6/29/2023 0 Comments My lock box software![]() ![]() You might, for example, look at the last accessed date/time of the LNK/shortcut file for "My Lockbox" as a potential date the program was last launched by the user meaning the date/time the user last double clicked on a desktop shortcut to "MyLockbox" and launching the program itself. If so, perhaps create a timeline of activity using EnCase or your favorite tool. In the registry files I have located keys called "FirstStart" and "LastOffer" which have hexadecimal values however I cannot link these locations back to the folder still.Īre you asking how to determine where the "My Lockbox" folder/file exists outside of the actual computer hard drive itself?įor example, if the target "locked" folder/file was stored on an external USB device or on a network server for example? I am trying to do this so I can prove the contents of the folder has been deliberately concealed. I have also completed a keyword search for the file path but still have no way of linking the program back to the folder. ![]() I can see the complete file structure and I can also see link files/MRU pointing to the folder in question. Yeah I have installed the software and had a play around with it myself. ![]() I'm not sure where any config files might be stored but it may be worth installing the software yourself on a test machine and having a play to see what you can find out. You may be able to link back via shortcuts if you can see the folder structure. I've used this software before and it doesn't stop the files from being listed in recent docs or the indexing process. Can you see the entire folder structure and all the files via EnCase?
0 Comments
Leave a Reply. |