Evidence Report for Project: C6Prj04PD
Project Number: C6Prj04PD
Project Description:
Image Files:
File Name: C:\M57\M57 HDs\M57 E01 HDDs\charlie-2009-12-07.E01
Image File Type: Expert Witness Image
File Number:
Compressed image: No
Time Zone Information:
Time Zone: (GMT-08:00) Pacific Time (US & Canada); Tijuana (Pacific Standard Time)
Total Drive Information
Total Sectors : 19999728
Total Size : 9999864 KB
Hard Disk: C:
Volume Name:
Volume Serial Number : D8CC-759A
File System: NTFS
Bytes Per Sector: 512
Disks:
Evidence of Interest:
Total Evidence Items of Interest: 8
Hard Disk: PhysicalDrive0
List of Files:
ACL Information :
Owner :
Group :
Audit :S-1-5-21-682003330-329068152-1644491937-1003
[FILE READ]
[FILE WRITE] [APPEND DATA] [READ EXTENDED ATTRIBUTES]
[WRITE EXTENDED ATTRIBUTES] [FILE EXECUTE] [FILE READ
ATTRIBUTES]
[FILE WRITE ATTRIBUTES] [FILE DELETE CHILD] [DELETE]
[READ CONTROL] [WRITE DAC] [WRITE OWNER]
Permissions:S-1-5-32–544 BUILTIN\Administrators
[FILE READ]
[FILE WRITE] [APPEND DATA] [READ EXTENDED ATTRIBUTES]
[WRITE EXTENDED ATTRIBUTES] [FILE EXECUTE] [FILE READ
___________________________________________________________________________
_____________________
Accessed:12/07/2009 17:34
ACL Information :
Owner :
Group :
Audit :S-1-5-21-682003330-329068152-1644491937-1003
[FILE READ]
[FILE WRITE] [APPEND DATA] [READ EXTENDED ATTRIBUTES]
[WRITE EXTENDED ATTRIBUTES] [FILE EXECUTE] [FILE READ
ATTRIBUTES]
ATTRIBUTES]
[FILE WRITE ATTRIBUTES] [FILE DELETE CHILD] [DELETE]
[READ CONTROL] [WRITE DAC] [WRITE OWNER]
[SYNCHRONIZE] [STANDARD RIGHTS REQUIRED]
___________________________________________________________________________
_____________________
C:\M57\M57 HDs\M57 E01 HDDs\charlie-2009-12-07.E01\C:\Documents and
Settings\Charlie\Application Data\Thunderbird\Profiles\4zy34x9h.default\abook.mab
MD5 Checksum: 4AA31DF6CE08A66018C8ECC10DFCDFB3
Created:11/12/2009 18:58Modified:12/07/2009 13:55Last
Accessed:12/07/2009 13:55
Investigator’s comments: search term project2400
ACL Information :
Owner :
Group :
Audit :S-1-5-21-682003330-329068152-1644491937-1003
[FILE READ]
[FILE WRITE] [APPEND DATA] [READ EXTENDED ATTRIBUTES]
[WRITE EXTENDED ATTRIBUTES] [FILE EXECUTE] [FILE READ
ATTRIBUTES]
[FILE WRITE ATTRIBUTES] [FILE DELETE CHILD] [DELETE]
[READ CONTROL] [WRITE DAC] [WRITE OWNER]
[SYNCHRONIZE] [STANDARD RIGHTS REQUIRED]
Permissions:S-1-5-18 NT AUTHORITY\SYSTEM
___________________________________________________________________________
_____________________
Investigator’s comments: search term project2400
ACL Information :
Owner :
Group :
Audit :S-1-5-32-544 BUILTIN\Administrators
[FILE READ]
[FILE WRITE] [APPEND DATA] [READ EXTENDED ATTRIBUTES]
[WRITE EXTENDED ATTRIBUTES] [FILE EXECUTE] [FILE READ
ATTRIBUTES]
[FILE WRITE ATTRIBUTES] [FILE DELETE CHILD] [DELETE]
___________________________________________________________________________
_____________________
Investigator’s comments: search term project2400
ACL Information :
Owner :
Group :
Audit :S-1-5-32-544 BUILTIN\Administrators
[FILE READ]
[FILE WRITE] [APPEND DATA] [READ EXTENDED ATTRIBUTES]
[FILE WRITE] [APPEND DATA] [READ EXTENDED ATTRIBUTES]
_____________________
C:\M57\M57 HDs\M57 E01 HDDs\charlie-2009-12-07.E01\C:\Documents and
Accessed:12/07/2009 12:42
Investigator’s comments: search term project2400
ACL Information :
Owner :
Group :
Audit :S-1-5-21-682003330-329068152-1644491937-1003
Permissions:S-1-5-18 NT AUTHORITY\SYSTEM
[FILE READ]
[FILE WRITE] [APPEND DATA] [READ EXTENDED ATTRIBUTES]
[WRITE EXTENDED ATTRIBUTES] [FILE EXECUTE] [FILE READ
ATTRIBUTES]
[FILE WRITE ATTRIBUTES] [FILE DELETE CHILD] [DELETE]
[READ CONTROL] [WRITE DAC] [WRITE OWNER]
___________________________________________________________________________
_____________________
C:\M57\M57 HDs\M57 E01 HDDs\charlie-2009-12-07.E01\C:\Documents and
[FILE WRITE] [APPEND DATA] [READ EXTENDED ATTRIBUTES]
[WRITE EXTENDED ATTRIBUTES] [FILE EXECUTE] [FILE READ
ATTRIBUTES]
[FILE WRITE ATTRIBUTES] [FILE DELETE CHILD] [DELETE]
[READ CONTROL] [WRITE DAC] [WRITE OWNER]
[FILE READ]
[FILE WRITE] [APPEND DATA] [READ EXTENDED ATTRIBUTES]
[WRITE EXTENDED ATTRIBUTES] [FILE EXECUTE] [FILE READ
___________________________________________________________________________
_____________________
C:\M57\M57 HDs\M57 E01 HDDs\charlie-2009-12-07.E01\C:\Documents and
Settings\Charlie\Local Settings\Application
Accessed:11/20/2009 11:07
ACL Information :
Owner :
Group :
Audit :S-1-5-21-682003330-329068152-1644491937-1003
[FILE READ]
ATTRIBUTES]
[FILE WRITE ATTRIBUTES] [FILE DELETE CHILD] [DELETE]
[READ CONTROL] [WRITE DAC] [WRITE OWNER]
[SYNCHRONIZE] [STANDARD RIGHTS REQUIRED]
Permissions:S-1-5-32–544 BUILTIN\Administrators
[FILE READ]
___________________________________________________________________________
_____________________
C:\M57\M57 HDs\M57 E01 HDDs\charlie-2009–12-07.E01 Hard Disk PhysicalDrive0 :
Evidence of Interest: 8
Clusters of Interest:
File Signature Mismatch:
Registry Keys of Interest:
Event Log Entries of Interest:
Internet Activity Information:
Search Results:
Project Notes:
This Report was created by ProDiscover