Posted: Mon Mar 30, 2015 3:05 am Post subject: Tool 2 remove traces of pc use after certain date
Thank you for reading this. I am absolutely new to the topic of forensics and was wondering if some of you can refer me towards a software tool that can remove selectively traces of pc-use in a windows7 based system (remove a time period).
I mean that there will be windows event logfiles and probably registry and other values on the system that can show that the pc has been used after a certain date and I would like to change such data in a way that the pc seems not to be used after a certain date.
Do you know a tool for that?
Thank you very much!
(for who wants to know my motivation:
It may sound strange, but the situation is that a friend of mine went into psychosis and I had to check roughly what he has been doing online all the time just before the psychosis started, in order to understand the course of events and maybe intervene. But he will use his pc again after some time and is an intelligent and paranoid person who will freak out when he somehow discovers that his pc has been used and re-enter a fictional existence in conspiracy theories, which will again destabilize him. I can't tell him either, since I need to keep his trust in order to be able to guide/help)
Joined: Nov 01, 2005 Posts: 551 Location: Marion, Indiana, USA
Posted: Mon Mar 30, 2015 6:14 am Post subject:
I seriously doubt you are going to be able to remove all traces of the system having been used since you did your examination on his actual computer instead of using an image of that drive (which is what you should have done). As it is, the only thing you could do is hope he doesn't notice that you were looking through his system.
Thanks for you input Cybercop.
2Late for the image way now. I will hope my efforts will go unnoticed for his sake, but was hoping as well that some of you could help with the most obvious traces, like changes in the windows event logs. I've already removed the recent locations superficially.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum