.

Webmail in Win 7

<<

Joshsevo

User avatar

Sr. Member
Sr. Member

Posts: 281

Joined: Tue Dec 29, 2009 11:00 pm

Post Fri Jul 15, 2011 1:33 pm

Webmail in Win 7

So our friends at Microsfot moved the spot where the webmail such as yahoo, hotmail, gmail to a different spot and without cracking open my SANS computer Forensics books.  Anyone know exactly where it is?

Got a Hotmail acct I need to look at for some emails.
Security+, Network+, C|EH, CHFI, CPT
<<

cd1zz

User avatar

Recruiters
Recruiters

Posts: 566

Joined: Sun Oct 03, 2010 9:01 pm

Post Fri Jul 15, 2011 4:07 pm

Re: Webmail in Win 7

I don't understand. Why cant you just go to hotmail.com, gmail.com and yahoo.com?

What "spot" are you talking about?
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Fri Jul 15, 2011 7:54 pm

Re: Webmail in Win 7

Yeah... This one lost me, too.  Please elaborate more, on what it is you're actually trying to do.
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

Data_Raid

User avatar

Full Member
Full Member

Posts: 165

Joined: Fri Nov 09, 2007 5:55 am

Post Sat Jul 16, 2011 6:14 am

Re: Webmail in Win 7

Spot = URL ?

Image
All men by nature desire knowledge.

Aristotle
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Sat Jul 16, 2011 7:06 am

Re: Webmail in Win 7

Data_Raid wrote:Image


<LOL>
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

Joshsevo

User avatar

Sr. Member
Sr. Member

Posts: 281

Joined: Tue Dec 29, 2009 11:00 pm

Post Tue Jul 19, 2011 1:39 pm

Re: Webmail in Win 7

Sorry,  We are trying to look for webmail on a suspects HDD.  Since windows 7 revamped so much stuff, they moved where they keep the files of webmail.

I assume that you guys know that the computers keeps these files on the HDD even though it's webmail.

So before in like XP the files were kept in Local/App data/users...etc.  These are usually just remenants of the emails and may need to be "carved" out.  Just seeing if anyone knows.
Security+, Network+, C|EH, CHFI, CPT
<<

lorddicranius

User avatar

Sr. Member
Sr. Member

Posts: 448

Joined: Thu Mar 03, 2011 3:54 am

Post Tue Jul 19, 2011 1:57 pm

Re: Webmail in Win 7

I didn't know that.  Can you elaborate?  Mind you, I'm not very well versed on forensics :) What format are/were these remnants in?
GSEC, eCPPT, Sec+
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Tue Jul 19, 2011 2:06 pm

Re: Webmail in Win 7

Browser cache?
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

nonexistententity

Newbie
Newbie

Posts: 15

Joined: Tue Jul 19, 2011 11:32 am

Post Tue Jul 19, 2011 2:30 pm

Re: Webmail in Win 7

You mean like:

C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Temporary Internet Files?

That information is always available in the browser settings.

-N33
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Tue Jul 19, 2011 2:46 pm

Re: Webmail in Win 7

Yeah, that's where I was leading him.
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

nonexistententity

Newbie
Newbie

Posts: 15

Joined: Tue Jul 19, 2011 11:32 am

Post Tue Jul 19, 2011 2:51 pm

Re: Webmail in Win 7

hayabusa wrote:Yeah, that's where I was leading him.


Were you leaning more towards a "find the answer" method? Sorry if I jumped the gun on ya, bro.

-N33
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Tue Jul 19, 2011 2:55 pm

Re: Webmail in Win 7

Yep, I was, but that's OK.  They'll find the answer with your guidance, too.  ;)
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

Joshsevo

User avatar

Sr. Member
Sr. Member

Posts: 281

Joined: Tue Dec 29, 2009 11:00 pm

Post Wed Jul 20, 2011 1:17 pm

Re: Webmail in Win 7

I sent an email to my SANS instructor and he said that it won't be in a specific spot but there will be remnants of the files left in different spots such as memory,

Here' is his response:

Grabbing webmail is like recovering any other browser artifact. It is
not kept in any particular place so your stuck working browser cache
data, memory, etc. That is why tools like IEF are popular...and
pricey.
Security+, Network+, C|EH, CHFI, CPT
<<

lorddicranius

User avatar

Sr. Member
Sr. Member

Posts: 448

Joined: Thu Mar 03, 2011 3:54 am

Post Wed Jul 20, 2011 1:25 pm

Re: Webmail in Win 7

Ooh, ok.  I see now.  Browser cache makes sense.  I had it in my head that there was something comparable to .PST's or something that I wasn't aware of haha
GSEC, eCPPT, Sec+
<<

Joshsevo

User avatar

Sr. Member
Sr. Member

Posts: 281

Joined: Tue Dec 29, 2009 11:00 pm

Post Wed Jul 20, 2011 1:52 pm

Re: Webmail in Win 7

I was too and that's why I posed the question like I did, sorry for the confusion.  But that's why I'm still an intern.  Still learning.  I won't forget this now.
Security+, Network+, C|EH, CHFI, CPT
Next

Return to Forensics

Who is online

Users browsing this forum: No registered users and 1 guest

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software