Wednesday, August 29, 2018

Daily Blog #467: Forensic Lunch Test Kitchen 8/29/18

Hello Reader,
        I've had a string of test kitchens this week all revolving around ObjectIDs. Today I extend and test Ken Pryor's testing in his blog (https://digiforensics.blogspot.com/2018/08/life-update-little-object-id-research.html) regarding how objectids are retained on copying and pasting versus cut and paste within two ntfs volumes. I did my testing in Windows 7 and validated what Ken had found in his post.

In addition we did some testing with:

  • ObjectIDs and FAT file systems
  • Do directories get ObjectIDs in Windows 7?
  • Does Privazer or CCleaner get rid of ObjectIDs?
  • Why do we care about ObjectIDs so much?

You can watch the broadcast here: