SlideShare ist ein Scribd-Unternehmen logo
1 von 14
The Traces We Leave Behind   AND HOW TO FIND THEM Mattias Wecksten 2009 (cc) by-nc-sa
What Traces Do You Leave If…
… you delete a file?
… you format a hard drive?
… edits a document without saving?
… use an USB memory?
Files on the Hard Drive ,[object Object],[object Object],[object Object],[object Object]
Data Extraction: deleted file ,[object Object],[object Object],[object Object]
Data Extraction: formatted hard drive ,[object Object],[object Object]
Data extraction: Word-recovery
The Windows Registry
Metadata
Questionnaire: ,[object Object],[object Object],[object Object],[object Object]
References ,[object Object],[object Object],[object Object],[object Object]

Weitere ähnliche Inhalte

Ähnlich wie The Traces We Leave Behind

L3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptxL3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptxUsamaSatti11
 
L3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptxL3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptxUsamaSatti11
 
L3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptxL3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptxUsamaSatti11
 
FTK report PART I Familiar with FTK ImagerBonus Exerc.docx
FTK report PART I Familiar with FTK ImagerBonus Exerc.docxFTK report PART I Familiar with FTK ImagerBonus Exerc.docx
FTK report PART I Familiar with FTK ImagerBonus Exerc.docxbudbarber38650
 
Defcon 17 Tactical Fingerprinting using Foca
Defcon 17   Tactical Fingerprinting using FocaDefcon 17   Tactical Fingerprinting using Foca
Defcon 17 Tactical Fingerprinting using FocaChema Alonso
 
Metadata Security: MetaShield Protector
Metadata Security: MetaShield ProtectorMetadata Security: MetaShield Protector
Metadata Security: MetaShield ProtectorChema Alonso
 
How to remove files safely from an HDD or SSD in Windows 10
How to remove files safely from an HDD or SSD in Windows 10How to remove files safely from an HDD or SSD in Windows 10
How to remove files safely from an HDD or SSD in Windows 10Hetman Software
 
ICT Lecture 1 -Computer Systems and Ergonomics.pdf
ICT Lecture 1 -Computer Systems and Ergonomics.pdfICT Lecture 1 -Computer Systems and Ergonomics.pdf
ICT Lecture 1 -Computer Systems and Ergonomics.pdfjoshielq
 

Ähnlich wie The Traces We Leave Behind (9)

L3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptxL3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptx
 
L3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptxL3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptx
 
L3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptxL3_Electronic Data Processing.pptx
L3_Electronic Data Processing.pptx
 
FTK report PART I Familiar with FTK ImagerBonus Exerc.docx
FTK report PART I Familiar with FTK ImagerBonus Exerc.docxFTK report PART I Familiar with FTK ImagerBonus Exerc.docx
FTK report PART I Familiar with FTK ImagerBonus Exerc.docx
 
Defcon 17 Tactical Fingerprinting using Foca
Defcon 17   Tactical Fingerprinting using FocaDefcon 17   Tactical Fingerprinting using Foca
Defcon 17 Tactical Fingerprinting using Foca
 
Metadata Security: MetaShield Protector
Metadata Security: MetaShield ProtectorMetadata Security: MetaShield Protector
Metadata Security: MetaShield Protector
 
How to remove files safely from an HDD or SSD in Windows 10
How to remove files safely from an HDD or SSD in Windows 10How to remove files safely from an HDD or SSD in Windows 10
How to remove files safely from an HDD or SSD in Windows 10
 
ICT Lecture 1 -Computer Systems and Ergonomics.pdf
ICT Lecture 1 -Computer Systems and Ergonomics.pdfICT Lecture 1 -Computer Systems and Ergonomics.pdf
ICT Lecture 1 -Computer Systems and Ergonomics.pdf
 
Digital preservation by Chris Smart
Digital preservation by Chris SmartDigital preservation by Chris Smart
Digital preservation by Chris Smart
 

Kürzlich hochgeladen

Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...HostedbyConfluent
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Servicegiselly40
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfEnterprise Knowledge
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024The Digital Insurer
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 3652toLead Limited
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreternaman860154
 
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Alan Dix
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Miguel Araújo
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024Scott Keck-Warren
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonetsnaman860154
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...shyamraj55
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024BookNet Canada
 

Kürzlich hochgeladen (20)

Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreter
 
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen Frames
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
 

The Traces We Leave Behind

Hinweis der Redaktion

  1. Tänk er en hårddisk som en pärm med ett register. Varje gång man skriver en fil till hårddisken så motsvaras det av att vi sätter in papper i pärmen under en flik och skriver namnet på filen i registret. Om vi raderar en fil så motsvaras det av att vi raderar filen ur registret. Om vi formaterar en hårddisk så motsvaras det av att vi river ut registret och sätter i ett nytt.
  2. Inte raderas utan märks som borttagen. Titta i databasen och återskapa Problem Överskrivning av register Leta för hand Överskrivning av data ” carving”
  3. Minsta möjliga arbete Markera MFT som tom Återskapa Överskriven Analysera datat (”carving”)
  4. Här blir det ett filmklipp.
  5. När man sätter i en hårdvara i systemet som tex. en USB-sticka så sparas information om detta i Windows konfigurationsdatabas. Konfigurationsdatabasen kan vi se som ett antal tomma blad i slutet av pärmen. När någon varit på besök så sätter de en liten signatur och berättar om upplevelsen. Varje USB-sticka har ett unikt serienummer som sparas. Vi kan alltså se när en viss USB-sticka använts och det kommer att unikt gå att spåra detta till en fysisk enhet.
  6. Här blir det ett filmklipp.