How much can be found?

  • We encourage our users to use Real Names to build a real community, friendships and networking opportunities.

    [more information]

Jun 16, 2018
3
0
#1
If I delete everything in my recycle bin, clear my cache, cookies & browser history AND run a program like CCleaner or SystemNinja, can anything I've been doing on my pc, really be found?
 

twicesafe

Administrator
Staff member
Sep 4, 2018
84
Ratings
20
8
Vancouver, Canada
www.computerforensicsworld.com
Twitter
Forensic_Notes
#3
The short answer is YES. But like anything in Digital Forensics, the real answer is...

It depends.

It depends on the version of CCleaner. It depends on the Operating System and version. It depends on the applications used. It depends on when CCleaner is run. It depends on if backups of your system were made. It depends on if your system utilizes full disk encryption.

It depends ....
 

azuleonyx

Member
Experienced Member
Oct 20, 2018
33
Ratings
29
18
Charlotte, North Carolina Area
cyberfenixtech.blogspot.com
Twitter
https://twitter.com/AzuleOnyx
#4
Also, note that unless whatever tool you use shreds the information to make it nearly unrecoverable then it will recoverable after some time when it is removed. SSDs actually are better to use for keeping things from being found then normal HDDs.
 

Lids

New Member
Experienced Member
Oct 23, 2018
22
Ratings
19
3
#5
Sometimes proving that CCleaner or equivalent was run can be just as damning -- reference to the files could still be found in MRU's, Registry (can use tools like Yaru for instance to undelete Registry items if the registry hasn't been compressed), Volume Shadow Copies, etc
 

azuleonyx

Member
Experienced Member
Oct 20, 2018
33
Ratings
29
18
Charlotte, North Carolina Area
cyberfenixtech.blogspot.com
Twitter
https://twitter.com/AzuleOnyx
#6
@Lids : You bring up an interesting point: the absent of data can be just as damaging as finding the data. Proving someone covered up deletion of data can lead investigators to know something was going on this would be the same as trying to clean up blood from a murder scene.
 

Lids

New Member
Experienced Member
Oct 23, 2018
22
Ratings
19
3
#7
Agreed @azuleonyx, sometimes proof that a cover-up has attempted to be performed - accompanied by other supporting evidence - will be exactly what's needed ahead of the custodian interview to obtain a confession or steer the conversation in a certain direction
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu