Patrick Leahy Center for Digital Investigation (LCDI) Internet Evidence Finder Report Written and Researched by Nick Murray 175 Lakeside Ave, Room 300A Phone: 802/865-5744 Fax: 802/865-6446 http://www.lcdi.champlin.edu July 2013 IEF Report 6/28/2013 Page 1 of 33 Patrick Leahy Center for Digital Investigation (LCDI) Disclaimer: This document contains information based on research that has been gathered by employee(s) of The Senator Patrick Leahy Center for Digital Investigation (LCDI). The data contained in this project is submitted voluntarily and is unaudited. Every effort has been made by LCDI to assure the accuracy and reliability of the data contained in this report. However, LCDI nor any of our employees make no representation, warranty or guarantee in connection with this report and hereby expressly disclaims any liability or responsibility for loss or damage resulting from use of this data. Information in this report can be downloaded and redistributed by any person or persons. Any redistribution must maintain the LCDI logo and any references from this report must be properly annotated. Contents Introduction ............................................................................................................................................................. 5 Prior Work: .......................................................................................................................................................... 7 Purpose and Scope: ............................................................................................................................................. 7 Research Questions: ............................................................................................................................................ 7 Methodology and Methods ..................................................................................................................................... 7 Reference Set: ................................................................................................................................................... 10 1 Software ......................................................................................................................................................... 10 2 Equipment ...................................................................................................................................................... 11 2.1 Write Blocker ......................................................................................................................................... 11 Results ................................................................................................................................................................... 11 IEF Report ......................................................................................................................................................... 12 Chat ................................................................................................................................................................... 13 AIM ............................................................................................................................................................... 14 Google Talk ................................................................................................................................................... 14 ICQ ................................................................................................................................................................ 14 MIRC ............................................................................................................................................................. 14 ooVoo ............................................................................................................................................................ 15 Skype ............................................................................................................................................................. 15 Trillian ........................................................................................................................................................... 17 Yahoo Messenger .......................................................................................................................................... 17 Cloud ................................................................................................................................................................. 18 Dropbox ......................................................................................................................................................... 18 IEF Report 6/28/2013 Page 2 of 33 Patrick Leahy Center for Digital Investigation (LCDI) Flickr .............................................................................................................................................................. 19 Google Docs .................................................................................................................................................. 19 Google Drive ................................................................................................................................................. 20 Google Drive Desktop App ........................................................................................................................... 20 Skydrive ......................................................................................................................................................... 21 Email ................................................................................................................................................................. 22 Gmail Fragments ........................................................................................................................................... 22 Gmail Webmail.............................................................................................................................................. 23 Hotmail Webmail .......................................................................................................................................... 23 Yahoo Webmail ............................................................................................................................................. 24 Mobile Backups................................................................................................................................................. 24 iOS backup .................................................................................................................................................... 24 Web History ...................................................................................................................................................... 24 Google Chrome.............................................................................................................................................. 24 Firefox ........................................................................................................................................................... 25 Internet Explorer ............................................................................................................................................ 26 Opera ............................................................................................................................................................. 26 Safari .............................................................................................................................................................. 27 Peer to Peer........................................................................................................................................................ 27 torrent File Fragments ................................................................................................................................... 27 Ares search keywords .................................................................................................................................... 27 Emule Search Keywords ............................................................................................................................... 28 Limewire/Frostwire ....................................................................................................................................... 28 Social Networking ............................................................................................................................................. 29 Bebo ............................................................................................................................................................... 29 Facebook Chat ............................................................................................................................................... 30 Facebook Pages ............................................................................................................................................. 30 Google+ ......................................................................................................................................................... 30 LinkedIn......................................................................................................................................................... 30 MySpace .......................................................................................................................................................