General strategy and concerns so far

cosmicnet · 2010-05-05T20:11:08Z

Hi All, I've had a bit of a play now with FTK (v 1.5 build 4). A few things occur to me I assume like many of you, being into computers means you end up helping out friends when they have computer problems. This can be anything from installing a virus checker, to taking out their hd, putting it into one of my machines, backing things up, re-installing, etc. I read a post on here about a computer repair guy getting arrested and I've suddenly started to feel paranoid. Do you guys have a procedure for helping people? Such to ensure you don't end up left with potential nasties that might be on their disks?? Or do you always check friends disks before you fix them? I'm assuming that any backups you've made of peoples stuff should be thoroughly shredded off your own disks once you've given them back. But as I understand it things you've opened would go into your ram, which could swap out to disk, so your computers main disk can contain things you are unaware of??? Frightening stuff, I guess it's best not to over think this? Or is paranoia the best policy when dealing with computer forensics? So far I've just been poking about with an image I've taken of an old disk. For some reason FTK (the version I have at least) doesn't like java much and takes ages to process the various jars and classes, so I've excluded these from the case. The thumbnail viewer seemed mostly filled of little icons, so I filtered out 0 - 5kb files. I tried a live search but that takes ages.This is the general strategy I have so far-1. Reduce evidence as much as possible to speed things up.2. Ignore small image files3. Ignore java files4. Only live search if you find something suspiciousAs for searching, FTK has an import, but no predefined word lists which seemed a little odd to me. Seen as I'm not searching for anything specific I'm assuming the process is first a general word list followed by specific lists based on what the general one brings up. I've searched on here for word lists and only found people talking about them and not wanting to post theirs. I thought there would be standard lists of sorts, am I missing something?Also, is there a moral issue if I check some backups from friends computers? Do you guys see this as a big no-no, or as your duty as forensics? Do I really want to know if there is anything there or should I just wipe it?As for wiping files/disk/slack/free space, if there a defacto standard bit of software (preferably free) that you all use?Ooops, that got a little long. Sorry for all the questions, I have been searching and reading posts to try to answer most my questions.Lyle

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by markg43 15 years ago

11 Posts

5 Users

0 Reactions

1,168 Views

RSS

markg43

(@markg43)

Trusted Member

Joined: 18 years ago

Posts: 77

11/05/2010 3:40 am

That's in a perfect world, in the real world, as a day in and day out forensic examiner - most of my cases do not require me to start examining the data blocks in hex. Generally, I stick with logical files and also some unallocated space searches if I do not find enough for conviction in logical files.

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
228 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed