The information from link file

What if \_s is mapped to S?

Suggestion perhaps decode it with this tool and see if there's consistency and see if it decodes more information http//code.google.com/p/lnk-parser/ Can you share the decoded version of the shortcut file?

What if \_s is mapped to S?

Suggestion perhaps decode it with this tool and see if there's consistency and see if it decodes more information http//code.google.com/p/lnk-parser/ Can you share the decoded version of the shortcut file?

Thanks, but is that not enough to use EnCase to parse the link file? And I think maybe I can check the USB connection information in Registry, then cross-check with the information from EnCase.

Is EnCase enough? That's a judgment call for you to make. Personally, when I run across results that are either ambiguous or central to the case, I use another tool for validation. Thought I would do you a favor and suggest one.

Hi, all,

I am using EnCase v6 to check if someone copied suspect file to external drives, the system disk is "C" and that's only HDD volume. One suspect link file in "Recent" folder indicated it was opened from "S" disk, but the problem is the serial number of "S" is as same as "C", why that occurs?

The original storage path of suspect file is under C\_S\xxx.ppt.

Thanks

A couple of thoughts/questions

First, what is the version of Windows that you're analyzing? This is very important, for a plethora of reasons.

Second, when you say, "..the serial number of "S" is as same as "C"", what are you referring to specifically? What value, and where did you retrieve the value?

Third, have you performed any USB device analysis on the system? Part of this may include finding that the S\ volume isn't a USB external device at all, but instead a mapped network drive.

Thanks, I think the 3rd point is the key point. Appreciate your ideas.

Or good old SUBST…

Indeed, what about venerable SUBST?!

I should have thought of that one (for reasons that aren't particularly important to anyone but me and Digital Research/Novell/Caldera).