Please enable JavaScript.

Coggle requires JavaScript to display documents.

(Analysis) - Coggle Diagram

- - - - it will list the partition detail by using offset number
    - - fls -rdF -o 206848 cfreds_2015_data_leakage_pc.dd | grep .docx
        
        -r recursively display directories
        -d display deleted entries only
        -F Display file (all non-directory) entries only
  - - - /media/kali/C8CA0C8DCA0C7A48/Windows/System32/config/SAM
    - - no (hash value)
    - - using rainbow attack
  - - - UsnJrnl2Csv
        
        icat -i raw -o 206848 cfreds_2015_data_leakage_pc.dd 59016-128-3 > UsnJrnl2Csv/usnJrnl.bin
  - - - This will list all directories(Not files) that were traversed in ‘RM#2’.
    - - copy UsrClass.dat file from mounted image
        
        rip.pl -r UsrClass_informat.dat -p shellbags | grep E:
  - - - cd Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\
    - - $MFT stores metadata of files and directories. but it is difficult to find copied files from CD because there may be no metadata in $MFT
  - - - To check uninstall registry
        
        rip.pl -r SOFTWARE -p uninstall | grep 2015-03-25 -A 2 -B 2
    - - cat the following path
        
        cat /media/root/C8CA0C8DCA0C7A48/Users/informant/AppData/Local/Google/Drive/user_default/sync_log.log
        
        And then pipe the following command
        
        grep -i deleting
  - - - Extract $LogFile
        
        icat -o 206848 cfreds_2015_data_leakage_pc. 2 > LogFileParser/logfile.bin
        
        Analyze extracted .csv
  - - - Extract the db
        
        icat -o 206848 cfreds_2015_data_leakage_pc.dd 490 > Windows.edb
      - Export the db to readable files
      - Exam each file