The CD Burning Party
The Question: Was proprietary company information copied to the computer?
The Answer: Yes
The Proof: This was an interesting one, requiring a knowledge of Windows and forensic techniques.
Windows maintains a database of file activity passing through the recycle bin, called INFO2. Unfortunately, the INFO2 database is cleared each time the recycle bin in emptied.
Windows also uses a folder buried in the user's profile as a temporary staging place for files ready to be burned to CD.
First we searched the whole drive for fragments of old INFO2 files. The search required finding INFO2 headers, and parsing through the hex displays to pull out the records. From these files we found dozens of references to files in the temporary CD burning folder.
Then we wrote a program to parse the recovered INFO 2 database and fill an Excel Spreadsheet. We ended up with proof that at least 3 CD's were burned, containing the exact information management needed.
The Question: Was proprietary company information copied to the computer?
The Answer: Yes
The Proof: This was an interesting one, requiring a knowledge of Windows and forensic techniques.
Windows maintains a database of file activity passing through the recycle bin, called INFO2. Unfortunately, the INFO2 database is cleared each time the recycle bin in emptied.
Windows also uses a folder buried in the user's profile as a temporary staging place for files ready to be burned to CD.
First we searched the whole drive for fragments of old INFO2 files. The search required finding INFO2 headers, and parsing through the hex displays to pull out the records. From these files we found dozens of references to files in the temporary CD burning folder.
Then we wrote a program to parse the recovered INFO 2 database and fill an Excel Spreadsheet. We ended up with proof that at least 3 CD's were burned, containing the exact information management needed.