Hello Reader,
It's Sunday Funday time again! I have some more images but I'm saving them for some bigger prizes, so this week be another scenario question. I was talking this week to the Texas Lawyer Technology Summit about spoliation so I thought that would be a fun topic for this weeks Sunday Funday.
The Prize:
The Challenge:
Your suspect has a Windows XP system and you evidence from the User Assist records that he ran CCleaner a month ago, but the count shows it has been run multiple times before. Write out what your methodology would be to determine:
It's Sunday Funday time again! I have some more images but I'm saving them for some bigger prizes, so this week be another scenario question. I was talking this week to the Texas Lawyer Technology Summit about spoliation so I thought that would be a fun topic for this weeks Sunday Funday.
The Prize:
- Your chance to become a contributing author to the 3rd edition of hacking exposed computer forensics. Yeah you read that right, we are in the process of updating hacking exposed computer forensics, win this week and you'll get to update a chapter and be listed as a contributing author in the 3rd edition! How's that for a good prize?
The Rules:
- You must post your answer before Monday 9/30/13 2AM CST (GMT -5)
- The most complete answer wins
- You are allowed to edit your answer after posting
- If two answers are too similar for one to win, the one with the earlier posting time wins
- Be specific and be thoughtful
- Anonymous entries are allowed, please email them to dcowen@g-cpartners.com
- In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post
The Challenge:
Your suspect has a Windows XP system and you evidence from the User Assist records that he ran CCleaner a month ago, but the count shows it has been run multiple times before. Write out what your methodology would be to determine:
- If system cleaning took place
- If wiping took place
- What is now missing
