I have a situation, where in a Laptop is in my custody.
It is suspected that some site are visited using that laptop. My job is to find out if the sites were visited from my office n/w or personal/home n/w
For this obviously i though i can do time line analysis… but the problem is that the machine is reformatted and i have recovered the index.dat files but timestamps for site/internet usage is not there….
Please let me know your ideas for this kind of investigation..
Have you tired NetAnalysis and HstEX?
Not saying just throw a tool at it but very good combo form carving and parsing. Do however take the time to read about the index.dat file structure on Craig's site so you know what the tool is actually doing with the data.
http//wordpress.bladeforensics.com/
Thanks for the pointer i'll definitely read and get back to you if i have any questions )
You can try the tool from X-Ways stable called Trace, demo available http//