Digital Forensics - Did you know?!

[SeanPreston]

Dear fellow NP'ers,

I'm currently at University in the UK studying a bachelor's degree in Digital Forensics, over the last few years I've come to learn some interesting points regarding how your data is stored on devices and how secure that "delete" button really is?! So I thought I'd share a few...

1) If you use Windows Vista or 7 (Business, Ultimate or Enterprise edition), assuming your system hasn't had it disabled at some point, windows will keep a "copy of previous files", simply Right Click on a file-> Properties->Previous Versions.

2) Up to 3500 file changes can take place just by pressing the power button on your device!

3) Facebook Chat history can be rebuilt using a systems Internet Cache

4) If you use a mobile phone (other than smartphones) and delete a message from your SIM cards memory, the message remains in storage, the status of the message is simply changed (until the maximum amount of stored deleted messages is reached)

5) The renowned thumbs.db - ever deleted a photo? well here's the bad news, most Windows systems will store a thumbnail version of that image in a file known as thumbs.db, this technique has been used a lot by the FBI.

6) One strange but true scenario is that if someone is caught taking part in illegal activity for example they could be "sending a death threat to someone via email", if the individual is arrested and they give law enforcement the login details for their email account (e.g. gmail) law enforcement are not allowed to login to the account without gaining permission from the provider in advance (e.g. gmail)

Well that's it, of course these are only based on my finding from guest lecturers from members of UK Cyber Crime Units and the final point may be different in other countries.

Best Regards,
:hehe:

 

[DU]

5) The renowned thumbs.db - ever deleted a photo? well here's the bad news, most Windows systems will store a thumbnail version of that image in a file known as thumbs.db, this technique has been used a lot by the FBI.

:hehe:

There are two scenarios similar to this. EXIF (not so much now) used to store a thumbnail image that remained intact if you used some image resizers.

This caused problems for Catherine Schwartz of TechTV who cropped a "nude" shot thinking that the naughty parts were gone.

There was also a "hacker" who went on record if he was anonymous. The picture was posted with location and time taken - this allowed people to locate his location to a small town in the midwest.

Another interesting one that gets people all the time. When you use the "redact" option in Adobe it just puts a black bar over the text which is fine if you PRINT the document; however, if you send out the source, the redacted information is still available!

I work with someone who has redacted PDFs on their website from their ex-employer. I have yet to tell them that the information is not hidden from a quick cntl-c cntl-v.

It's all interesting stuff!

 

[kokopelli]

Yes, scary!

And did you know?

... every time you printed a document it automatically included a secret code that could be used to identify the printer - and potentially the person who used it.

Source: https://www.eff.org/issues/printers