Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Criminal Forensics


19 Mar 2011   #11

Windows 8.1 Pro
 
 

Quote   Quote: Originally Posted by bobland View Post
No one has answered my question. Where are search data strings stored?
I myself can't answer that question. Also be aware that those "search data strings" may be something unique to law enforcement..... And something not publically published for obvious reasons

My System SpecsSystem Spec
.

19 Mar 2011   #12
Microsoft MVP

W 7 64-bit Ultimate
 
 

Just deleting data does not remove it.

I am always totally amazed that people think a format does something, it does not.
My System SpecsSystem Spec
19 Mar 2011   #13

Windows 8.1 Pro
 
 

Quote   Quote: Originally Posted by Bare Foot Kid View Post
Just deleting data does not remove it.

I am always totally amazed that people think a format does something, it does not.
He clearly understands that - that's why he's asking about the technology law enforcement uses to recover it. Curiosity???
My System SpecsSystem Spec
.


19 Mar 2011   #14
Microsoft MVP

 

If you're signed into Google when you search from their webpage, toolbar or browser search box then the search is saved in their servers to be compiled and sold as marketing research which profiles you. Privacy is but one of the reasons Google is becoming less trustworthy.

I would imagine that police forensics use the latest data recovery technology so one could never be sure the data is not recoverable.

The full combination of disk wiping regimens including DOD standard are available on the Disk tab of free Partition Wizard boot CD.
My System SpecsSystem Spec
19 Mar 2011   #15

Microsoft Community Contributor Award Recipient

Windows 7 SP1, Home Premium, 64-bit
 
 

The average person whose computer has been confiscated by law enforcement has not even attempted a format to erase anything.

Formatting is not the point of the OP's post.

Does law enforcement look in particular folders on the hard drive for search strings? If so, what folders?

Or, alternatively, does law enforcement just capture the computer's IP address and then contact the ISP in question and/or Google to find out what search terms may have been entered into Google from that IP address?

The confiscation of the computer implies the search terms are to be found on the computer, per se. If so, where, and can that location be cleared? If cleared, can that cleared space then be wiped (overwritten deliberately)?

From reading this thread, I don't see any answers on the point.

I periodically see apps designed to wipe ONLY unoccupied space--I think CCleaner has such a capability. But I have no idea how well it works.
My System SpecsSystem Spec
19 Mar 2011   #16

Windows 8.1 Pro
 
 

Quote   Quote: Originally Posted by gregrocker View Post
If you're signed into Google when you search from their webpage, toolbar or browser search box then the search is saved in their servers to be compiled and sold as marketing research which profiles you. Privacy is but one of the reasons Google is becoming less trustworthy.
Not to be paranoid but I've been saying this for a while now. Google is becoming the premier information corporation worldwide. Information is power. Who controls it???

Anyway there are tons of ways for law enforcement to recover data you've created or searched for. Don't want them to find it.... don't use the internet, or computers

Quote   Quote: Originally Posted by ignatzatsonic View Post
The confiscation of the computer implies the search terms are to be found on the computer, per se. If so, where?

From reading this thread, I don't see any answers on the point.
I don't think there is a simple answer, and certainly not one non-forensics people can answer.
My System SpecsSystem Spec
19 Mar 2011   #17

Windows 7 Ultimate X64 SP1
 
 

This may be of interest: HowStuffWorks "How Computer Forensics Works" I've only given it a skim read, but it looks interesting, will have a proper look later.
My System SpecsSystem Spec
19 Mar 2011   #18

W7x64 Pro, SuSe 12.1/** W7 x64 Pro, XP MCE
 
 

Quote   Quote: Originally Posted by Bare Foot Kid View Post
Just deleting data does not remove it.

I am always totally amazed that people think a format does something, it does not.
I'm not certain that it is as thorough as other options, but a low level format does delete data. If course, that only works on a drive or partition, not specific data within them.
My System SpecsSystem Spec
19 Mar 2011   #19

Microsoft Community Contributor Award Recipient

Windows 7 SP1, Home Premium, 64-bit
 
 

Quote   Quote: Originally Posted by severedsolo View Post
This may be of interest: HowStuffWorks "How Computer Forensics Works" I've only given it a skim read, but it looks interesting, will have a proper look later.

I read through the above link and found nothing particularly revealing, other than the following quote, which implies data can be recovered from RAM, even after a shutdown. Not surprising, I guess.

"There are several programs designed to preserve the information in a computer's random access memory (RAM). Unlike information on a hard drive, the data in RAM ceases to exist once someone shuts off the computer. Without the right software, this information could be lost easily."


But I found nothing in the article regarding folders, locations, wiping, overwriting, etc. It does give a brief background on anti-forensics.
My System SpecsSystem Spec
19 Mar 2011   #20

Win 7 Ultimate 32bit
 
 

Quote   Quote: Originally Posted by sygnus21 View Post
Quote   Quote: Originally Posted by gregrocker View Post
If you're signed into Google when you search from their webpage, toolbar or browser search box then the search is saved in their servers to be compiled and sold as marketing research which profiles you. Privacy is but one of the reasons Google is becoming less trustworthy.
Not to be paranoid but I've been saying this for a while now. Google is becoming the premier information corporation worldwide. Information is power. Who controls it???

Anyway there are tons of ways for law enforcement to recover data you've created or searched for. Don't want them to find it.... don't use the internet, or computers

Quote   Quote: Originally Posted by ignatzatsonic View Post
The confiscation of the computer implies the search terms are to be found on the computer, per se. If so, where?

From reading this thread, I don't see any answers on the point.
I don't think there is a simple answer, and certainly not one non-forensics people can answer.

Yeah, and with Android, people are not only collected as data, they are tracked by their movements. If one does not think so, then I say one is a fool.
Remember, google maps collected WIFI data all over the world. They would have kept doing it had they not been caught, and who is to say they have truly stopped?

I do not trust google, which is why everything I can block from them is blocked and I will never use Chrome.

Quote:
I'm not certain that it is as thorough as other options, but a low level format does delete data. If course, that only works on a drive or partition, not specific data within them.
Not, it is not, low level format only writes Zero's to the drive one time, it's a single overwrite.

The most secure method of wiping a drive completely of all data is to use the Secure Erase function of the firmware on the drive itself. It's is not a quick method.

HDDErase is one of a very small number of applications that you can use to access the Secure Erase Function.
My System SpecsSystem Spec
Reply

 Criminal Forensics




Thread Tools



Similar help and support threads for2: Criminal Forensics
Thread Forum
Criminal websites are taken down Security News
world's most dangerous criminal threat-Cybercrime Security News
Visa Warns of Fraud Attack from Criminal Group Security News
Criminal hacker 'Iceman' gets 13 years Chillout Room

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 10:22 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33