Triage - live boot cd with just one task

Is this just a back log in general for multiple types of investigations or is it specific to one type of examination like CP or something else?

The cases are mostly related to narcotics and contraband.
The computers are not the most important evidence. There is nearly always another seizure (ie drugs) inolved. My deparment only work with CP when it is classified as contraband (physically moved across a border).

//D

I have developed my own system for dealing with the backlogs, it runs off CD, USB or can be installed to a workstation to deal with loose hard drives.
Basically you boot the suspect system, launch the program then attach an external drive for all the output to be sent to. The program aggressively goes after graphic and movie files, it uses file signature checks, analyses various file archives such as zip, rar, .iso etc, decodes any
email attachments, everything is exported to the hard drive. It also does
a number of routines to try and identify encrypted data (and recover any potential encryption keys). It does some keyword searching through the MFT/FAT/Inode table, web history, P2P client history files and some other structures.
It also creates a summary report on what it finds, one of the things that it does report is the last shutdown time for Windows machine (this data taken from the registry).

The system is designed for IIOC jobs. Although there is a module for our asset recovery team. The problem for you would be that you have to run the whole program, which will take several hours.

I 'should' be able to create a program that does just the last shutdown time and remaster the disk, however it will take me a few days to sort out.
PM me and I will see what I can do.

@differentlayer

Check out Harlan Carveys excellent RegRipper (http//regripper.net/).

It's free and excellent!

However, if you want a total triage solution - We produce a forensically sound tool (SPEKTOR Forensic Intelligence) that is touch screen driven and designed to enable very fast yet comprehensive forensic triage in the field or lab. It handles computers, loose hard disks, USB/Firewire devices, memory cards, cell phones and GPS devices. Check out www.evidencetalks.com or PM me for more info.

Relevant example output

Computer Name ***
Last shutdown time Mon Feb 14 104152 2011 (UTC)

Username Fred
Full Name *******
Last Login Date 10/01/2011 170935
PWD Reset date 2105/2008 075220
PWD Fail Date 16/11/2010 170448
Login Count 217

I would second the use of RegRipper as well.

Another alternative would be to use ADF-Triage from ADF Solutions or you could just remove the drive/s, preview them in EnCase, open the SYSTEM hive and look at the ShutdownTime key.

Bear in mind that the ShutdownTime is the last CLEAN shutdown. If the user decided to just switch off or pull the plug you need to look a bit deeper perhaps at event logs.

I would second the use of RegRipper as well.

Another alternative would be to use ADF-Triage from ADF Solutions or you could just remove the drive/s, preview them in EnCase, open the SYSTEM hive and look at the ShutdownTime key.

Well this is getting boring, but
I second the use of ADF-Triage, esp. when dealing with multiple systems, it can save a lot of time. I does need some extra work before deployment (creating search packs), so you need to have at least an idea of what you're looking for (certain words, pictures, documents, whatever).

- Roland

Take a look at this product - http//www.ldiscovery.net/remote_collection_manager.htm