Temporary Intertnet Files

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Stamitz 19 years ago

2 Posts

2 Users

0 Reactions

568 Views

RSS

zwzskate

(@zwzskate)

New Member

Joined: 19 years ago

Posts: 1

Topic starter 30/01/2008 9:59 pm [#2217]

Is there a way to tell if temporary internet files have been deleted by the system or by the user?

Quote

Stamitz

(@stamitz)

Eminent Member

Joined: 19 years ago

Posts: 34

30/01/2008 10:19 pm

Hi zwzskate,

you can use rifiuti (http//www.foundstone.com/us/resources/proddesc/rifiuti.htm) and search for the SID to tell if the files where deleted by the system or deleted by a user. There are a lot of possible temporary internet files, as you probably know, like .jpg, .gif, .html, .php etc. I use photorec to carve for this kind of files. When an important file is found, you have to investigate at what time it has been deleted (in other words moved into the unallocated clusters) and if it can be related to details in the INFO2 file.

Stamitz

ReplyQuote