Not too long ago i posted a topic about evidence of files being printed and the locations of this evidence.
In this topic i mentioned that i was going to image a HDD from a machine which was a photocopier/scanner/ printer all in one.
To be precise this was a Ricoh Aficio 1224c with a 40GB HDD.
Well, i now possess that image and have imported it into FTK.
When i click the Explore tab, i can navigate as far as the following
Case > Disk1 > NONAME-Unknown > DriveFreeSpace0032
In the Overview tab, FTK reports the following about the drive
Total File Items 3054
Unchecked Items 3054
Filtered Out 3054
Slack/Free Space 3053
When i click "Total File Items" all are reported as being in DriveFreeSpace.
I can view their contents in Hex/ASCII but no readable format.
I am looking for advice on what you make of this / what i can do to get information from this drive?
My priority is to locate word documents that may be on the HDD through printing.
Thanks
I'm guessing maybe its a custom file system that FTK maybe can't interpret?
This is only guesswork, but when you print/scan/copy to it, its not going to save documents locally in MS Word format.
What format would you suggest it saves them in? I was hoping for maybe still image files…
Again, a custom format. When they designed it i'm sure they didn't have this situation in mind.
Perhaps if they do store the scanned documents as image files (tiff) for example, you could search for the file header within the slack space on the drive. perhaps you can recover something that way?
OK i'll give that a try.
0000000200 begins 08 8c and this value seems to be repeated a lot..
is this a clue at all…
I've not had the opportunity to examine a neetwork printer drive so I'm making a best guess here. I'd look for something more resembling print spooler files. The space is generally used to store print images so I'd expect font and formatting codes and probably very little ASCII. I'd also expect the file format to be based on a Linux file system since many devices use Linux as the core OS. I'd start researching the printer drivers associated with the printer connected to it and the fax. That'll tell more as to what to expect.
I also wouldn't expect to see many print jobs as when a job clears the queue, the printer should overwrite the space occupied by the privious job.
The only multiple print images I'd expect would be from when there were multiple print jobs queued.
OK thanks, this is gonna b a challenge for me i've never had to do this before.
Anyone know any good sites with a list of all file headers in hex?
cheers
Anyone know any good sites with a list of all file headers in hex?
Why, yes I do! See
-AWT
You might ring up
Zoran Corporation, gak follows..
Zoran Corporation, based in Sunnyvale, California, is a leading provider of digital solutions-on-a-chip for applications in the growing consumer electronics markets.
They are listed as the imbedded OS for that copier-printer.
http//
" The IPS XPS from Zoran provides compatibility with Microsoft's XPS Document … Vista and can be created and viewed on multiple operating system platforms "
" The XPS Document format is a paginated representation of electronic paper described in an XML-based format. The XPS Document format is an open, cross-platform document format that allows customers to effortlessly create, share, print and archive paginated documents. This format supports a powerful imaging model that enables end-users to create graphics-rich documents that can be shared and viewed on many platforms "
http//
I'm guessing the Richo Aficio 1224c uses the IPS XPS document interpreter from Zoran, although there is information on others from the link above.
If this is the case how would i find hex signatures from it on the HDD?
If the XPS document format is described in an XML based format, i'd better start looking for XML signatures?…..