Images downloaded from the WWW

Rickeh,

I have some input into this, but rather than writing a tome, could you give me an overview of what testing you've done yourself already, and what your findings have been?

Thanks,

H. Carvey
"Windows Forensics and Incident Recovery"
http//www.windows-ir.com
http//windowsir.blogspot.com

All I have found out is that when you copy an image which contains a hyperlink to a word document (e.g. the image for Forensic Focus (logo.gif)). It is retained and points to where ever the hyperlink orginally intends to go. But this does not really prove that this .gif image came from forensic focus.com because all it does is point to a specific place.

Another point is when formatting an image under 'format picture' and then 'Web' text can be written here for alternative use when the image is being loaded in a browser. For example in this case if the image logo.gif is loading/missing the text forensic focus is displayed by default.

Any ideas?

Any ideas?

Not really…I'm not really sure what it is you're asking.

For example, you say

All I have found out is that when you copy an image which contains a hyperlink to a word document (e.g. the image for Forensic Focus (logo.gif)). It is retained and points to where ever the hyperlink orginally intends to go. But this does not really prove that this .gif image came from forensic focus.com because all it does is point to a specific place.

That makes sense…when you put a hyperlink to an image in a Word document (I do this all the time with references and footnotes), you simply have a hyperlink, and nothing else.

But I have no idea what that has to do with your original question

Is there any way of discovering where exactly from the WWW the original image orignated from if it's simply copied and pasted say into a word document?

So from what you're telling me, you haven't done any testing at all of this…go to ForensicFocus.com, copy an image from the page, and then paste the image into the Word document.

Since this was your original question, why don't you do some testing to see what happens, what's left behind. If someone puts a hyperlink to an image on the web into a Word document, I think it's pretty clear to everyone what happens…you get a hyperlink. But that wasn't what you were talking about in your original post, it appears.

I would like to help, as I think that this is potentially a very interesting question. However, it would really help if you could be a bit more clear about what it is your asking. I also think it would help if you could detail what it is you've done already to try and discover the solution to your question(s).

Thanks,

H. Carvey
"Windows Forensics and Incident Recovery"
www.windows-ir.com
windowsir.blogspot.com

Thats all i could think of. I don't think it is possible to retrace someones steps from copying and pasting an image from the WWW, to a word document to determine where the original image came from. Unless there is a log in the registry perhaps? I know there is a reference in the registry for typed URL's. But I don't know if there is somekind of paste log (registry?) which shows the user copying and pasting from a specific web site and contains the image name and originating website.

As you can see this is all theory at the moment. I'm just tyring to have a good think about it, I don't really know if i'm making sense as I have no forensic experience (computer or otherwise)
Thanks for the comments though and any more are very welcome,
-Rick

I don't think it is possible to retrace someones steps from copying and pasting an image from the WWW, to a word document to determine where the original image came from. Unless there is a log in the registry perhaps?

Again, I ask the question…what testing have you done? Have installed/run any monitoring tools, and done what you're asking about? This is actually pretty easy to test. For example, you asked the question about some kind of paste log in the Registry…run Regmon from Sysinternals.com while pasting an image from the web, and see what you find.

H. Carvey
"Windows Forensics and Incident Recovery"
www.windows-ir.com
windowsir.blogspot.com

Is the Word document being created on the same machine that is being used to view the web site containing the image?

Examination of the temporary internet cache may reveal the image, together with internet history of the url it came from. Time line analysis may show the creation time of that image and the word document correlate. How about an md5 of the image in the word document and compare it with with that found in the cache.