webmail in Win 7
Post by: Joshsevo on July 15, 2011, 01:33:53 PM

So our friends at Microsfot moved the spot where the webmail such as yahoo, hotmail, gmail to a different spot and without cracking open my SANS computer Forensics books. Anyone know exactly where it is?

Got a Hotmail acct I need to look at for some emails.

Title: Re: Webmail in Win 7
Post by: cd1zz on July 15, 2011, 04:07:44 PM

I don't understand. Why cant you just go to hotmail.com, gmail.com and yahoo.com?

What "spot" are you talking about?

Title: Re: Webmail in Win 7
Post by: hayabusa on July 15, 2011, 07:54:38 PM

Yeah... This one lost me, too. Please elaborate more, on what it is you're actually trying to do.

Title: Re: Webmail in Win 7
Post by: Data_Raid on July 16, 2011, 06:14:52 AM

Spot = URL ?

(http://t1.gstatic.com/images?q=tbn:ANd9GcT35hqvLdHamYwOWCpes7JPidrkdIh5ero66UqYaDESeQzJoPd0cA&t=1)

Title: Re: Webmail in Win 7
Post by: hayabusa on July 16, 2011, 07:06:33 AM

Quote from: Data_Raid on July 16, 2011, 06:14:52 AM

(http://t1.gstatic.com/images?q=tbn:ANd9GcT35hqvLdHamYwOWCpes7JPidrkdIh5ero66UqYaDESeQzJoPd0cA&t=1)

<LOL>

Title: Re: Webmail in Win 7
Post by: Joshsevo on July 19, 2011, 01:39:12 PM

Sorry, We are trying to look for webmail on a suspects HDD. Since windows 7 revamped so much stuff, they moved where they keep the files of webmail.

I assume that you guys know that the computers keeps these files on the HDD even though it's webmail.

So before in like XP the files were kept in Local/App data/users...etc. These are usually just remenants of the emails and may need to be "carved" out. Just seeing if anyone knows.

Title: Re: Webmail in Win 7
Post by: lorddicranius on July 19, 2011, 01:57:13 PM

I didn't know that. Can you elaborate? Mind you, I'm not very well versed on forensics :) What format are/were these remnants in?

Title: Re: Webmail in Win 7
Post by: hayabusa on July 19, 2011, 02:06:19 PM

Browser cache?

Title: Re: Webmail in Win 7
Post by: nonexistententity on July 19, 2011, 02:30:17 PM

You mean like:

C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Temporary Internet Files?

That information is always available in the browser settings.

-N33

Title: Re: Webmail in Win 7
Post by: hayabusa on July 19, 2011, 02:46:17 PM

Yeah, that's where I was leading him.

Title: Re: Webmail in Win 7
Post by: nonexistententity on July 19, 2011, 02:51:44 PM

Quote from: hayabusa on July 19, 2011, 02:46:17 PM

Yeah, that's where I was leading him.

Were you leaning more towards a "find the answer" method? Sorry if I jumped the gun on ya, bro.

-N33

Title: Re: Webmail in Win 7
Post by: hayabusa on July 19, 2011, 02:55:51 PM

Yep, I was, but that's OK. They'll find the answer with your guidance, too. ;)

Title: Re: Webmail in Win 7
Post by: Joshsevo on July 20, 2011, 01:17:28 PM

I sent an email to my SANS instructor and he said that it won't be in a specific spot but there will be remnants of the files left in different spots such as memory,

Here' is his response:

Grabbing webmail is like recovering any other browser artifact. It is
not kept in any particular place so your stuck working browser cache
data, memory, etc. That is why tools like IEF are popular...and
pricey.

Title: Re: Webmail in Win 7
Post by: lorddicranius on July 20, 2011, 01:25:17 PM

Ooh, ok. I see now. Browser cache makes sense. I had it in my head that there was something comparable to .PST's or something that I wasn't aware of haha

Title: Re: Webmail in Win 7
Post by: Joshsevo on July 20, 2011, 01:52:00 PM

I was too and that's why I posed the question like I did, sorry for the confusion. But that's why I'm still an intern. Still learning. I won't forget this now.

Title: Re: Webmail in Win 7
Post by: hayabusa on July 20, 2011, 02:52:26 PM

Yup. And THAT'S why we're all here. To both help by example and giving answers, or to help by helping you to help yourself (pointing you in the right direction.)

Anyway, glad the hint was helpful, although you still have to followup and do your digging on it.

;)