Notifications
Clear all
Topic starter
26/05/2010 8:52 pm
I am doing an investigation/triage and have previously been notified by another source that Yahoo messenger file transfers have taken place on several machines without the user's knowledge. I take a look at one of the machines that supposedly transferred files via Yahoo IM and it does not even have Yahoo messenger installed on the system.
I was wondering if the user may be using Yahoo Messenger for the Web, but I am not sure what artifacts and where to look. Was wondering if anyone had any insight?
26/05/2010 10:32 pm
If you search the Forum you'll find some threads. Here is one.
http//www.forensicfocus.com/forensic-investigation-of-instant-messenger-histories
You could also install and test it to see where artifacts will be stored; basic ingenuity.