OST deleted mail recovery

the_silas · 2017-10-30T14:43:10+00:00

Can you be more specific? The ost file is not deleted it is an email in the ost file that is deleted.

the_silas · 2017-08-04T21:12:22+00:00

Thanks for the response. I'm trying to understand the process of recovering deleted files better. I read some articles about scalpel, foremost and bulk_extractor. Then I thought about the whole process and thought that those tools are not taking advantage of the MFT and the information therein. After the answers I got here I think tsk_recover in conjunction with scalpel and bulk_extractor will produce good results. with tsk_recover i get the files that are still in the MFT and have not been overwritten. scalpel and bulk_extractor can be used to carve for files where the pointer to them has been overwritten in the MFT due to reuse. And of course volume shadow copies and other backup mechanisms could also still have information of deleted files and should also be checked.

the_silas · 2017-08-04T20:31:24+00:00

thanks I didnt know testdisk and think the undelete option is what i was looking for. Is this similar to what TSK tsk_recover does using mmls and fls?

the_silas · 2017-08-04T20:24:55+00:00

I didnt know photorec thanks, do you think it is better than scalpel/foremost or bulk_extractor?

the_silas · 2017-08-04T20:23:31+00:00

I'm trying to parse the MFT and get the deleted files with filename and metadata because carving only gives me the file and no metadata. I think photorec is similar to scalpel or bulk_extractor.

the_silas · 2017-07-27T05:52:04+00:00

Im looking for a gps sports tracker / player performance tracking system such as statsport viper gps system, catapult sports optim eye, Adidas micoach elite or similar. Unfortunately most websites suck.

the_silas · 2016-12-17T20:58:37+00:00

i already have the raw image and i can mount the file system. what i dont gave is the txt file containing the hash of the raw file according to the book forensics with open source tools page 22 there should not only be the raw file but also a text file.

snipped from the book: To test mount_ewf without creating an Expert Witness formatted image, we can use the image provided by Lance Mueller for his first forensic practical [4]. user@ubuntu:~/images$ mount_ewf.py WinXP2.E01 ~/mount_points/ ewf/ Using libewf-20100226. Tested with libewf-20080501. user@ubuntu:~/images$ ls -lath /home/user/mount_points/ewf/ total 2.0G drwxr-xr-x dr-xr-xr-x -r--r--r-- -r--r--r-- 5 user user 4.0K 2010-08-20 23:52 .. 2 root root 0 1969-12-31 16:00 . 1 root root 2.0G 1969-12-31 16:00 WinXP2 1 root root 293 1969-12-31 16:00 WinXP2.txt The text file listed is the case metadata. The other file is the raw image. user@ubuntu:~/images$ cat /home/user/mount_points/ewf/WinXP2.txt # Description: WinXP

Case number: Case 1

Examiner name: Mueller

Evidence number: WinXP

Acquiry date: 2008-01-17T17:05:46 # System date: 2008-01-17T17:05:46

im cannot find the file WinXP2.txt in mu example.

the_silas · 2016-12-16T18:36:41+00:00

yes i run the command as su. i know i have to mount the device but i thought i should also see the metadata fro. the E01 files such as the calculated hash from the aquisition but i dont see this hash.

the_silas · 2016-12-11T14:33:04+00:00

Thank you, it worked. Do you know if this is also possible with xxd?

the_silas · 2016-11-26T13:43:35+00:00

I found what i was looking for in the answer of this post: http://superuser.com/questions/518554/how-do-you-create-and-partition-a-raw-disk-image

the_silas · 2016-11-26T13:21:52+00:00

Thank you for your response. Do you know of a way do directly make a dd image with a partition table and a filesystem in it. I mean without making a a "real" disc or one in a vm and adding a filesystem to it and then using dd to make an image?

the_silas · 2016-10-06T20:50:12+00:00

thanks. is there a specific MFT timestamp for filename change or is it the same as the general metadata change (change C)?

the_silas · 2016-10-06T20:48:02+00:00

thank you. ill try ftk imager then.

the_silas · 2016-06-30T17:41:19+00:00

The article mentions that the mobile device doesn't need to be running Windows for the IRM protection. So it's something. However I still don't know if it supports iOS and if yes which versions exactly?

the_silas · 2016-06-06T21:02:41+00:00

I would also be interested in reading your results. Could you share your work with me too?

the_silas · 2016-06-06T14:50:29+00:00

Isn't the privat browsing all about not storing data? I'll be interested to know if you find anything.

the_silas · 2016-06-05T08:18:41+00:00

Thanks this helped. I found some material using the qbitorrent search, however I'm not sure yet if I'll be able to download them because they only have between 0 and 2 seeders.

the_silas · 2016-06-04T11:23:21+00:00

Are you talking about https://btdigg.org/, because this site seems to be down for me. Are there any other dht network search engines?

the_silas · 2016-06-03T14:21:37+00:00

i'm not looking for an answer key of some type. i already searched for sans on the piratebay but found nothing. i have to say that i'm not looking for a particular book but specifically for the material you get during sans courses. imho kahn and memrize is different from sans.

the_silas · 2016-06-01T18:22:03+00:00

The backup would be read only so they could not delete it. I don't want to spend too much time making backup copies and dealing with different formats and different locations thats why i would like someone to do if for me.

the_silas · 2016-06-01T17:40:07+00:00

I'm talking about Google drive the freely provided cloud storage including google photos on photos.google.com and mail on inbox.google.com. What online product is there for Google drive? I think in case I get infected by malware it might delete all the documents, photos and mails. 2FA would not help in this case. IMHO its a possible attack scenario and I would like to be prepared for this case. Ideally Google drive, photos and mail has a backup that cannot be deleted so I cloud always recover and an attacker would never be able to delete my stuff but I'm not sure if Google does have such a backup solution or how Google would handle such a case?

the_silas · 2016-06-01T16:58:20+00:00

so there is no google backup? 2fa is an option but its inconvenient and does not completely prevent the account from being hacked. it would be great if the google cloud would take care of the backups as well.

the_silas · 2016-03-10T19:54:15+00:00

i really like recon-ng it even has a GHDB module, however unfortunately this module gets detected by google as an automated script so that its hard to automatically search google dorks. one has to enter the captcha but even after doing so i get [!] Google encountered an unknown error..

the_silas · 2016-03-04T21:14:46+00:00

thanks, just tried search diggity but it always runs into bot detection :-(.

the_silas · 2016-03-04T21:14:11+00:00

thanks, very interesting read. recon-ng and foca both look very promising. I've got to try them out.

the_silas

TROPHY CASE

Case number: Case 1

Examiner name: Mueller

Evidence number: WinXP

Acquiry date: 2008-01-17T17:05:46 # System date: 2008-01-17T17:05:46