Missing person, google searches might help

First off, can I just say im not a forensics specialist, but given the cirumstances of this post I thought I could possibly give something to help your situation.

The pro's here will correct me if I am wrong, but all because history is deleted, doesn't neccessary mean that all of his cookies and login sessions were.

If the user of the computer, in this case, the missing person, had an account with Google - he would have had his history stored by Google Web History .
If the user is still logged in to the computer, and his session hasn't expired, you can use that tool to view everything that was typed into Google.

You could also try using a tool called IndexDatSpy, which scans the system's index.dat files. You can click on one to view what was accessed on the internet.

Hope this helps,
DeWire

I can't speak to the Google issues, but it would seem that one could always file a missing persons report. From what you mentioned you won't be getting an Amber Alert issued, but it would still get a report on file.

Does he have a Facebook account or does he regularly check another social media site? Did he have a bank account? Did he leave town and if so could he have taken a bus? I take my phone everywhere I go, so it would seem reasonable that if he left his phone, which I'm sure he knows could be tracked, he doesn't want to be found.

I would want to look at the entire browser history and not just the Google searches?

Good luck!

NetAnalysis is a good tool; so is Internet Evidence Finder. And there are data recovery tools which could help, as well.

But your friend should ask himself how much "time is of the essence?" In the time that it would take he and you to research this to the point where you could assure yourselves that you have done everthing that you could, the trail could grow cold.

Also, he took his Mac which means that he likely wants some way to stay in touch with somebody. A good investigator could quickly identify all recoverable e-mail addresses/aliases as well peer to peer and social web accounts including possible contacts where he might be staying or with whom he might be in touch.

Again, do you have the time to learn this or does it make more sense to hire a professional and what may be lost by the delay?

Finally, how did he pay for such things as e-mail accounts, Internet access, etc.? You may be able to get some ideas from billing records, etc.

This is as much about good detective work as it is about forensics. You should consider involving professionals.

Thank you all for your comments,
we already checked all the social websites that he might have been related to. But any useful information. There must be someone out of the known circle of friends involved.

I spent several hours yesterday going to each of the websites clicked (obtained with NetAnalysys) nothing useful. I agree with you Sam, by the time we found something useful it might be not useful information anymore.

Getting support from a forensics professional is the best way to go. But I have the recovery image already , I knew the person and maybe I could find something. Time is the key. I think also he doesn't want to be found. But being a parent is difficult to accept this.

Having forensics skills might be crucial in a situation like this. I have spent hours reading in this forum, I might not be able to find what I am looking for but at least I want to keep trying.

Thanks

I realize that you are doing this investigation for someone else but, in cases like these, the digital evidence may be unhelpful or even misleading (think Chandra Levy). If the kid left home on his own then there is clearly an issue between he and the parent(s) and it is that issue which must be addressed.

As I said, before, this case requires good detective work and that means interviewing friends, classmates, co-workers (if any), etc. It is unlikely that no one knows anything though some people may be willing to lie for him if they perceive that the parent is the cause of the problem.

The personal approach, talking to people whom he may trust, will be a more visible means of expressing concern and, ultimately, getting support than digging into the computer.

In addition, if it is true that he doesn't want to be found, then convincing him that he should reconsider is essential.

You haven't said what steps the parent is taking but, were I he, I would be spending my time trying to establish a better rapport with those who are likely to know someone, especially if there is no hope of involving law enforcement.

By all means, continue your investigation but make sure that the parent has other baskets to hold the rest of his eggs.

Sean ,
I am retrieving a lot of info with Internet Evidence Finder,
but I am not 100% sure if it is retrieving the information even though the web-browsing history was deleted.

I just wanted to know if the deleted webbrowsing history is recovered as well with this product.

thanks.

Kids today use Facebook quite extensively to keep in touch with friends.

Have you searched for facebook chat in unallocated space? This would be a good starting point.

I just wanted to know if the deleted webbrowsing history is recovered as well with this product.

IEF will recover artefacts from unallocated space, but remember that you may get duplicate artefacts representing the same actual event.