Well articulated "Chris_Ed"
Not having all the specifics of the scene, have you considered that the suspect computer your examining was used purely as a pass through modem, in that some other device was connecting through it to the internet.
Some ideas and hints on this
- joakims already mentioned the NTFS evidence sources- no evidence there?
- i would check for all autorun locations, perhaps some kind of cleaning script?
- is there a hibernation file?
- there are so called hidden TrueCrypt volumes. Did you search for them?
BriMor Labs has a nice blog post about it
- when MAC was changed, you can find evidence on the DHCP server perhaps? My Wifi SOHO router is acting as DHCP at home and has a full history of IP + MAC adresses
- did you check the Windows Event Logs?
- i would check the Performance Logs, too
and last but not least any existing Windows Memory dump file or Error reporting archive? Even if you do not find a full memory dump, you might find the name and path of a crashed application.
Good hunting!
Robin
Significant suspicions of what, exactly?
Significant suspicions of acting in such a way to raise the possibility to infer significant suspicions, of course. wink
Next step being of course wider use of precogs 😯 .
And now, only seemingly OT, some previous questionable use of "significant"
http//www.edwardtufte.com/bboard/q-and-a-fetch-msg?msg_id=0001yBThe vigorous, vaguely quantitative, words “significant” and “significantly” are used 5 times on this slide, with meaning ranging from “detectable in a perhaps irrelevant calibration case study” to “an amount of damage so that everyone dies” to “a difference of 640-fold.” None of the 5 “significants” refer to “statistical significance;” such wordplay may suggest that a formal statistical analysis has been done.
@wotsits
Wait until you find a smart guy with no hard disk and booting from a CD/DVD to a ramdisk …
… now that would be really suspicious…jaclaz
What would the approach be in the scenario @jaclaz mentions? would it even be possible to prove such a set up had even happened?
Not sure if it's entirely relevant any more, as the thread is so old, but ... in this case I would be interested in:
How does the system boot? Is this 'empty' Windows environment at the top of the boot list, or is just what gets booted if no of five other boot alternative works?
Is PXE booting on the boot-order list? Does the system allow PXE booting from user-selected boot key, or only from the boot-order list? (that is, can the user select PXE with some F8-like boot option key?)
Does BIOS/UEF/etc. allow for MAC address reconfiguration? Or is something more heavyweight required for that?
If the laptop was used by a technician as a tool in an environment where PXE booting (or similar technical solution) was used, I'd expect something like this kind of set-up. Boot priority list would be at least a) PXE boot, b) local Windows or other environment where MAC address could be changed easily for testing and troubleshooting of PXE boot code delivery.
And in such environment, DHCP and PXE server logs would probably be the first things to check, followed by a check of what the booted environment actually is. (It might still exist on a SAN somewhere.)