Advice Needed: General Computer Forensics Analysis after Employee Firing

eonxl · 08-04-2009, 05:34 AM

Hopefully I am posting this in the correct topic. I have been doing technical consulting for a number of years now, primarily doing database development, small business networking and web development.

Recently, one of my clients, for whom I had developed a custom customer contact system, was forced to fire one of their employees. I don't know the details of why this individual was fired, but I gather there are some fairly serious allegations.

I was asked by this client to do an analysis of the fired employee's workstation computer. They would like me to: recover any emails which might have been sent, do an anlaysis of recent web activity, and recover anything else which might potentially be part of a legal case against this employee if such becomes necessary in the future.

I have never been asked to do such an analysis before, and although I'm fairly technically savvy, I'm not sure how to approach this assignment.

I'm hoping to get some advice regarding what I should be looking for, any utilities (best if they are free) which might help me with such an analysis, and what areas of the system might contain the information I'd be looking for.

The computer I'm looking at has Vista Business Edition loaded, and Internet Explorer and MS Office are the primary applications used.

Any advice or suggestions would be greatly appreciated. Thanks in advance for your help!

--e

eonxl · 08-07-2009, 11:58 AM

Hey. I noticed no one has responded to me. I have to work on this analysis today, so if anyone has any ideas or suggestions, please offer them!

Thanks in advance! --eric

tetonbob · 08-10-2009, 09:50 PM

Hello -

We have no way of ascertaining whose machine you're asking about. In this type of forum setting, we have to take a cautious approach.

We do understand that the majority of requests may be legitimate, but we do not have the means to discern these from non-legitimate requests.

I'm sure as an experienced tech, you can find what you need by googling.

I'm sorry, but this thread is closed.

08-04-2009, 05:34 AM	#1 (permalink)
eonxl Registered User Join Date: Aug 2006 Location: so cal Posts: 6 OS: OS X 10.3.9	Advice Needed: General Computer Forensics Analysis after Employee Firing Hopefully I am posting this in the correct topic. I have been doing technical consulting for a number of years now, primarily doing database development, small business networking and web development. Recently, one of my clients, for whom I had developed a custom customer contact system, was forced to fire one of their employees. I don't know the details of why this individual was fired, but I gather there are some fairly serious allegations. I was asked by this client to do an analysis of the fired employee's workstation computer. They would like me to: recover any emails which might have been sent, do an anlaysis of recent web activity, and recover anything else which might potentially be part of a legal case against this employee if such becomes necessary in the future. I have never been asked to do such an analysis before, and although I'm fairly technically savvy, I'm not sure how to approach this assignment. I'm hoping to get some advice regarding what I should be looking for, any utilities (best if they are free) which might help me with such an analysis, and what areas of the system might contain the information I'd be looking for. The computer I'm looking at has Vista Business Edition loaded, and Internet Explorer and MS Office are the primary applications used. Any advice or suggestions would be greatly appreciated. Thanks in advance for your help! --e

08-07-2009, 11:58 AM	#2 (permalink)
eonxl Registered User Join Date: Aug 2006 Location: so cal Posts: 6 OS: OS X 10.3.9	Re: Advice Needed: General Computer Forensics Analysis after Employee Firing Hey. I noticed no one has responded to me. I have to work on this analysis today, so if anyone has any ideas or suggestions, please offer them! Thanks in advance! --eric

08-10-2009, 09:50 PM	#3 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,701 OS: 2000 Pro; XP Pro; XP Home	Re: Advice Needed: General Computer Forensics Analysis after Employee Firing Hello - We have no way of ascertaining whose machine you're asking about. In this type of forum setting, we have to take a cautious approach. We do understand that the majority of requests may be legitimate, but we do not have the means to discern these from non-legitimate requests. I'm sure as an experienced tech, you can find what you need by googling. I'm sorry, but this thread is closed. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009