Notifications
Clear all
Topic starter
02/10/2009 3:56 pm
Is it possible to find out what was uploaded to an ftp server or a Web server during a forensic analysis. I have a idea a suspect has uploaded some files to a webserver and an FTP server on windows 98 machine. Is there any network log or something in the registry which could tell me when a file was uploaded or would that info even be in the index.dat.
John
02/10/2009 5:15 pm
Depending on how the file was uploaded, you may find indications in the browser history…*if* the browser was used. In most cases, you'd want to check the logs on the server.
02/10/2009 5:31 pm
take a look for log files within ftp directories if its enabled, maybe even httpd logs, event logs… again time frames are useful as they will help you in the investigation.