Deleted registry hi...
 
Notifications
Clear all

Deleted registry hives  

  RSS
nightworker
(@nightworker)
Active Member

This case it manager who cloned company hard drive is this evidence support my opinions?
What i sould understrand from this case

Quote
Posted : 05/06/2015 2:34 pm
jaclaz
(@jaclaz)
Community Legend

This case it manager who cloned company hard drive is this evidence support my opinions?

I guess it depends on WHAT exactly are your opinions. ?

Those entries are connected with Optional Packages of a PE 4.x/5.x
https://technet.microsoft.com/en-us/library/hh824926.aspx

Which may mean that on that machine the Windows 8/8.1 ADK has been installed or downloaded, but not much more.

jaclaz

ReplyQuote
Posted : 05/06/2015 4:03 pm
nightworker
(@nightworker)
Active Member

thanks to feedback

ReplyQuote
Posted : 05/06/2015 5:12 pm
EricZimmerman
(@ericzimmerman)
Active Member

what program did you use to recover those? =)

ReplyQuote
Posted : 08/06/2015 8:32 pm
EricZimmerman
(@ericzimmerman)
Active Member

also those arent deleted hives, they are deleted KEYS.

ReplyQuote
Posted : 08/06/2015 8:32 pm
Belkasoft
(@belkasoft)
Active Member

To look for registy files, including deleted and badly damaged ones, you can use Belkasoft Evidence Center (http//belkasoft.com/ec). You can also use built-in carving tool to recover the data.
Here is a short video tutorial on how to do it, and what can be found
https://www.youtube.com/watch?v=WnmQ-_42IYQ

ReplyQuote
Posted : 15/06/2015 9:19 pm
twjolson
(@twjolson)
Active Member

also those arent deleted hives, they are deleted KEYS.

Well, sure, if you want to get all technical…

ReplyQuote
Posted : 15/06/2015 9:36 pm
UnallocatedClusters
(@unallocatedclusters)
Senior Member

Nightworker,

You said "This case it manager who cloned company hard drive is this evidence support my opinions? What i sould understrand from this case"

Do you mean, "I am analyzing a forensic image of a computer of a former IT manager to determine if IT manager created a copy of the computer, possibly using some version of WindowsPE/FE to do it, before leaving the organization."?

ReplyQuote
Posted : 16/06/2015 1:11 am
EricZimmerman
(@ericzimmerman)
Active Member

This is forensics. our world is technical =)

ReplyQuote
Posted : 16/06/2015 2:33 am
Share: