Join Us!

BlackBerry Wireless...
Clear all

BlackBerry Wireless Handheld Devices .....  

Junior Member

Hey Guys and gals.

I have a new case to work on as part of my self directed learning.
I have a Hard disk, which was a cloned image from a clients PC.
The clients PC was used as a family PC and occasionaly a member of the family connected their BlackBerry PDA.

Not knowing the model or make of the BlackBerry - is there a chance data could be held on the Hard Disk, even though I cannot prove or disprove the Device had actually sync'd

I have looked at the registry and as of yet havent found any relavent entries - using EnCase4.

Could anyone suggest

1- Where to look on the disk for data (compressed or not?)
Key word seraches produced no significant results, using FTK or EnCase

2 - Where in the registry would you look?

Cheers again.


Posted : 16/06/2006 1:46 pm
Active Member


Take a look in the System registry (assuming you are looking at a 2000/XP machine) at the appropriate control set\Enum\USB\. There should be a list of USB devices that have been used in the system that you will need to look through one by one. Hopefully, if a blackberry has been used in the system it will be listed here.


Posted : 16/06/2006 3:05 pm
Junior Member

Hey Sam,

Thanks for the advice, however I have looked through these, and it doesnt appear to state BlackBerry, or anything of relavence, any suggestions?


Posted : 16/06/2006 5:08 pm