Tales of eBay – Part 6

Coming into the home stretch now, keeping up from Part 5 and moving onto the next drive. This drive I spent easily the most time on and had to wrangle back in the searching ..

Again connecting the drive to my laptop and autorun opened …
… opened twice actually
And Hex Editor backs up there is data on the drive
Lots of files to recover
… and a bunch of structures to recover
Applying some Forensics this time for a deeper dive and look at more than files
… specifically emails

This drive I spent the most time on, the file carving took nearly 3 days. 67000 images, 876 word documents, 617 pdfs, and 4714 emails of multiple users. Among all those files …

  • Adult Images / Videos
  • Family pictures
  • Pay stubs
  • Bank documents
  • Divorce papers
  • Tax documents
  • Cisco test prep materials
  • Hardware Manuals
  • Network configurations and maps (many years old though)

This was by far the worst drive that I looked at in this little adventure. The fact that the user left adult photos and movies right next to the family pictures is mind blowing to me, but it was the piece de resistance of the whole project. To top it off, this is the 3rd drive out of the stack with the same names attached to it … That is right the drives from Part 4, 5, and now 6 were all from the same person and from a little poking around, this person was an IT Manager, a person who should have known the meaning of data destruction.

5 Down, 1 to go…

PHP Code Snippets Powered By : XYZScripts.com