±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 34081
New Yesterday: 0 Visitors: 155

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

XBOX 360

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 

XBOX 360

Post Posted: Tue Sep 29, 2009 1:32 pm

Afternoon all. I am looking for information on doing a forensic investigations done on the xbox 360. I know the old xbox could be used to store data on I am just interested in if anyone has done an investigation on the 360. Any Help would be highly appreciated Wink  


Re: XBOX 360

Post Posted: Tue Sep 29, 2009 1:45 pm

A quick trip to Google may help or you could try this page.



Senior Member

Re: XBOX 360

Post Posted: Tue Sep 29, 2009 2:06 pm

Hi there,

I did some research into forensically analysing the Xbox 360 and the PS3. Are you looking for anything in particular?  


Re: XBOX 360

Post Posted: Fri Oct 02, 2009 8:38 pm

- scuzz

I did some research into forensically analysing the Xbox 360 and the PS3. Are you looking for anything in particular?
Hi scuzz!

In my experience, the Xbox 360 has a proprietary file and folder format that obscures the majority of data created by user profile activity. It is possible to extract some time and date information about game saving and last games played but associating this information with a 'real' user profile name seems to be something that Microsoft encode in a proprietary format.

Mounting the partition table stored in a forensic image of an Xbox 360 hard disk sems to be beyond EnCase and FTK although data carving for images is possible, so browsing a mounted disk image is left to a small app called Xplorer 360, this may change with the advent of FATX support on Windows 7.
The Xbox hard disk is FATX formatted and the hard disk firmware prevents 'cloned' hard disks from being used. Flashing the firmware of a similar make and model hard disk, explained here Xbox 360 HDD Hack may be a sound basis for a restore but I have a sneaky feeling that the serial number of the original hard disk is part of the header in a lot of system files and could cause the restore to fail.

Until these issues are sorted, I have simply been acquiring a forensic image of the hard disk (in case comparison is needed later) and then performing a live examination of the device to identify email accounts and user profile names etc.
PS3 consoles will have no problem working with a 'clone' of the original hard disk but again a live examination is neccessary as the PS3 hard disk is encrypted.
Forensic Computer Analyst (LE)
BSc (Hons)

Senior Member


Post Posted: Sat Oct 03, 2009 5:59 am


Re: hi,,,,,,,,,,,,

Post Posted: Tue Oct 06, 2009 9:17 am

- bbbhhh

Wow what an unhelpful first post! Crying or Very sad  

Senior Member

Re: XBOX 360

Post Posted: Wed Oct 21, 2009 10:40 am

I'm potentially about to embark on a similar investigation, except this time I have no xbox hard drive, only the memory card. Has anyone looked at these before?  

Senior Member

Page 1 of 2
Go to page 1, 2  Next