Looking for any expertise out there in identifying images sent through AOL's AIM service with either FTK or EnCase. After conducting a kew word search I found what I am looking for, in text view I can see a "to" and "from" with html header and footers and within the body, image names.jpg. When reconstructed to view in html format I can see the images frames but not the image itself. The text does not show a path to where the image is located. In order to get a federal distribution charge I need to be able to show that the images recived are the images sent from this machine.
they dont giving this infoD i am trying to find also msn and yahoo messenger too.
check this
http//
To determine the download directory for AIM look at this key in your user's NTUSER.dat
Software\America Online\AOL Instant Messenger (TM)\Current Version\Users\[screen name]\Xfer
One of the names within is DirDownload which is the current directory selected for downloading files. Of course it isn't definitive. I would also look at any file with the same name.