Forensic picture evidence


New Member
Mar 15, 2019
how can i be sure that a person not only downloaded a picture accidentally but also opened the image on his computer.

What are the methods that can be used to prove that the person opened the image on the computer.

thanks in advance


Experienced Member
Oct 18, 2007
To prove, you need unambiguous traces. You need to find out what software capable of opening the image is or was available to the user on that computer, and you need to find out if that software leaves such traces. And you usually also need to establish that such traces are not left under any other circumstance than through opening the image using that software.

I assume you're referring to 'person' only as a convenience. If you're not, you may also have to establish who was using the computer or the computer account at that time.

As for accidentally vs. deliberately ... well, that's a different can of worms.


Experienced Member
Oct 23, 2018
To determine if someone opened an image, you could look through LNK files as well as MRU's for the file extension that the picture was saved in and software tools installed that are capable of opening files. I would suggest parsing the registry hives / link files and searching across them for your filename of interest

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu