Scenerio

<<

r_mizell@hotmail.com

Newbie
Newbie

Posts: 2

Joined: Tue May 05, 2009 2:09 am

Post Sat May 09, 2009 3:24 am

Scenerio

Good morning guys

This may not be the right place for this but I have a couple of questions. I'm a newbie into forensics and in trying to learn what's going on I set up scenarios and play them out. Last night my task was, using HelixPro Live Response on XP system. As a first responder to find out what usb type of items were attached to the computer and when. As a first responder I would know to look around the area to find these devices. My questions are, is there a way to see what was copied to the usb devices, second, is there anything in the live responder to actually tell if the cd or dvd burner has been used and maybe the types of files copied also, so as a first responder I know if I need to look deeper into whats in the area of investigation. I believe in the Plan B logo that everything leaves a fingerprint and was hoping you guys might point me in the right direction.

Thanks

Rick
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Sat May 09, 2009 10:37 am

Re: Scenerio

Unfortunately you hit the question that's one of the most difficult to answer in an Intellectual Property case, "What did they take before the left the company?"  Yes, it's easy to go through the mounted devices registry key and determine what devices where plugged and what drive letters they occupied.  This is your first step.

The second step is to look at the LNK files on a Windows machine.  Look at the recently opened files, both in the Recent folder and MS Office Recent Files.  See if any of them are pointing to a drive letter occupied by your external devices.  If you find any, it does NOT tell you that something was copied by your suspect to the external drive.  All it tells you is that the files were on the device at some point.  It doesn't tell you how they got there. 

CD Burning is a little bit more workable, if they used the built-in Windows CD-Burning app especially.  There are temp files the process creates in the Local Settings folder of the user profile:

C:\Documents and Settings\<profile>\Local Settings\Application Data\Microsoft\CD Burning

The prefetch file will also tell you when the CD Burning process was executed.  Finally, the event log will show the CD Burning service stopping and starting.  If your Access Times on the actual files and the Creation Times for the links in the CD Burning temp folder mach, and the CD Burning service ran for more than 20 Seconds (amount of time typically needed to open and close a CD), then you can speculate and only speculate that a CD was burned with these files. 

Your best evidence for determining if anything was copied to an external device or burned to a CD is the external device or the CD itself.  If you don't have that, it's very difficult to determine what was taken.

Those are my two cents.  I hope that someone can provide a better answer.  I would love to learn a better way myself.
~~~~~~~~~~~~~~
Ketchup
<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1253

Joined: Mon Apr 28, 2008 9:20 am

Post Mon Jun 22, 2009 3:07 am

Re: Scenerio

As far as I know its written in the registry when an usb-device was plugged into the system but not which files where copied onto it.

It will be also hard if not not possible to find out what was copied on external drives or burned on cds/ dvds, as there are also programs available, which can be used as a third party software which don't have to be installed on the system (portable) or have built-in functions to reset all changes which were made.
I also don't think that it is somewhere stored in the registry or on another place when files were copied from A to B, but I am not sure about this though.

Two programs you may have a look at are usbview and USBDeview (both freeware) which will display some information about usb devices on your system and help for further research.

Return to Forensics

Who is online

Users browsing this forum: No registered users and 1 guest

Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software