±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 1
New Yesterday: 9
Overall: 27208
Visitors: 49

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

XBOX 360

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

XBOX 360

Post Posted: Tue Sep 29, 2009 8:32 am

Afternoon all. I am looking for information on doing a forensic investigations done on the xbox 360. I know the old xbox could be used to store data on I am just interested in if anyone has done an investigation on the 360. Any Help would be highly appreciated Wink  

Velandra
Newbie
 
 
  

Re: XBOX 360

Post Posted: Tue Sep 29, 2009 8:45 am

A quick trip to Google may help or you could try this page.

Cheers,

Chris  

Chris55728
Member
 
 
  

Re: XBOX 360

Post Posted: Tue Sep 29, 2009 9:06 am

Hi there,

I did some research into forensically analysing the Xbox 360 and the PS3. Are you looking for anything in particular?  

scuzz
Member
 
 
  

Re: XBOX 360

Post Posted: Fri Oct 02, 2009 3:38 pm

- scuzz


I did some research into forensically analysing the Xbox 360 and the PS3. Are you looking for anything in particular?
Hi scuzz!


In my experience, the Xbox 360 has a proprietary file and folder format that obscures the majority of data created by user profile activity. It is possible to extract some time and date information about game saving and last games played but associating this information with a 'real' user profile name seems to be something that Microsoft encode in a proprietary format.

Mounting the partition table stored in a forensic image of an Xbox 360 hard disk sems to be beyond EnCase and FTK although data carving for images is possible, so browsing a mounted disk image is left to a small app called Xplorer 360, this may change with the advent of FATX support on Windows 7.
The Xbox hard disk is FATX formatted and the hard disk firmware prevents 'cloned' hard disks from being used. Flashing the firmware of a similar make and model hard disk, explained here Xbox 360 HDD Hack may be a sound basis for a restore but I have a sneaky feeling that the serial number of the original hard disk is part of the header in a lot of system files and could cause the restore to fail.

Until these issues are sorted, I have simply been acquiring a forensic image of the hard disk (in case comparison is needed later) and then performing a live examination of the device to identify email accounts and user profile names etc.
PS3 consoles will have no problem working with a 'clone' of the original hard disk but again a live examination is neccessary as the PS3 hard disk is encrypted.
_________________
Neddy
Forensic Computer Analyst (LE)
BSc (Hons)
!(-.-)!~~ 

neddy
Senior Member
 
 
  

hi,,,,,,,,,,,,

Post Posted: Sat Oct 03, 2009 12:59 am


bbbhhh
Newbie
 
 
  

Re: hi,,,,,,,,,,,,

Post Posted: Tue Oct 06, 2009 4:17 am

- bbbhhh


Wow what an unhelpful first post! Crying or Very sad  

s1lang
Senior Member
 
 
  

Re: XBOX 360

Post Posted: Wed Oct 21, 2009 5:40 am

I'm potentially about to embark on a similar investigation, except this time I have no xbox hard drive, only the memory card. Has anyone looked at these before?  

jgoss
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next