Video within Conten...
 
Notifications
Clear all

Video within Content.IE5 dat file

5 Posts
5 Users
0 Likes
519 Views
(@bitmadmax)
Posts: 2
New Member
Topic starter
 

Greetings all,

I am a long time lurker of these forums and have found the topics and resources on this site to be most useful and valuable. So thank you very much.

However I need some further help and would appreciate any opinion you could offer.

As part of a current job I am working on, I have encountered a video that may be of evidential value. The video itself is present within a .dat file, and the file is located in \temporary internet files\Content.IE5\XXXXXXXX\xx[x].dat

How might I be able to determine how this video came to be where it is? I have used HstEx/NetAnalysis and Encase6 to try and analyse it. Nothing within the internet history gives any clues as to how it got there. All I have is the carved movie itself (mpg) and a timestamp on the actual .dat file.

Any pointers would be great, thanks )

 
Posted : 28/01/2013 4:48 pm
MagnetForensics
(@magnetforensics)
Posts: 40
Eminent Member
 

Hi bitmadmax,

Can you advise what the actual filename is?

Have you tried doing a keyword search in the index.dat files (or anywhere else) for that filename?

Regards,
Jad

 
Posted : 28/01/2013 5:35 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

How might I be able to determine how this video came to be where it is? I have used HstEx/NetAnalysis and Encase6 to try and analyse it. Nothing within the internet history gives any clues as to how it got there. All I have is the carved movie itself (mpg) and a timestamp on the actual .dat file.

Random thoughts.

Streams attached?
Like Zone.Identifier?
http//www.nirsoft.net/utils/alternate_data_streams.html

If the filename is - as I presume - something like
mynicemovie[n].dat
http//kb.digital-detective.co.uk/display/NetAnalysis1/Internet+Explorer+Cache
and n is not 1, then another copy has been downloaded/accessed through Explorer.

jaclaz

 
Posted : 28/01/2013 6:33 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

As part of a current job I am working on, I have encountered a video that may be of evidential value. The video itself is present within a .dat file, and the file is located in \temporary internet files\Content.IE5\XXXXXXXX\xx[x].dat

As already mentioned, the complete name of the file would be very helpful.

How might I be able to determine how this video came to be where it is? I have used HstEx/NetAnalysis and Encase6 to try and analyse it. Nothing within the internet history gives any clues as to how it got there.

Timeline analysis might be very useful in this case.

All I have is the carved movie itself (mpg) and a timestamp on the actual .dat file.

Carved? When you say that this video was "located in" the file, what do you mean? Was the video embedded in the file with other data, or did it appear that the .mpg file was simply renamed to .dat?

Is there anything in the video that might reveal something about from where the movie originated?

 
Posted : 28/01/2013 9:38 pm
pbobby
(@pbobby)
Posts: 239
Estimable Member
 

Hello Bitmadmax - is that .dat file perhaps deleted?

 
Posted : 29/01/2013 12:01 am
Share: