Cyber Crime and Cyber Terrorism

68
CHAPTER 6
High-tech investigations of cyber crime 
information from old files, which may be fragments of important data related to 
the investigation. It is also possible for a user to hide information in this space 
so that it is not easily recoverable.
• 
Temporary Files
: many applications utilize temporary files when performing a 
function, such as when a user is working on a document or printing file. These 
files are typically deleted when the task is complete. However if there is an 
improper shutdown of the device, or it loses power, it is possible to recover and 
identify user actions.
• 
Deleted Files
: the way in which digital data is deleted means that in a lot of 
instances it is possible to recover the data. In most cases of deletion all that is 
actually done is the pointer to the file is removed, the actual data is still resident 
on the exhibit and can be recovered in a relatively easy manner.
As Windows is still the most common operating system, the following sections will 
briefly describe some of the core artifacts that may be of use during an investigation: 
including the significance of this information (also see Chapter 7).
WINDOWS LNK FILES
Windows uses shortcuts to provide links to files in other locations. This could 
be to an application on a desktop or to a document on a network store. These 
files are referred to as LNK (or link) as they have the file extension .lnk. Of 
particular interest to a high-tech investigator are the LNK files found within a 
user’s “
Recent
” folder. These files are created when a user opens a document 
and is the reference to the original document. LNK files are persistent which 
means they are there even after the target file is removed or no longer available. 
The “
Recent
” folder and LNK files are one of the first places an investigator will 
check when looking for user activity on a Windows-based system. These will 
provide information related to user activity; whether any external/remote drives 
are in use; and if any notable filenames can be found. LNK files include:
• The complete path to the original file
• Volume serial number: this is a unique reference to a partition (or volume)
• The size of the file that the LNK is pointing to
• MAC time stamps of the file the LNK is pointing to