Hey Guys and gals.
I have a new case to work on as part of my self directed learning.
I have a Hard disk, which was a cloned image from a clients PC.
The clients PC was used as a family PC and occasionaly a member of the family connected their BlackBerry PDA.
Not knowing the model or make of the BlackBerry - is there a chance data could be held on the Hard Disk, even though I cannot prove or disprove the Device had actually sync'd
I have looked at the registry and as of yet havent found any relavent entries - using EnCase4.
Could anyone suggest
1- Where to look on the disk for data (compressed or not?)
Key word seraches produced no significant results, using FTK or EnCase
2 - Where in the registry would you look?
Cheers again.
iconSerf
Hi,
Take a look in the System registry (assuming you are looking at a 2000/XP machine) at the appropriate control set\Enum\USB\. There should be a list of USB devices that have been used in the system that you will need to look through one by one. Hopefully, if a blackberry has been used in the system it will be listed here.
Sam
Hey Sam,
Thanks for the advice, however I have looked through these, and it doesnt appear to state BlackBerry, or anything of relavence, any suggestions?
Cheers,