Hi all,
Thank you all for the Skype support. It all worked out and the tools were very helpful.
I now have a Gambling investigation where the suspects used a laptop to put bets in from overseas and print up slips for their customers.
Is there anywhere in particular i should be concentrating on in recovering the printer spool and any particular sites or servers they were linked to place the bets?
Thank you
Is there anywhere in particular i should be concentrating on in recovering the printer spool and any particular sites or servers they were linked to place the bets?
Lahamt,
I may have mis-read your request, however, dependant on OS and version (you’ve not mentioned what’s in use), in Windows XP (which is predominantly what we get in), they “apparently” live in \system32\spool\printers. You might also find SHD file that tells you which printer used which may come in handy for you.
I say “apparently”, as I have never had much luck in tracking down printer spools on NTFS file systems, but others may have some pointers for you.
As for the latter part of your query, are you asking for gambling Websites they accessed? Tracking the suspects Web Access? Again, you have not mentioned what OS, Web Browser is in use here. Assuming they used IE on Windows, and making some assumptions on current version of both the aforementioned, these areas may be of interest to you
•C\Documents and Settings\<username>\Cookies\index.dat
•C\Documents and Settings\<username>\Local Settings\History\History.IE5\index.dat
•C\Documents and Settings\<username>\Local Settings\Temporary Internet Files\Content.IE5\index.dat
•C\Documents and Settings\<username>\UserData\index.dat
I can suggest a tool called Pasco to help with this analysis, others may use something different.
There is a thread about print spoolers, right here
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=5565
jaclaz
Thank you. I check printer spools, also the OS is Vista. I believe the person on the computer was using a program (ICA Client) from Citrix. I can't find any logs or other items that point to the gambling. First time I've ever seen this. I also tried starting a virtual machine, but was unsucessful. It's a mystery to me.
Depending on the printer used, if it was a printer/copy machine, that could actually be the source of printed documents
http//
Lahamt, the question is whether you have access to the printer(s) where the subject allegedly printed those documents.
Newer OS' (XP onward) are much more efficient in handling the print spool than they used to be. The odds of you finding spool files is very slim.