Join Us!

BlackBerry Wireless...
 
Notifications
Clear all

BlackBerry Wireless Handheld Devices .....  

  RSS
novadonuk
(@novadonuk)
Junior Member

Hey Guys and gals.

I have a new case to work on as part of my self directed learning.
I have a Hard disk, which was a cloned image from a clients PC.
The clients PC was used as a family PC and occasionaly a member of the family connected their BlackBerry PDA.

Not knowing the model or make of the BlackBerry - is there a chance data could be held on the Hard Disk, even though I cannot prove or disprove the Device had actually sync'd

I have looked at the registry and as of yet havent found any relavent entries - using EnCase4.

Could anyone suggest

1- Where to look on the disk for data (compressed or not?)
Key word seraches produced no significant results, using FTK or EnCase

2 - Where in the registry would you look?

Cheers again.

iconSerf

Quote
Posted : 16/06/2006 1:46 pm
samr
 samr
(@samr)
Active Member

Hi,

Take a look in the System registry (assuming you are looking at a 2000/XP machine) at the appropriate control set\Enum\USB\. There should be a list of USB devices that have been used in the system that you will need to look through one by one. Hopefully, if a blackberry has been used in the system it will be listed here.

Sam

ReplyQuote
Posted : 16/06/2006 3:05 pm
novadonuk
(@novadonuk)
Junior Member

Hey Sam,

Thanks for the advice, however I have looked through these, and it doesnt appear to state BlackBerry, or anything of relavence, any suggestions?

Cheers,

ReplyQuote
Posted : 16/06/2006 5:08 pm
Share: