Join Us!

Recycle Bin identif...
 
Notifications
Clear all

Recycle Bin identifier and Owner ID SID's  

  RSS
DaDataCop
(@dadatacop)
New Member

I'm looking for peer validation on this to ensure I'm correct in my thinking.

I have a case where incriminating evidence (7 videos and a folder) were found on an external HDD in one of 7 Recylcer/Recylce.Bin folders. The Recycle.Bin Folder and Path identify the SID related to the account, so I am confident that the Recycle.Bin I matched up to a specific User's SID deleted the incriminating files.

Where I am getting caught up is in a Different SID for the individual files that is different from any of the known computers in the case under the "Owner ID". My understanding is that the Owner ID is the SID for the user who created the file. However, the files would have had to have been on the computer with the SID in the Recycle.bin path in order to have been deleted from that user profile. Is that a correct conclusion?

If this isn't clear, let me know and I'll try to clarify more. Thanks in advance all. Appreciate the help.

APT

Quote
Posted : 02/02/2017 4:21 am
Share: