0

I am analyzing a disk image for a forensic investigation and I see deleted files having a later date for last modified date than the last system log on date. Does this means someone has created a raw image file and delete those files from the forensic image and then burn it to the disk again. Can some one do this using a linux live CD.

2
  • Do you have any reason to believe / absolute proof that the last system log on date has not been tampered with? Or should you consider this the proof that it actually has been tampered with... And as a second thought: is that really an abnormal timeline? Because normally you log on - a log on date is recorded - you do some stuff (file modification times are after log on date) & don't log off and do some more stuff (file modification times are much longer after that log on date)
    – Bob
    May 7, 2021 at 6:55
  • yes We have informed the owner to turn the PC off. So he should never turn it on after that time. But he has take couple of more days to had over the disk to us which is suspicious. And we suspect he has taken a image of the disk and remove the malicious files and write the image to the disk again.
    – ragn3r
    May 7, 2021 at 9:30

0

You must log in to answer this question.

Browse other questions tagged .