Xbox 360 user history

I am not sure about on the XBox but if you are police you could do a check with Micro$oft I believe they record the serial number when people log in to Live. Worth a try.

Pat

I have the same problem, & I kind of did some search on it but the only thing that I found was a new book by Steven bolton (XBOX 360 Forensics A Digital Forensics Guide to Examining Artifacts) which has some extracting solutions using different forensics tools.
I ordereed last week I will post my results & how good the book is later on to see if it helps.

Jose

I'm not sure if this will help you but it may. Check out the last post in this thread.

http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=3152

Or the tool "Collins XFT" looks like it may be of assistance.

Pat, I believe the case officer has done this already with negative results, but I will recommend it anyway! You never know…

Jose, might have to see if the unit budget will stretch to the book, after all, we've had a couple of XBoxes in lately.

Muirner, Live viewing is what I have done so far, but it's only revealed 1 currently listed user. A full imaging and examination have not been approved, so its live preview, or write-blocked browsing of hard disc only it seems. Was hoping to find that perhaps a 'Golden Nugget' file existed that stored previous users in it. I'll take a look into the Collins XFT tool.

Thanks to all for your time and help

Ben

Got this from another list I am on

———————————–
You can use the standard tools and data carve files out of the image
(Image of the hard disk, I haven't worked with flash model). You can
also run string searches through image with std tools but none of the
tools with recognize the fs (FATX is correct).

You can purchase XFT (XBox Forensic Tool) from protowise.com. This
software will read the file system.

Or you can try to use one of the hack tools for XBox such as
Explorer360 to read the fs. You'll have to check the modder forums to
find this, there may also be others. This tool was developed to let
you copy the data from a 20Gb HD to a larger one to allow more games
on the drive, also to maybe hack some of the games saves to make you
invincible or unlimited ammo, etc.

Goog luck. I have never had to dive fully into one. After looking at
the data carved images, I have stopped my investigations because it
did not seem I was going to find anything. No ROI for me to spend the
time.l

MarkG

On Sun, Mar 6, 2011 at 0649, J wrote
> I received a request to try and recover "any email addresses associated with
> deleted profiles" on an XBOX 360. Unfortunately, I have no idea where to
> start with an XBOX 360! While googling it appears that I need to make sure
> the hard drive is "unlocked" and then I'll need a utility to read the
> filesystem (I've read conflicting accounts of it being XFAT or FATX). This
> is not something that will end up in court (I'm assured), just an attempt to
> locate a previous owner and return their equipment to them.
> Can someone with experience with these devices point me to
> 1) Either complete instructions on imaging a 360 disk, or a list of
> gotchas/differences for the process opposed to a standard disk imaging
> 2) A free/lost cost (this is charity work) utility that would allow me to
> hexdump files present in the filesystem
> or
> 3) an entirely different and better way to go about this
> )
> Thanks to all,

>
>
>

Sorry, was on my way out the door when I posted my earlier response, here are links from Amazon and B&N

http//www.amazon.com/XBOX-360-Forensics-Examining-Artifacts/dp/1597496235/ref=sr_1_1?ie=UTF8&qid=1299429349&sr=8-1

http//productsearch.barnesandnoble.com/search/results.aspx?WRD=xbox+forensics&page=index&prod=univ&choice=allproducts&query=xbox+forensics&flag=False&ugrp=2

show details 1439 (20 hours ago)

1) You can remove the drive from its enclosure and connect it using a sata to USB connector to create an image.

2) Then use Xplorer360 (free) to extract the profiles (partition 3 > content > E0000<random>) to your drive.

3) You can then use WxPirs (http//gael360.free.fr/wxPirs.php) to open the profile and decrypt / extract the "Account" file.

4) Then decrypt that file using a tool called "sigggggggggy" (remember to use the right amount of g's when searching D).

5) Opening the decrypted file in a hex editor will get you the gamertag for sure. You can dig around to see if the e-mail is in there as well.

Then again, this will only show you profiles that weren't deleted completely (there is a way to delete profiles from the xbox interface without removing all related data). You'll have to search for the download links for xplorer360 and sigggggggggy. I see a bunch of download links on file sharing sites. Needless to say, the tools are not error-free and have been known to corrupt xbox360 drives. So, creating an image is a very good idea.

http//www.xbox-scene.com/xbox1data/sep/EEFAZAlEpAHLgaWKhN.php
http//www.se7ensins.com/forums/topic/85274-profile-account-decryptionencryption-tutorial/

Cheers Mark, plenty of info there for me to look into!

Ben