Temporary Intertnet Files

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Stamitz 18 years ago

2 Posts

2 Users

0 Reactions

313 Views

RSS

zwzskate

(@zwzskate)

New Member

Joined: 18 years ago

Posts: 1

Topic starter 30/01/2008 9:59 pm

Is there a way to tell if temporary internet files have been deleted by the system or by the user?

Quote

Stamitz

(@stamitz)

Eminent Member

Joined: 18 years ago

Posts: 34

30/01/2008 10:19 pm

Hi zwzskate,

you can use rifiuti (http//www.foundstone.com/us/resources/proddesc/rifiuti.htm) and search for the SID to tell if the files where deleted by the system or deleted by a user. There are a lot of possible temporary internet files, as you probably know, like .jpg, .gif, .html, .php etc. I use photorec to carve for this kind of files. When an important file is found, you have to investigate at what time it has been deleted (in other words moved into the unallocated clusters) and if it can be related to details in the INFO2 file.

Stamitz

ReplyQuote

8 Forums
15.7 K Topics
92.3 K Posts
223 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed