Notifications
Clear all

"Orphaned" Files in Windows 10 Pro

2 Posts
2 Users
0 Reactions
2,998 Views
UnallocatedClusters
(@unallocatedclusters)
Honorable Member
Joined: 13 years ago
Posts: 576
Topic starter  

Distinguished Colleagues

First, I used Guymager v. 0.7.3-2 within DeftZero to create a forensic image (*.E01) of an HP laptop running Windows 10 Pro ("Laptop").

I then used GetData's Forensic Explorer v. 3.9.8.6626 (64 Bit) to create a forensic database of the Laptop.

Forensic Explorer has identified around 6,000 files in the following location LT001_Sue_Smith.E01\Partition @ 927223808\Orphaned\………

I have done some research to identify what causes files to become "Orphaned" files and the concensus seems to be that uninstalling a program will cause files associated with the now uninstalled program to become "Orphaned" files.

QUESTIONS

1. Is it correct to assume that files found in the \Orphaned\ file path are NOT the result of an end user deleting the files now found in the \Orphaned\ file path?

My understanding is that end-user deleted files will appear in the associated Windows SID recycle bin.

2. Do other forensic tools such as EnCase or X-Ways also identify "Orphaned" files as appearing in the same type of address and path such as "\Partition @ 927223808\Orphaned\"??

I am seeing Word, Excel and other office type files in the \Orphaned\ path, which confuses me; I would expect to see deleted user generated office type files in the Recycle Bin.

To the extent I am seeing user generated Office type files in the \Orphaned\ path, should I be looking for evidence of, for example, Microsoft Office being uninstalled (and thus causing the office type files to now become "Orphaned" files)???

Many thanks in advance.

Larry


   
Quote
tracedf
(@tracedf)
Estimable Member
Joined: 10 years ago
Posts: 169
 

I think the definition you got is for a different type of orphan. Yes, one type is a file that belongs to an application that is no longer installed (e.g. a DLL file that was left behind). The other type is a file whose parent folder was deleted and whose MFT entry was reused. The child file still points to the parent's MFT record but that record has been reused for another file/folder so we can no longer tell what folder it belonged to.

Check out this paper from AccessData

https://support.accessdata.com/hc/en-us/article_attachments/201859217/wp.NT_Orphan_Files.en_us.pdf

Edit Corrected my orphan description for accuracy.


   
ReplyQuote
Share: