±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 30290
New Yesterday: 0 Visitors: 147

±Latest Articles

RSS Feed Widget

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News   Forums   Articles

A "Can you fix my machine?" question.

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

A "Can you fix my machine?" question.

Post Posted: Tue Feb 24, 2009 6:47 am

This is not a forensic question, this is a "You know about computers, can you fix my machine?" problem.

A laptop belonging to the local Church and ridddled with viruses was given to me to fix. I attached the drive to my sheep-dip machine, removed the viruses and put the drive back in the laptop. Everything went OK, booted the machine, no password prompt, in fact no account prompt. I then cleaned up the registry and defragged the drive. The next time I booted I was taken through the account/password screen. I know that I was not asked for a password the first time because I don't know what it is.

Cleary I can defeat the password but I am interested in why this happened. Any ideas?

Thanks
Ron
_________________
Forensic Computer Services
Digital Forensics and eDiscovery
Lotus Notes eDiscovery and Forensics
CCTV Forensics and analysis
Tape eDiscovery and Forensics 

roncufley
Senior Member
 
 
  

Re: A "Can you fix my machine?" question.

Post Posted: Tue Feb 24, 2009 6:57 am

Perhaps related to a change in the registry when you were cleaning it up? e.g. removal of saved profile info or a change to the default logon procedure?

Jamie
_________________
Jamie Morris
Forensic Focus
Web: www.forensicfocus.com
Twitter: twitter.com/ForensicFocus
Facebook: www.facebook.com/forensicfocus
Google+: www.google.com/+ForensicFocus 

jamie
Site Admin
 
 
  

Re: A "Can you fix my machine?" question.

Post Posted: Tue Feb 24, 2009 7:10 am

what OS is the machine running?!  

fuzed
Senior Member
 
 
  

Re: A "Can you fix my machine?" question.

Post Posted: Tue Feb 24, 2009 7:14 am

- fuzed
what OS is the machine running?!


Sorry, I should have said: Win XP SP2.
_________________
Forensic Computer Services
Digital Forensics and eDiscovery
Lotus Notes eDiscovery and Forensics
CCTV Forensics and analysis
Tape eDiscovery and Forensics 

roncufley
Senior Member
 
 
  

Re: A "Can you fix my machine?" question.

Post Posted: Tue Feb 24, 2009 7:25 am

could be profile related!!?! maybe the profiles that were on there have been deleted some how...

Seen XP do some very very strange things in my time of using it (esp with profiles).... have a dig around and see if there are any corrupted profiles on the machine..  

fuzed
Senior Member
 
 
  

Re: A "Can you fix my machine?" question.

Post Posted: Tue Feb 24, 2009 11:08 am

Ron,

I feel I need to refer you to this video for further explanation of the behaviour you're seeing Wink

Jamie
_________________
Jamie Morris
Forensic Focus
Web: www.forensicfocus.com
Twitter: twitter.com/ForensicFocus
Facebook: www.facebook.com/forensicfocus
Google+: www.google.com/+ForensicFocus 

jamie
Site Admin
 
 
  

Re: A "Can you fix my machine?" question.

Post Posted: Tue Feb 24, 2009 11:28 am

Thanks, Jamie. That explains it all. The answer is always so simple once you know what it is.
_________________
Forensic Computer Services
Digital Forensics and eDiscovery
Lotus Notes eDiscovery and Forensics
CCTV Forensics and analysis
Tape eDiscovery and Forensics 

roncufley
Senior Member
 
 

Reply to topicReply to topic

Share this forum topic to encourage more replies




Page 1 of 1