Autopsy, Windows Image and yet no results... 🙁

banderas20 · 2019-04-24T09:39:32Z

Hello,I'm new to forensics and I'm performing some tests with Autopsy and a Windows dump image.It's a challenge. I am supposed to find relevant info. That's what I have found so far- $Logfile, $MFT and orphaned files.- 2 JPG images.- 2 txt files with the same name. One of them deleted and the other undeleted. Both with a size of 0 bytes and empty.- A MS Word document password protected.I have analyzed all the metadata, and the hex content of every file, but I can't find a clue. I have also digged into the images to see if there is any message hidden in them.I think that maybe the text that once existed in the txts might help, but I am not able to recover it.The data HAS to be somewhere, as it's a challenge. But I am lost. ¿Can you point me somewhere or shed some light on this?Many thanks in advance!

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by watcher 7 years ago

12 Posts

3 Users

0 Reactions

5,387 Views

RSS

banderas20

(@banderas20)

Eminent Member

Joined: 8 years ago

Posts: 29

Topic starter 02/07/2019 4:16 am

Well. The jpg image didn't contain anything at all. I think it was a maneuvre to distract (as far as I know).

Regarding the other files, I think the issue had to do with some assembler code/trojan embedded into some executable files, according to the alarm given by many antiviruses.

Nothing very clear, for what you can see.

Many thanks!

ReplyQuote