Locating Screen Saver Log file
I am working on a case that involves someone using My Picture Slideshow that is buit into XP to display pics of CP. The pictures have been deleted and have been overwritten. Does anyone know if windows keeps a log file of what was placed into this screen saver or is there a place in the registry that this info may be located. The file name is ssmypics.scr. I am using FTK for forensics. Any help would be appreciated.
Just a quick note to say welcome to the Forensic Focus forums.
I believe the registry will only contain a pointer to the .scr file in the system32 folder. If the pics have been deleted and overwritten there is always the possibility of pulling some info out of the hidden file thumbs.db (in the folder that would have contained the pics in the first place). This is by default the My Pictures folder when using ssmypics.scr This will not recoup the picture but may be able to provide some valuable information even if the pictures are no longer present.
Keep in mind that the thumbs.db file will only be there if the user selected the thumbnail view as his option in the particular folder that the pics were in.
I have never tried this myself and am not 100% sure what info you will get (names, deletions, modification times..?). You will need some third party software to accomplish this howeverâ€¦
Thumbs.db files have been disgussed before.
I believe the registry will only contain a pointer to the .scr file in the system32 folder.
The HKEY_USER hive will contain the "pointer" you're refering to…
The key of interest is HKEY_USER\<SID>\Control Panel\Desktop
The value is SCRNSAVE.EXE. The data in this value will point to the .scr file used, regardless of location. The key also contains other values that refer to various screensave (and desktop) settings.
The LastWrite time of the key will tell you when the contents of the key were last modified. However, it will not tell you which value was modified last.