- My Forums
- Tiger Rant
- LSU Recruiting
- SEC Rant
- Saints Talk
- Pelicans Talk
- More Sports Board
- Fantasy Sports
- Golf Board
- Soccer Board
- O-T Lounge
- Tech Board
- Home/Garden Board
- Outdoor Board
- Health/Fitness Board
- Movie/TV Board
- Book Board
- Music Board
- Political Talk
- Money Talk
- Fark Board
- Gaming Board
- Travel Board
- Food/Drink Board
- Ticket Exchange
- TD Help Board
Customize My Forums- View All Forums
- Show Left Links
- Topic Sort Options
- Trending Topics
- Recent Topics
- Active Topics
Started By
Message
Any computer forensics gurus out there?
Posted on 11/27/14 at 9:05 am
Posted on 11/27/14 at 9:05 am
I've got a little situation at my place of employment that I'm trying to investigate
The scenario. Myself and another employee who I rotate with on an assignment share some information that we exchange on a hard drive.
A few weeks ago the hard drive was stolen. Didn't think much of it other than someone stealing a hard drive.
He gets another drive that he loads some info on for me. I took a look at the drive and didn't do much with the files my first few days. A couple days ago I insert the drive and someone has wiped it clean.
I was able to find a recovery program to retrieve the files, but I want to know who wiped all the files off the drive. Is there a way to look at the usage history of the drive (i.e. which machine would have wiped the data?)
I've been looking around to see if there is a program out there that is capable of this. I'm sure I could send it off to an expert if I wanted to take the investigation far enough. What are my options here?
The scenario. Myself and another employee who I rotate with on an assignment share some information that we exchange on a hard drive.
A few weeks ago the hard drive was stolen. Didn't think much of it other than someone stealing a hard drive.
He gets another drive that he loads some info on for me. I took a look at the drive and didn't do much with the files my first few days. A couple days ago I insert the drive and someone has wiped it clean.
I was able to find a recovery program to retrieve the files, but I want to know who wiped all the files off the drive. Is there a way to look at the usage history of the drive (i.e. which machine would have wiped the data?)
I've been looking around to see if there is a program out there that is capable of this. I'm sure I could send it off to an expert if I wanted to take the investigation far enough. What are my options here?
4
Posted on 11/27/14 at 9:18 am to Powerman
quote:
A few weeks ago the hard drive was stolen. Didn't think much of it other than someone stealing a hard drive.
Hope it was using FDE.
quote:
A couple days ago I insert the drive and someone has wiped it clean.
Is there a way to look at the usage history of the drive (i.e. which machine would have wiped the data?)
The point of "wiping a drive clean" is to restore it to brand-new condition, so almost certainly not. Your only hope would be for it not to have been wiped clean, and there are many programs to inspect drives, e.g. WinHex.
Posted on 11/27/14 at 9:18 am to Powerman
If the drive was truly wiped, that is it was overwritten, I am not familiar with being able to determine this information.
Posted on 11/27/14 at 1:05 pm to Powerman
quote:
Didn't think much of it other than someone stealing a hard drive.
What kind of work do you do that this is a commonplace occurrence? I've been in the workforce for 25 years and this has never happened to me.
Posted on 11/28/14 at 10:27 pm to Powerman
quote:
and someone has wiped it clean.
A drive is never truly wiped clean after one format. You really gotta do it several times until the binary is FUBAR to the computer so it's much harder to recover.
Page 1 of 1
Popular
Back to top
Follow TigerDroppings for LSU Football News