Hello
I’m new to forensic examination & Im sure my colleagues are fed up of all my question. So hear goes
I have a case where images have been found located in- user\desktop\documents\lifecam files
Obviously in my report I have to advise how these images got their.
I am trying to research Microsoft lifecam but can’t seem to find any relevant documentation online to help me be able to clarify how the images got in the said directory and obviously there is always the time & date issue.
As anyone had any previous experience with Microsoft lifecam?
Many Thanks
I don´t specifically have lifecam experience, but…
The LifeCam documentation form Microsoft can be found here
http//
However, the documentation wont tell you *exactly* how it got there. My guess is that you should see the standard LifeCam software from Microsoft installed, and that is probably, but not necessarily, what created the lifecam directory. You could test the default install options by installing the lifecam software (on a test machine) which can be found here
http//
For where the pictures came from you might start with looking at the lifecam software, and what instant messengers are installed. Check their settings for the default webcam save location. One of them might even have the filenames saved in an MRU or something.
It is also a possibility that the user took the pictures with another camera, created the directory, and just moved the pictures there themselves. Make sure your evidence backs up your conclusion.
Hope this helps,
Joshua