±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 1 Overall: 34611
New Yesterday: 6 Visitors: 236

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

"Oh no, the suspect ran CCleaner to get rid of the evidence!"

Wednesday, July 17, 2013 (01:05:26)

"Oh no, the suspect ran CCleaner to get rid of the evidence!"

"I recently received a few questions about the effects of running Internet history sanitation tools such as CCleaner, when examining a computer looking for internet related artifacts. CCleaner is freely available online and commonly used to ‘sanitize’ user activity. From the online documentation, CCleaner is said to protect privacy by cleaning out Internet browsing history and temporary internet files.

I have personally run into CCleaner on several cases when examining digital evidence and found it to have a varying degree of effectiveness, depending on exactly the types of artifacts you are trying to find/recover after its use. CCleaner has the ability to clean and remove information from several different locations, including the registry, the recycle bin and even wipe the disk. For this article, I am focusing on its effectiveness against the ability to recover Internet related history after CCleaner has been run..."

Read More (Magnet Forensics)


1 comment

Log in to post a comment. The comments are owned by the poster. Forensic Focus is not responsible for their content.

1. Secure deletion

Ok, so if the default isn't changed to "secure deletion," many artifacts can still be recovered. Isn't that a little obvious?

It would be much more interesting to see what IEF recovers when secure deletion has been selected.