Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: Swantao
New Today: 1
New Yesterday: 0
Overall: 29538

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 is it possible to verify if a HDD was wiped with DBAN
 Forenic artifacts if someone accessed a remote Win10?
 timeline analysis
 Hostile work enviornment
 Can anyone suggest me a topic under printers forensics

Computer Forensics World Forums


Pages Served
We received
56075183
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - SD Card Forensics (Advanced)
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

SD Card Forensics (Advanced)

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues
View previous topic :: View next topic  
Author Message
noname911
Newbie
Newbie


Joined: Dec 13, 2012
Posts: 1

PostPosted: Fri Dec 14, 2012 2:03 pm    Post subject: SD Card Forensics (Advanced) Reply with quote

Hi
I need to find out if files were copied from my SD card.
The files were written onto the card on the 10th of November.
Then i gave away the SD card to someone on the same day, and i want to find out if this person copied the files.
After i got it back, i copied the files from the SD card onto my laptop myself and afterwards i deleted them, all on the same day November 10th.
The card is formatted in FAT 32
The files can still be recovered.
I know simply recovering the files will not get me going anywhere. FAT 32 does not even record the time accessed, only the date. However i know there still should be some other way through system volume information folder maybe...
Please, please, if anyone can help me i would really appreciate it.
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Sat Dec 15, 2012 2:20 am    Post subject: Reply with quote

Do you have a forensic image of the hard drive from the computer of the person you suspect copied the files? (And of course this presupposes that person only has access to one computer) If not you really have nothing, there is nothing on the SD card that will give any indication that the file was copied.
Back to top
View user's profile
vaibhavs
Newbie
Newbie


Joined: Sep 21, 2012
Posts: 4

PostPosted: Mon Aug 26, 2013 10:21 am    Post subject: Need to have forensic image , created the same time Reply with quote

Hello friend,
When your friend return back your memory card U must have made forensic image of it immediately (use FTK image or Encase imging tool, available freely.).
Date modification, last access date could have given U some clue..Smile
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.