I did not find an encrypted volume yet. I am a fairly new investigator and am unsure how to go about locating an encrypted volume. The suspect has two hard drives each with a default directory structure under his name that was set up by win7 and therein is where I located the installed programs. A view of most of the folders in these directories shows data that appears to be encrypted it is not legible in the hex/ascii view pane. I have a list of IP addresses and a credit card number that was used and have created a specific keywords search for them in Encase. Results are pending. The areas I am running the search in are unallocated, pagefile.sys and hiberfile.sys. In a perfect world I would like to find the IP addresses and credit card numbers associated to these hard drives on the dates and times the fraudulent orders were made. If a program like proxifier was used I am guessing that the IP address may be in the pagefile.sys. The size of the pagefile.sys is about 17GB so I am hopeful.
Thanks for the help thus far.
I am new to the investigator field also but this list of file signatures help me find an encrypted program when I compared the HEX values to ones listed on the list. Hope it helps, if not it may be a good reference.
http//
eddtta
2) If the formhistory.sqlite file stored the values entered when filling out on-line forms why did it not capture the credit card numbers as well?
Could it be that information was deleted from this file the history cleaner (I see the reference to CCleaner in your original posting)? If this is the case, some traces of deleted data (or entire records) can be found in so-called "freelists". You can try dealing with that with our tool, Belkasoft Evidence Center (link in my signature).
Thank for all of your replies. I decided to just supply the investigator with what I had to this point and have pretty much closed my investigation unless the lead investigator needs more. I have received many more cases since this one and all present their own unique problems. Thanks for this forum and those who are willing to share knowledge.