It would be interesting to be able to perform live forensic on a copier…
It would be interesting to be able to perform live forensic on a copier…
If you do, don't forget to wear sunglasses 8) those lamps can be really bright lol
Paul
It would be interesting to be able to perform live forensic on a copier…
How long has it been since many network devices come with a web interface? * years maybe.
1. Most of these multifunction devices have port 80 active.
2. You can access the interface unless it has been disabled.
3. Most of the times, I run into these multifunction devices with no administrative password.
4. You can change the configuration of the device if no password, or depending on the model and default settings, view the last several documents printed.
It wouldn't be "live forensics" but I can tell you from experience that you can view some of the documents printed using the web interface to the multifunction device.
* years was supposed to mean "8 years".
The other thing I should add is that these days, some of those devices (again, depends on the manufacturer and model) come with good functionality and settings that enable the device to purge documents after certain time, or to even not store any documents at all.
That functionality is great because it doesn't require that you use a security kit or encryption. Unfortunately, that same functionality seems to be too much of an administrative task for IT departments.
This falls more on the realm of IT security, but it may be something you are not aware of.
Thanks for the detailed info, saves a lot of work. These MFPs have become a hot item for our organization as well.
Thanks for the detailed info, saves a lot of work. These MFPs have become a hot item for our organization as well.
I call them MESD - that is multi edge sword devices, as an analogy to double edge swords. It happens that I was taking a look at one of these devices where a suspect was printing, and found out you can also use some of these devices to conduct some type of electronic surveillance.
In some models you can set the device to store all print jobs by user name. Isn't that great? Obviously, this applies when you believe somebody is a suspect; why bother with the print spool in these situations.
Just wanted to let you guys know that I've been able to recover images from a Ricoh multi function device. Here is what I did
1- Created a DD image of the hard drive.
2- Swapped all the bytes in the image file.
3- Added the swapped image in FTK 3.
4- Performed data carving on the unallocated space (the whole drive was unallocated space).
5- Recovered 98 images.
Voilà!
I just imaged our Toshiba E studio 550. It had a 40gb IDE drive with a whopping 26 partitions!
Each partition was formatted either FAT16 or FAT32 and there was some unpartitioned space. Partitions 2,3, & 4 are invisible or non-existent as they didn't show up. I used FTK imager to image and FTK 1.8 to analyze.
Each partition contained a list of folders which vary depending on the
partition. The common theme was every partition has a folder named "root".
Folders named cpy004, scn0018, emailTA, etc. appeared to be easy pickings, but were empty or had files named in a odd format such as pr001.001. These odd files were not very large, mainly around 400kb.
However in partition 15, the folder structure of root/smb/scan yielded deleted PDFs. These were easily read and exported. Here is where I found pay stubs, vacation confirmations, and other personal information.
I was expecting to find a lot more of this information all over the drive, but it was localized in that one scan folder.
Interestingly, many of the copy, scan, and email folders showed as deleted. I don't know what process deleted these and am looking for documentation to find out what security features this machine has.
Hope this helps,
Thanks!
Just wanted to let you guys know that I've been able to recover images from a Ricoh multi function device. Here is what I did
1- Created a DD image of the hard drive.
2- Swapped all the bytes in the image file.
3- Added the swapped image in FTK 3.
4- Performed data carving on the unallocated space (the whole drive was unallocated space).
5- Recovered 98 images.Voilà!
I know this is a question on an old post, but I was wondering how you "swapped all the bytes in the image file"? What did you use to swap them (i.e. hex editor, other program)? Could you please provide the details of your procedures? I am conducting some research on this topic and was intrigued by this forum. Thanks.