Data file question

dalchina said:

You could have created a 3rd party disk image of the PC as received, and then restored it to exactly as was- indeed I hope the owner protected themselves by creating one before passing it to you.

Assuming you didn't (else you wouldn't be asking) you could, of course, search the entire Windows partition - assuming that's the only one in question- for all files created after the date you received the PC and review the result.

That's assuming you've already used it. If you haven't yet, there are other approaches.

One would be to create a virtual machine and work entirely within that, then delete it afterwards.

I have used it.

How do you search the entire Windows partition (there is only 1 parition in the PC, Windows is C:) - for all files created after the date I received the PC? Where to type and what to type?

How to create a virtural machine and work entirely within that?

Thanks

- - - Updated - - -

idgat said:

Boot into Linux distro and use that. Any data is only stored in the memory and lost when the device is shut down.

Alternatively, create your own Win 10 drive and just swap out/over the drives when you use the device

I do not know anything about Linux, I googled and it seems like Linux is unable to use Microsoft office.

How do you create your own Win 10 drive? I thought 1 PC can only install 1 Windows.

When you use a computer data WILL splatter all over hell and back. That's why just using a portable browser on someone else's PC is not a good idea. You'd want to disconnect the hard drive and boot something like a Linux live disk or Hiren's Boot CD and work from withen that environment.

Now that the deed has been done you could try the following:

You asked about dates of files when you last used the computer? Use the portable version of Everything.exe and click the Date Modified column. Now you can see what files were created since you got the PC. But be careful, you just can't delete everything willy-nilly. You need to know what you're doing.

The other thing you could do is run System Ninja. That will help get rid of some stuff left behind.

Then there's the registry to contend with. For that you're pretty much SOL unless you had made a full backup prior to you using the computer so that you could restore that backup.

There's also the shadow copies. To delete those run command prompt as Admin and run the following command: vssadmin delete shadows /for=c: /all.

Doing all this is fine and will help, but data is still there for the taking with file recovery software. Especially if it's a flash based HDD using wear-leveling. Consider the following from the Truecrypt encryption software manual on wear-leveling:

Wear-Leveling


Some storage devices (e.g., some solid-state drives, including USB flash drives) and some file
systems utilize so-called wear-leveling mechanisms to extend the lifetime of the storage device or
medium. These mechanisms ensure that even if an application repeatedly writes data to the same
logical sector, the data is distributed evenly across the medium (logical sectors are remapped to
different physical sectors). Therefore, multiple "versions" of a single sector may be available to an
attacker. This may have various security implications. For instance, when you change a volume
password/keyfile(s), the volume header is, under normal conditions, overwritten with a re-
encrypted version of the header. However, when the volume resides on a device that utilizes a
wear-leveling mechanism, TrueCrypt cannot ensure that the older header is really overwritten. If an
adversary found the old volume header (which was to be overwritten) on the device, he could use it
to mount the volume using an old compromised password (and/or using compromised keyfiles that
were necessary to mount the volume before the volume header was re-encrypted). Due to security
reasons, we recommend that TrueCrypt volumes are not created/stored on devices (or in file
systems) that utilize a wear-leveling mechanism (and that TrueCrypt is not used to encrypt any
portions of such devices or filesystems).

Downloads - voidtools

System Ninja - SingularLabs

F22 Simpilot said:

When you use a computer data WILL splatter all over hell and back. That's why just using a portable browser on someone else's PC is not a good idea. You'd want to disconnect the hard drive and boot something like a Linux live disk or Hiren's Boot CD and work from withen that environment.

Now that the deed has been done you could try the following:

You asked about dates of files when you last used the computer? Use the portable version of Everything.exe and click the Date Modified column. Now you can see what files were created since you got the PC. But be careful, you just can't delete everything willy-nilly. You need to know what you're doing.

The other thing you could do is run System Ninja. That will help get rid of some stuff left behind.

Then there's the registry to contend with. For that you're pretty much SOL unless you had made a full backup prior to you using the computer so that you could restore that backup.

There's also the shadow copies. To delete those run command prompt as Admin and run the following command: vssadmin delete shadows /for=c: /all.

Doing all this is fine and will help, but data is still there for the taking with file recovery software. Especially if it's a flash based HDD using wear-leveling. Consider the following from the Truecrypt encryption software manual on wear-leveling:



Downloads - voidtools

System Ninja - SingularLabs

Please teach me how to run vssadmin delete shadows /for=c: /all ?
In Windows 10 I right click start button>click Run>paste vssadmin delete shadows /for=c: /all into the box>click OK, then I see something like a rectangle flashed 1 second on the screen and disappeared, not sure if I have done correctly?