All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: To catch a cheater! - Windows 8 Internet History Recovery
PostPosted: July 16th, 2015, 5:58 
Offline

Joined: July 16th, 2015, 5:40
Posts: 2
Location: New Zealand
Hello,

I have a customer who wants me to do a forensic recovery on a windows 8 machine, they are concerned partner is using 'various' online services to cheat on them. Your mission is to help me confirm or deny this.

This thread is to discuss how i can get as much history as possible from the machine in the limited time window i can look at it (12hrs). I have 4 days until they arrive to study and try do a descent recovery, please help me.

I have as my disposal:

1x PC3000 Express kit with software

My current strategy:

1) Map all unused sectors in the drive for later analysis, or preferably the entire drive.
2) Copy existing history from the Windows 8 OS, Firefox and Chrome. (The specifics on this I'm not sure of yet.)

Any help appreciated. I've done plenty of deleted recoveries but this is my first specifically forensic recovery. :mrgreen:


Top
 Profile  
 
 Post subject: Re: To catch a cheater! - Windows 8 Internet History Recover
PostPosted: July 16th, 2015, 10:55 
Offline

Joined: February 13th, 2010, 9:44
Posts: 207
Location: san diego, ca.
after imaging, on a duplicate duplicate copy only... as a starting place to discover just about anything re websites, passwords, banking,credit cards, etc. I use a lisc. from http://www.identityfinder.com . Great general discovery software. The use lisc. is very reasonably priced.


Top
 Profile  
 
 Post subject: Re: To catch a cheater! - Windows 8 Internet History Recover
PostPosted: July 16th, 2015, 12:24 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3152
Location: Adelaide, Australia
Try the open source "autopsy".

but first, be damn sure you are legally able to do this.

a husband can go to jail for "hacking" his wife's email account.. and yes EVEN if she IS cheating.


Top
 Profile  
 
 Post subject: Re: To catch a cheater! - Windows 8 Internet History Recover
PostPosted: July 16th, 2015, 13:03 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1856
Location: Providence, RI
Yes, not to mention the possible legal repercussions. Even if it's "legal" for you do search someone's HDD without their knowledge (and I doubt it is), you can definitely be sued for invasion of privacy. That's why I steer way clear of stuff like this.

When customers drop off phones and the likes for recovery and I even suspect it's not theirs, I tell them that our company policy is to notify the police when we discover a device belongs to someone else. Literally I've had people just walk out after I told them that.

_________________
Data Medics - Hard Drive and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: To catch a cheater! - Windows 8 Internet History Recover
PostPosted: July 16th, 2015, 14:13 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2060
Location: Ontario, Canada
If they don't trust their spouse, refer them to marriage counselling.

_________________
Luke
RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: To catch a cheater! - Windows 8 Internet History Recover
PostPosted: July 17th, 2015, 1:03 
Offline

Joined: July 16th, 2015, 5:40
Posts: 2
Location: New Zealand
Good advice all around.

I will have to reject her offer, i cannot except devices that are not owned by the person submitting them!


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group