±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 0
Overall: 27350
Visitors: 43

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

find out if user booted from CD

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3, 4  Next 
  

find out if user booted from CD

Post Posted: Mon Dec 03, 2012 7:10 am

How can I find out if a user booted their computer from a CD?  

digitalcoroner
Member
 
 
  

Re: find out if user booted from CD

Post Posted: Mon Dec 03, 2012 8:31 am

1. Ask them.

2. Ask others around them.

3. Check the video.  

keydet89
Senior Member
 
 
  

Re: find out if user booted from CD

Post Posted: Mon Dec 03, 2012 8:49 am

- keydet89
1. Ask them.

2. Ask others around them.

I would add "nicely" Wink

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: find out if user booted from CD

Post Posted: Wed Dec 05, 2012 4:10 am

Your answers would imply that there is no way to determine this via digital forensic methods?

asking-the-user method doesn't work very well. Smile  

digitalcoroner
Member
 
 
  

Re: find out if user booted from CD

Post Posted: Wed Dec 05, 2012 4:38 am

- digitalcoroner
Your answers would imply that there is no way to determine this via digital forensic methods?

asking-the-user method doesn't work very well. Smile

Well, a bootable CD normally completely by-passes each and every hard disk on the PC during the booting phase, so it leaves no traces whatever.
What you may find (in particular situations) is:
  1. that the BIOS of the PC was set to boot from CD before booting from internal HD (but this means nothing as this is a common enough setting and a number of modern BIOS offer a F11 or F12 option to change boot order on the fly, so besides being unlikely that you find this, the finding wouldn't be conclusive at all)
  2. if the PC was using Linux and on it no NT system was ever booted, that there is a disk signature in the MBR
  3. if the user used the booted cd to perform some particular operation on the filesystem or on files that the "resident" OS would be incapable of or "normally" does not perform (are you familiar with needles and haystacks?) this is a "generalization of point #2 above

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: find out if user booted from CD

Post Posted: Wed Dec 05, 2012 5:31 am

You may also check what is in the swap partition if a ext file systems formatted HD with a linux distro installed is luckily present in the machine you want to investigate. Some live CD distros may use it.  

jako822
Newbie
 
 
  

Re: find out if user booted from CD

Post Posted: Wed Dec 05, 2012 7:08 am

- digitalcoroner
Your answers would imply that there is no way to determine this via digital forensic methods?


I'm sure that if you reason through your question, you'll see why that is...

If a user inserts a CD into the CD Device and boots off of it, most bootable distros that I'm aware of will create a swap partition in RAM, in addition to loading the entire OS in RAM.

As such, what artifacts would you expect to see?  

keydet89
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 4
Go to page 1, 2, 3, 4  Next