±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 5
New Yesterday: 5
Overall: 27203
Visitors: 60

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Video within Content.IE5 dat file

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Video within Content.IE5 dat file

Post Posted: Mon Jan 28, 2013 6:48 am

Greetings all,

I am a long time lurker of these forums and have found the topics and resources on this site to be most useful and valuable. So thank you very much.

However I need some further help and would appreciate any opinion you could offer.

As part of a current job I am working on, I have encountered a video that may be of evidential value. The video itself is present within a .dat file, and the file is located in \temporary internet files\Content.IE5\XXXXXXXX\xx[x].dat

How might I be able to determine how this video came to be where it is? I have used HstEx/NetAnalysis and Encase6 to try and analyse it. Nothing within the internet history gives any clues as to how it got there. All I have is the carved movie itself (mpg) and a timestamp on the actual .dat file.

Any pointers would be great, thanks Smile  

bitmadmax
Newbie
 
 
  

Re: Video within Content.IE5 dat file

Post Posted: Mon Jan 28, 2013 7:35 am

Hi bitmadmax,

Can you advise what the actual filename is?

Have you tried doing a keyword search in the index.dat files (or anywhere else) for that filename?

Regards,
Jad  

MagnetForensics
Member
 
 
  

Re: Video within Content.IE5 dat file

Post Posted: Mon Jan 28, 2013 8:33 am

- bitmadmax
How might I be able to determine how this video came to be where it is? I have used HstEx/NetAnalysis and Encase6 to try and analyse it. Nothing within the internet history gives any clues as to how it got there. All I have is the carved movie itself (mpg) and a timestamp on the actual .dat file.


Random thoughts.

Streams attached?
Like Zone.Identifier?
www.nirsoft.net/utils/...reams.html

If the filename is - as I presume - something like:
mynicemovie[n].dat
kb.digital-detective.c...orer+Cache
and n is not 1, then another copy has been downloaded/accessed through Explorer.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Video within Content.IE5 dat file

Post Posted: Mon Jan 28, 2013 11:38 am

- bitmadmax

As part of a current job I am working on, I have encountered a video that may be of evidential value. The video itself is present within a .dat file, and the file is located in \temporary internet files\Content.IE5\XXXXXXXX\xx[x].dat


As already mentioned, the complete name of the file would be very helpful.

- bitmadmax

How might I be able to determine how this video came to be where it is? I have used HstEx/NetAnalysis and Encase6 to try and analyse it. Nothing within the internet history gives any clues as to how it got there.


Timeline analysis might be very useful in this case.

- bitmadmax

All I have is the carved movie itself (mpg) and a timestamp on the actual .dat file.


Carved? When you say that this video was "located in" the file, what do you mean? Was the video embedded in the file with other data, or did it appear that the .mpg file was simply renamed to .dat?

Is there anything in the video that might reveal something about from where the movie originated?  

keydet89
Senior Member
 
 
  

Re: Video within Content.IE5 dat file

Post Posted: Mon Jan 28, 2013 2:01 pm

Hello Bitmadmax - is that .dat file perhaps deleted?
_________________
Blog: secureartisan.wordpress.com 

pbobby
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1