Finding an image sa...
 
Notifications
Clear all

Finding an image saved after a certain date

1 Posts
1 Users
0 Likes
236 Views
(@francesco)
Posts: 79
Trusted Member
Topic starter
 

Hello,

I'm trying to find an image/video on a computer but
- I only know the date the image/video was taken and the few details needed to recognize it
- I don't know what camera/phone it was taken with
- The machine was used for photo and video editing, it likely contains lots of similar photos so I can't simply recover everything and check each file

So far
- I checked the FTK filelist of the filesystem (nothing)
- I checked the sleuthkit's fls output (nothing)
- I loaded the disk image in Autopsy and gave a look at all the images having EXIF metadata (nothing)
- I checked the content of all ThumbCache* files (nothing)

Now
- I'm trying to run photorec (MOV + BMP + JPG) but it runs for a while and then crashes returning to the prompt
- I've used SFDump in the meanwhile (however no videos, I think I'll use foremost for those) and I'm thinking about grouping images by EXIF/lack-of-EXIF, then common camera resolutions.
- The system had Win7 on it (shadow copies likely on) so I'm planning to redoing all the filelist checks on all the snapshots. Then I'm planning to check the thumbnails file.

Unfortunately this is my first case with photos/videos. The machine was already checked so I was told to check if I can find the exact files or otherwise just recover everything with photorec (ouch!).

Am I doing it properly? Or does anybody have suggestions for a different approach/workflow, or simply an alternative to photorec (recovery with file validation) that I could try?

 
Posted : 30/09/2014 2:36 am
Share: