Hello Guys.
I have been working on case where, the system is being used from 2009. I'm basically looking for all the document files(doc, xls, pdf..etc) from the computer.
Surprisingly, I am not able to find any such files on the system. For a fact, I know the person had made them on the same system.
He has deleted those files using CC Cleaner. I don't if he has deleted them or wiped, but they are not there.
The install date of the OS is intact, 2009.
I am using EnCase V6.18 for my investigation.
Any kind of help would be appreciated. My email ID is prithpal.pardal@gmail.com.
Thanks.
Have a look at memory files adn volume shadow copies. Often a user forget these resources.
Thanks a lot friend!
What is the OS?
Carving didn't turn anything up?
I haven't looked at CC cleaner in years but the website doesn't mention anything about a file shredder, just cleaning of temp files for internet history etc.
I know it can wipe a drive but I didn't think it could shred files, but I could be wrong.
Unless it's got that capacity then it will have no effect on any document files.
It has both a secure delete option and a wipe free space option.
@RyanP It has windows installed in it.
@isth No Carving isn't showing the files I need. I'm getting only the preloaded files from Microsoft. Hardly 10 Documents.
Where as I am getting traces of a lot files, but no data. Its because a had given a Keyword Search and it showed me that a lot of files were present earlier.
@Adam Even I tried to look how these cleanup softwares work. The mention cleaning up of only temp files, but strangely I am not getting any real good stuff!
Hi,
I agree with Larry Daniel. C cleaner has an option to Wipe free space or Entire drive and also number of passes 1,3,7 or 35.
@RyanP It has windows installed in it.
Depending on the version take a look at Volume Shadow Copies.
Take a look also at when Windows was installed is it possible that the user completely wiped the drive and made a clean installation recently? In that case, you'll be unlikely to find anything.