Version française   Home | Contact Us

Example


Example of the kind of search work we usually perform on a PC equipped with Windows:

  • Surfing on the web Even if a user thinks that he/she has deleted the cache memory, it is still possible to recover the last operations on the Web and to draw up a list of the websites consulted with the date, time and list of the files viewed. To make this list easier to use, LERTI lists the consulted websites in order of frequency and copies the images into the navigator cache memory.

  • Messaging and e-mails. The message service and its attachments can sometimes be entirely reconstructed. Most often, fragments of e-mails can be recovered.

  • Deleted images.LERTI are equipped with software programs capable of wholly or partly reconstructing deleted images, depending on how long ago they were deleted.

  • Cookies are small files placed on the user’s hard disk while the user is consulting the web. The list of cookies along with the date and time can be very useful in discovering where the user surfed.

  • The "Recent" log gives details of the last files used, even if these files are no longer in the computer.

  • The trash bin and the super trash bin (sometimes inserted by anti-virus software such as Norton) give a list of the last files deleted.

  • Character string-based searches work in the same way as the Windows "start", "search" and "files" functions, but can search the entire disk, including deleted files, non-allocated sectors and cluster stacks. We are capable of finding the slightest remaining fragment of text located in any of these places that are inaccessible to the user.


  • © 2017 Lerti: Computer forensics - Legal clauses - Computer forensics, evidence collection, traces, electronic investigations - Compiled by Kreatys