Windows 2K/XP regis...
 
Notifications
Clear all

Windows 2K/XP registry 'Footprints' for Gmail

5 Posts
5 Users
0 Likes
411 Views
Webbie
(@webbie)
Posts: 29
Eminent Member
Topic starter
 

Does anyone know where Google's Gmail leves its 'footprints' (forensically) in the registry hives of Win 2K/XP O/S - Thanks mrgreen

 
Posted : 10/01/2006 8:01 pm
skip
 skip
(@skip)
Posts: 57
Trusted Member
 

Do webmail sites register anything?
My guess would be under IE.

I also found my gmail address under my google earth settings. But google earth is an installed program.

I searched my registry for my username, gmail, google, my session ID (logged into gmail) and nothing found.

Skip

 
Posted : 10/01/2006 9:37 pm
nickfx
(@nickfx)
Posts: 131
Estimable Member
 

Having a GMail account itself will not leave anything except cached pages, however if you have the Google Toolbar or the Mail Notifier then that is a different matter.

I installed the mail notifier and monitored the changes to the registry and the only immediate change was to

\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\{0228E555-4F9C-4E35-A3EC-B109A192B4C2}

where it added the data

C\Program Files\Google\Gmail Notifier\gnotify.exe

Hope that's helpful to you.

Nick

 
Posted : 10/01/2006 9:54 pm
arashiryu
(@arashiryu)
Posts: 122
Estimable Member
 

You can also be running Regmon from sysinternals as you work in Gmail and check for realtime activity of registry changes.

Regmon can be downloaded from

http//www.sysinternals.com/Utilities/Regmon.html

You can also try diskmon etc…

 
Posted : 10/01/2006 10:43 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

> Does anyone know where Google's Gmail leves its 'footprints' (forensically) in the registry hives of Win 2K/XP O/S

While accessing GMail itself may leave only limited footprints, the GMail Drive shell extension leaves more

http//windowsir.blogspot.com/2005/04/gmail-drive-footprints.html

Harlan

 
Posted : 11/01/2006 1:13 am
Share: