References were also found within the UsrClass.dat registry files when the Dropbox client software was used, but not when a browser was used to access Dropbox. Dropbox software file references were located in the SOFTWARE and SYSTEM registry hives when the Dropbox client software was installed, but not when a browser was used to access or download data from Dropbox. Deleted Dropbox information was located within the NTUSER.dat registry files in the Chrome and IE CCleaner-VMs, such as filenames and URL references, but not in the Firefox CCleaner-VM. There were no references to the Dropbox username within the registry files in any of the VMs. Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs **All values printed in MRUList\MRUListEx order. For example, the “RecentDocs” key in the NTUSER.dat registry file provided a list of Dropbox and Enron related files and folders, and a sample RegRipper output is listed as follows: In the Upload-VM, Access-VM, and Download-VM registry files, there were references to the Dropbox URL, Dropbox software files and folders, the Dropbox sample files, and the Enron test files. Analysis revealed there were no references to Dropbox or the Enron sample files in the four control Base-VM hard drives. Registry files were analyzed using AccessData Registry Viewer 1.6.3.34 and RegRipper version 20080909.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |