Deleted Dropbox information was located within the NTUSER.dat registry files in the Chrome and IE CCleaner-VMs, such as filenames and URL references, but not in the Firefox CCleaner-VM. There were no references to the Dropbox username within the registry files in any of the VMs. **All values printed in MRUList\MRUListEx order. ![]() For example, the “RecentDocs” key in the NTUSER.dat registry file provided a list of Dropbox and Enron related files and folders, and a sample RegRipper output is listed as follows: In the Upload-VM, Access-VM, and Download-VM registry files, there were references to the Dropbox URL, Dropbox software files and folders, the Dropbox sample files, and the Enron test files. Analysis revealed there were no references to Dropbox or the Enron sample files in the four control Base-VM hard drives. ![]() Registry files were analyzed using AccessData Registry Viewer 1.6.3.34 and RegRipper version 20080909.
0 Comments
Leave a Reply. |