Tracking history of a file

As this is an NTFS volume, you could try extracting $LogFile and parse it with; https://github.com/jschicht/LogFileParser

You could also check if there are volume shadow copies there, or if $UsnJrnl is active too. Both which would likely bring more nice details into the analysis.

Can you please provide some guidance on extracting the LogFile and checking for USNJrnl? I don't know anything about these.

Thanks

Can you please provide some guidance on extracting the LogFile and checking for USNJrnl? I don't know anything about these.

Thanks

Open the image file with FTK imager.
The $logfile is in the [root] folder and the $USNJrnl in the $Extend 'sub-folder'. Right click on each one and select 'Export Files'.

Can you please provide some guidance on extracting the LogFile and checking for USNJrnl? I don't know anything about these.

Thanks

My opinion this questions goes beyond the usual support i am willing to accept or reply to. Obviously you have no knowledge about NTFS and should start with a learning session and read a few books. "File System Forensic Analysis" from Brian Carrier http//www.digital-evidence.org/fsfa/ is a must-have for any Digital Forensics worker. The Forensic Wiki http//forensicswiki.org/wiki/New_Technology_File_System_(NTFS) is a good starting place, too. To get a first impression about the USNJournal and LogFile, you should read the tool related documentation from Joakim Schicht, one of the leading experts for NTFS forensics and a great tool developer. He answered above and mentioned the link to his github site already.

happy reading,
Robin

Thanks for all your replies.

The USN Journal and Logfile appear to be areas of interest I want to follow on this. I will spend some more time learning about NTFS but unfortunately on this occasion I must get to a conclusion a bit quicker on this.

If I take another external hard drive that doesn't need to be used as evidence so can be handled any which way, when I plug it in how can I access the USN Journal then?

If I can try to establish it's the right thing to look at then I can spend more time in trying to obtain it in the seized drive, as I don't have FTK as the previous posted mentioned.

There is no *need* to use specifically FTK. (though FTK imager is anyway freely available)

You can retrieve the "hidden" file system structure files of NTFS with DMDE (if from a disk/volume) or even with 7-zip (if an image), and of course the one or the other tool by joakims offer the same possibilities of extracting files from the filesystem or from an image..

Still, without a more than basic understanding on the workings of the filesystem and of the OS in use, as Bunnysniper said before, it is unlikely that you will get anything of value by using those tools, as the matter is really complex and is prone to lead to "wrong" conclusions in the interpretation of the artifacts.

jaclaz