Does anyone know where Google's Gmail leves its 'footprints' (forensically) in the registry hives of Win 2K/XP O/S - Thanks mrgreen
Do webmail sites register anything?
My guess would be under IE.
I also found my gmail address under my google earth settings. But google earth is an installed program.
I searched my registry for my username, gmail, google, my session ID (logged into gmail) and nothing found.
Skip
Having a GMail account itself will not leave anything except cached pages, however if you have the Google Toolbar or the Mail Notifier then that is a different matter.
I installed the mail notifier and monitored the changes to the registry and the only immediate change was to
\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\{0228E555-4F9C-4E35-A3EC-B109A192B4C2}
where it added the data
C\Program Files\Google\Gmail Notifier\gnotify.exe
Hope that's helpful to you.
Nick
You can also be running Regmon from sysinternals as you work in Gmail and check for realtime activity of registry changes.
Regmon can be downloaded from
http//
You can also try diskmon etc…
> Does anyone know where Google's Gmail leves its 'footprints' (forensically) in the registry hives of Win 2K/XP O/S
While accessing GMail itself may leave only limited footprints, the GMail Drive shell extension leaves more
http//
Harlan