Posted: Fri Dec 14, 2012 2:03 pm Post subject: SD Card Forensics (Advanced)
I need to find out if files were copied from my SD card.
The files were written onto the card on the 10th of November.
Then i gave away the SD card to someone on the same day, and i want to find out if this person copied the files.
After i got it back, i copied the files from the SD card onto my laptop myself and afterwards i deleted them, all on the same day November 10th.
The card is formatted in FAT 32
The files can still be recovered.
I know simply recovering the files will not get me going anywhere. FAT 32 does not even record the time accessed, only the date. However i know there still should be some other way through system volume information folder maybe...
Please, please, if anyone can help me i would really appreciate it.
Do you have a forensic image of the hard drive from the computer of the person you suspect copied the files? (And of course this presupposes that person only has access to one computer) If not you really have nothing, there is nothing on the SD card that will give any indication that the file was copied.
Posted: Mon Aug 26, 2013 10:21 am Post subject: Need to have forensic image , created the same time
When your friend return back your memory card U must have made forensic image of it immediately (use FTK image or Encase imging tool, available freely.).
Date modification, last access date could have given U some clue..
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum