Overclock.net › Forums › Components › Hard Drives & Storage › URGENT: Information Stolen from Flash Storage- Able to track what happened???
New Posts  All Forums:Forum Nav:

URGENT: Information Stolen from Flash Storage- Able to track what happened??? - Page 5

post #41 of 48
Thread Starter 
Quote:
Originally Posted by tpi2007 View Post


I just answered my own question when unimatrixzero posted the link to Recuva. I made a text file on a removable drive and then deleted it a few minutes later. Recuva shows as "Last Modified" the time I created it, not the time I deleted it. So apparently, when the file is deleted, the OS only marks it as ready to be overwritten in the file system and doesn't change anything else.

So are you saying I should try Recuva, as it will have the old time stamps?


Installing now...

OMG TPI2007 I LOVE YOU



Those are OLD timestamps biggrin.gif Also, yes, that is mainly music. Theres a ton of files i now need to sort through lol


EDIT: It didnt pick up any of the documents on the 'top-layer' scan, i changed the settings to a deep-scan. Should take like 20 minutes. Then i might be able to find the old timestamps and solve this mystery!
Edited by Eric335 - 10/28/13 at 10:01pm
    
CPUMotherboardGraphicsRAM
i5-3570k ASUS MAXIMUS V FORMULA Gigabyte GTX 670 G.SKILL Ripjaws X Series 16GB (2 x 8GB) 240-Pin... 
Hard DriveHard DriveOptical DriveCooling
Hitachi 2TB 7200RPM Crucial M4 128GB SSD ASUS 24X DVD-Burner Corsair H100 Extreme Liquid Cooling 
CoolingCoolingOSMonitor
NZXT Blue LED 140mm Fans NZXT Switch 810 Case Fbnans- 140mm Windows 7 Professional 64-Bit ASUS VE278Q 
KeyboardPowerCaseMouse
Logitech G510 Antec High Current Gamer Series 900W PSU NZXT Switch 810 Mionix Naos 3200 
Mouse PadAudioAudioOther
Kensington 56001 Optical-Enhancing Mouse Pad JVC Sound System Corsair Vengeance 2000 NZXT Sentry-2 Fan Controller 
Other
NZXT Hue 
  hide details  
Reply
    
CPUMotherboardGraphicsRAM
i5-3570k ASUS MAXIMUS V FORMULA Gigabyte GTX 670 G.SKILL Ripjaws X Series 16GB (2 x 8GB) 240-Pin... 
Hard DriveHard DriveOptical DriveCooling
Hitachi 2TB 7200RPM Crucial M4 128GB SSD ASUS 24X DVD-Burner Corsair H100 Extreme Liquid Cooling 
CoolingCoolingOSMonitor
NZXT Blue LED 140mm Fans NZXT Switch 810 Case Fbnans- 140mm Windows 7 Professional 64-Bit ASUS VE278Q 
KeyboardPowerCaseMouse
Logitech G510 Antec High Current Gamer Series 900W PSU NZXT Switch 810 Mionix Naos 3200 
Mouse PadAudioAudioOther
Kensington 56001 Optical-Enhancing Mouse Pad JVC Sound System Corsair Vengeance 2000 NZXT Sentry-2 Fan Controller 
Other
NZXT Hue 
  hide details  
Reply
post #42 of 48
Quote:
Originally Posted by Eric335 View Post

So are you saying I should try Recuva, as it will have the old time stamps?


Installing now...

OMG TPI2007 I LOVE YOU



Those are OLD timestamps biggrin.gif Also, yes, that is mainly music. Theres a ton of files i now need to sort through lol
Ahhh, I couldn't help but notice Karel.
That was how I learned Java as well.
A lot of fun was had with those robots... biggrin.gif
 
Phantom
(18 items)
 
z77 mITX
(9 items)
 
CPUMotherboardGraphicsRAM
Intel i7 5930k Asus Rampage V Extreme Gigabyte Gtx 980 g1 Edition G.Skill Ripjaws 4 16gb (4x4Gb) Ddr4-2666 
CoolingCoolingCoolingCooling
Corsair Hydro h105 (4) Corsair Sp120 w/ Red LEDs (1) Corsair Af140 w/ Red LEDs (3) Corsair Af120 w/ Red LEDs 
MonitorPowerCaseOther
Acer XB280HK Evga 1300 g2 Corsair Carbide Air 540 Evga Individually Sleeved Cable Set for Evga B2... 
CPUMotherboardGraphicsRAM
Intel i7 3770 Evga z77 Stinger Evga 750 Ti G.Skill Ripjaws 8gb (2x4gb) Ddr3-1600 (Red) 
Hard DriveHard DriveOptical DrivePower
Ocz Vertex 460 120gb Solid State Drive Western Digital Black - 1Tb Evga Slim Slot-Load Dvd-Rw SilverStone ST45SF-G 450w 
Case
SilverStone Raven Series Rvz01b 
  hide details  
Reply
 
Phantom
(18 items)
 
z77 mITX
(9 items)
 
CPUMotherboardGraphicsRAM
Intel i7 5930k Asus Rampage V Extreme Gigabyte Gtx 980 g1 Edition G.Skill Ripjaws 4 16gb (4x4Gb) Ddr4-2666 
CoolingCoolingCoolingCooling
Corsair Hydro h105 (4) Corsair Sp120 w/ Red LEDs (1) Corsair Af140 w/ Red LEDs (3) Corsair Af120 w/ Red LEDs 
MonitorPowerCaseOther
Acer XB280HK Evga 1300 g2 Corsair Carbide Air 540 Evga Individually Sleeved Cable Set for Evga B2... 
CPUMotherboardGraphicsRAM
Intel i7 3770 Evga z77 Stinger Evga 750 Ti G.Skill Ripjaws 8gb (2x4gb) Ddr3-1600 (Red) 
Hard DriveHard DriveOptical DrivePower
Ocz Vertex 460 120gb Solid State Drive Western Digital Black - 1Tb Evga Slim Slot-Load Dvd-Rw SilverStone ST45SF-G 450w 
Case
SilverStone Raven Series Rvz01b 
  hide details  
Reply
post #43 of 48
Quote:
Originally Posted by Eric335 View Post

Quote:
Originally Posted by tpi2007 View Post


I just answered my own question when unimatrixzero posted the link to Recuva. I made a text file on a removable drive and then deleted it a few minutes later. Recuva shows as "Last Modified" the time I created it, not the time I deleted it. So apparently, when the file is deleted, the OS only marks it as ready to be overwritten in the file system and doesn't change anything else.

So are you saying I should try Recuva, as it will have the old time stamps?


Installing now...

OMG TPI2007 I LOVE YOU



Those are OLD timestamps biggrin.gif Also, yes, that is mainly music. Theres a ton of files i now need to sort through lol


As much as I love to be loved thumb.gif, that doesn't really help you that much.

It doesn't tell you when the files were deleted although it does tell you when they were last modified, so at least you can check against your backups and be sure that they were not tampered with while on the flash drive. However, that doesn't tell you if they were copied to another drive.
 
Metro 2033 review
Metro 2033
CPUMotherboardGraphicsRAM
Core i7-3820 Asus Sabertooth X79 MSI GTX 750 Ti TF Gaming 16 GB Corsair DDR3 1866 Mhz Dominator 
Hard DriveOptical DriveCoolingOS
Samsung SSD 830 128GB + WD Caviar Black 1TB Sony Optiarc DVD-RW Corsair A70 + Noiseblocker M12-P Windows 7 Home Premium 64-bit 
MonitorKeyboardPowerCase
BenQ RL2455HM Cooler Master Octane Corsair AX750 Professional Modular 80 Plus Gold Cooler Master HAF 912 Plus 
Mouse
Cooler Master Octane 
  hide details  
Reply
 
Metro 2033 review
Metro 2033
CPUMotherboardGraphicsRAM
Core i7-3820 Asus Sabertooth X79 MSI GTX 750 Ti TF Gaming 16 GB Corsair DDR3 1866 Mhz Dominator 
Hard DriveOptical DriveCoolingOS
Samsung SSD 830 128GB + WD Caviar Black 1TB Sony Optiarc DVD-RW Corsair A70 + Noiseblocker M12-P Windows 7 Home Premium 64-bit 
MonitorKeyboardPowerCase
BenQ RL2455HM Cooler Master Octane Corsair AX750 Professional Modular 80 Plus Gold Cooler Master HAF 912 Plus 
Mouse
Cooler Master Octane 
  hide details  
Reply
post #44 of 48
Thread Starter 
Quote:
Originally Posted by tpi2007 View Post

As much as I love to be loved thumb.gif, that doesn't really help you that much.

It doesn't tell you when the files were deleted although it does tell you when they were last modified, so at least you can check against your backups and be sure that they were not tampered with while on the flash drive. However, that doesn't tell you if they were copied to another drive.


Once this scan is done ill see what it says. I fear you may be right, in that it has the timestamp before it was deleted or moved.


EDIT: Yeah these dates dont seem to be accurate. Its telling me dates of essays that are ~6 months before they were actually written...

Quote:
Originally Posted by Jwilliams01207 View Post

Ahhh, I couldn't help but notice Karel.
That was how I learned Java as well.
A lot of fun was had with those robots... biggrin.gif

Oh yes, AP Programming. KarlJMain doing his Java thing.





Alright, i guess ill have to settle everything tomorrow and see where we can go from there. This is a dead end frown.gif

Thanks to everyone who helped me. I really appreciate it.thumb.gif
Edited by Eric335 - 10/28/13 at 10:12pm
    
CPUMotherboardGraphicsRAM
i5-3570k ASUS MAXIMUS V FORMULA Gigabyte GTX 670 G.SKILL Ripjaws X Series 16GB (2 x 8GB) 240-Pin... 
Hard DriveHard DriveOptical DriveCooling
Hitachi 2TB 7200RPM Crucial M4 128GB SSD ASUS 24X DVD-Burner Corsair H100 Extreme Liquid Cooling 
CoolingCoolingOSMonitor
NZXT Blue LED 140mm Fans NZXT Switch 810 Case Fbnans- 140mm Windows 7 Professional 64-Bit ASUS VE278Q 
KeyboardPowerCaseMouse
Logitech G510 Antec High Current Gamer Series 900W PSU NZXT Switch 810 Mionix Naos 3200 
Mouse PadAudioAudioOther
Kensington 56001 Optical-Enhancing Mouse Pad JVC Sound System Corsair Vengeance 2000 NZXT Sentry-2 Fan Controller 
Other
NZXT Hue 
  hide details  
Reply
    
CPUMotherboardGraphicsRAM
i5-3570k ASUS MAXIMUS V FORMULA Gigabyte GTX 670 G.SKILL Ripjaws X Series 16GB (2 x 8GB) 240-Pin... 
Hard DriveHard DriveOptical DriveCooling
Hitachi 2TB 7200RPM Crucial M4 128GB SSD ASUS 24X DVD-Burner Corsair H100 Extreme Liquid Cooling 
CoolingCoolingOSMonitor
NZXT Blue LED 140mm Fans NZXT Switch 810 Case Fbnans- 140mm Windows 7 Professional 64-Bit ASUS VE278Q 
KeyboardPowerCaseMouse
Logitech G510 Antec High Current Gamer Series 900W PSU NZXT Switch 810 Mionix Naos 3200 
Mouse PadAudioAudioOther
Kensington 56001 Optical-Enhancing Mouse Pad JVC Sound System Corsair Vengeance 2000 NZXT Sentry-2 Fan Controller 
Other
NZXT Hue 
  hide details  
Reply
post #45 of 48
Just to add two things, one of which might actually help you:

1. I recovered the text file I made earlier to my computer and checked the properties and Recuva actually keeps the timestamps from the deleted file instead of creating a new file with identical content but with a new timestamp;

2. This might actually help you: in the Recuva tabs to the right there is one called "Info", there you can find the "Last access time" information. Then you can check with the time you were at school and determine if the kid is telling the truth or not. If the last access time is hours later he may have accessed the files at home.
Edited by tpi2007 - 10/28/13 at 10:16pm
 
Metro 2033 review
Metro 2033
CPUMotherboardGraphicsRAM
Core i7-3820 Asus Sabertooth X79 MSI GTX 750 Ti TF Gaming 16 GB Corsair DDR3 1866 Mhz Dominator 
Hard DriveOptical DriveCoolingOS
Samsung SSD 830 128GB + WD Caviar Black 1TB Sony Optiarc DVD-RW Corsair A70 + Noiseblocker M12-P Windows 7 Home Premium 64-bit 
MonitorKeyboardPowerCase
BenQ RL2455HM Cooler Master Octane Corsair AX750 Professional Modular 80 Plus Gold Cooler Master HAF 912 Plus 
Mouse
Cooler Master Octane 
  hide details  
Reply
 
Metro 2033 review
Metro 2033
CPUMotherboardGraphicsRAM
Core i7-3820 Asus Sabertooth X79 MSI GTX 750 Ti TF Gaming 16 GB Corsair DDR3 1866 Mhz Dominator 
Hard DriveOptical DriveCoolingOS
Samsung SSD 830 128GB + WD Caviar Black 1TB Sony Optiarc DVD-RW Corsair A70 + Noiseblocker M12-P Windows 7 Home Premium 64-bit 
MonitorKeyboardPowerCase
BenQ RL2455HM Cooler Master Octane Corsair AX750 Professional Modular 80 Plus Gold Cooler Master HAF 912 Plus 
Mouse
Cooler Master Octane 
  hide details  
Reply
post #46 of 48
Thread Starter 
Quote:
Originally Posted by tpi2007 View Post

Just to add two things, one of which might actually help you:

1. I recovered the text file I made earlier to my computer and checked the properties and Recuva actually keeps the timestamps from the deleted file instead of creating a new file with identical content but with a new timestamp;

2. This might actually help you: in the Recuva tabs to the right there is one called "Info", there you can find the "Last access time" information. Then you can check with the time you were at school and determine if the kid is telling the truth or not. If the last access time is hours later he may have accessed the files at home.

This is exactly what I am looking for. Im re-running the deep scan now to see what i can get off of it. thumb.gif For some reason, even though it would have been the latest files to be modified, Recuva was saying that they were unrecoverable. Which doesnt make much sense since its an 8GB flashdrive with like 4% usage.

Finishing the scan now, will report back in a second.


EDIT:

Alright, well that was helpful but im still somewhat confused. A few documents were accessed on 10/15 which i believe is the day i lost the drive. Its been a while between when I lost it and when it was finally returned to me. It seems that there was a few items that were viewed on the 15th itself, but theres no time stamp (as in it states 10/15/2013 00:00 ). Im not sure what timestamps would change when it was delted (the modified or the last accessed) but neither seem to be changed.


Ill do some more digging in the morning, but for now, this is a good start.
Edited by Eric335 - 10/28/13 at 10:41pm
    
CPUMotherboardGraphicsRAM
i5-3570k ASUS MAXIMUS V FORMULA Gigabyte GTX 670 G.SKILL Ripjaws X Series 16GB (2 x 8GB) 240-Pin... 
Hard DriveHard DriveOptical DriveCooling
Hitachi 2TB 7200RPM Crucial M4 128GB SSD ASUS 24X DVD-Burner Corsair H100 Extreme Liquid Cooling 
CoolingCoolingOSMonitor
NZXT Blue LED 140mm Fans NZXT Switch 810 Case Fbnans- 140mm Windows 7 Professional 64-Bit ASUS VE278Q 
KeyboardPowerCaseMouse
Logitech G510 Antec High Current Gamer Series 900W PSU NZXT Switch 810 Mionix Naos 3200 
Mouse PadAudioAudioOther
Kensington 56001 Optical-Enhancing Mouse Pad JVC Sound System Corsair Vengeance 2000 NZXT Sentry-2 Fan Controller 
Other
NZXT Hue 
  hide details  
Reply
    
CPUMotherboardGraphicsRAM
i5-3570k ASUS MAXIMUS V FORMULA Gigabyte GTX 670 G.SKILL Ripjaws X Series 16GB (2 x 8GB) 240-Pin... 
Hard DriveHard DriveOptical DriveCooling
Hitachi 2TB 7200RPM Crucial M4 128GB SSD ASUS 24X DVD-Burner Corsair H100 Extreme Liquid Cooling 
CoolingCoolingOSMonitor
NZXT Blue LED 140mm Fans NZXT Switch 810 Case Fbnans- 140mm Windows 7 Professional 64-Bit ASUS VE278Q 
KeyboardPowerCaseMouse
Logitech G510 Antec High Current Gamer Series 900W PSU NZXT Switch 810 Mionix Naos 3200 
Mouse PadAudioAudioOther
Kensington 56001 Optical-Enhancing Mouse Pad JVC Sound System Corsair Vengeance 2000 NZXT Sentry-2 Fan Controller 
Other
NZXT Hue 
  hide details  
Reply
post #47 of 48
Quote:
Originally Posted by Eric335 View Post

Quote:
Originally Posted by tpi2007 View Post

Just to add two things, one of which might actually help you:

1. I recovered the text file I made earlier to my computer and checked the properties and Recuva actually keeps the timestamps from the deleted file instead of creating a new file with identical content but with a new timestamp;

2. This might actually help you: in the Recuva tabs to the right there is one called "Info", there you can find the "Last access time" information. Then you can check with the time you were at school and determine if the kid is telling the truth or not. If the last access time is hours later he may have accessed the files at home.

This is exactly what I am looking for. Im re-running the deep scan now to see what i can get off of it. thumb.gif For some reason, even though it would have been the latest files to be modified, Recuva was saying that they were unrecoverable. Which doesnt make much sense since its an 8GB flashdrive with like 4% usage.

Finishing the scan now, will report back in a second.


EDIT:

Alright, well that was helpful but im still somewhat confused. A few documents were accessed on 10/15 which i believe is the day i lost the drive. Its been a while between when I lost it and when it was finally returned to me. It seems that there was a few items that were viewed on the 15th itself, but theres no time stamp (as in it states 10/15/2013 00:00 ). Im not sure what timestamps would change when it was delted (the modified or the last accessed) but neither seem to be changed.


Ill do some more digging in the morning, but for now, this is a good start.

Hmm, I just did another test text file, it seems the access time is erased (shows 00:00 just like you said) when the file is deleted, only the date remains. It seems like you won't be able to tell if the kid or someone else accessed the files before deleting them :/ .
Edited by tpi2007 - 10/28/13 at 11:25pm
 
Metro 2033 review
Metro 2033
CPUMotherboardGraphicsRAM
Core i7-3820 Asus Sabertooth X79 MSI GTX 750 Ti TF Gaming 16 GB Corsair DDR3 1866 Mhz Dominator 
Hard DriveOptical DriveCoolingOS
Samsung SSD 830 128GB + WD Caviar Black 1TB Sony Optiarc DVD-RW Corsair A70 + Noiseblocker M12-P Windows 7 Home Premium 64-bit 
MonitorKeyboardPowerCase
BenQ RL2455HM Cooler Master Octane Corsair AX750 Professional Modular 80 Plus Gold Cooler Master HAF 912 Plus 
Mouse
Cooler Master Octane 
  hide details  
Reply
 
Metro 2033 review
Metro 2033
CPUMotherboardGraphicsRAM
Core i7-3820 Asus Sabertooth X79 MSI GTX 750 Ti TF Gaming 16 GB Corsair DDR3 1866 Mhz Dominator 
Hard DriveOptical DriveCoolingOS
Samsung SSD 830 128GB + WD Caviar Black 1TB Sony Optiarc DVD-RW Corsair A70 + Noiseblocker M12-P Windows 7 Home Premium 64-bit 
MonitorKeyboardPowerCase
BenQ RL2455HM Cooler Master Octane Corsair AX750 Professional Modular 80 Plus Gold Cooler Master HAF 912 Plus 
Mouse
Cooler Master Octane 
  hide details  
Reply
post #48 of 48
Quote:
Originally Posted by tpi2007 View Post

Hmm, I just did another test text file, it seems the access time is erased (shows 00:00 just like you said) when the file is deleted, only the date remains. It seems like you won't be able to tell if the kid or someone else accessed the files before deleting them :/ .

umless it was the day after or so.

id be using your school deputy's authority in this one. and have the kid in his office for a direct Q&A, if hes lying hardcore, he'll slip up.
Orange Angel
(23 items)
 
 
BOINC me! (TM)
(9 items)
 
CPUMotherboardGraphicsRAM
i5 2500k @ 4.8Ghz ASUS P8Z77-I Deluxe  Visiontek RX 480 [EK FC nickel/Acetal] 16GB Mushkin Blackline 2133mhz @11-11-11-31-1T 
Hard DriveHard DriveHard DriveCooling
Samsung 840 EVO 120GB Crucial M300 1TB Seagate Firecuda 2TB EK Supreme LTX CSQ [Canadian Special Edition] 
CoolingCoolingCoolingCooling
MCP 35X 10W W/ EK CSQ X-TOP EK Coolstream PE 240 Bitspower Multi Tank 80 Bitspower Matte Black Rotary Fittings/ Feser Ma... 
OSMonitorMonitorKeyboard
Windows 10 Professional 64-Bit Samsung 32 Inch 4K TV Acer S231H NKPC V60 65% custom  
PowerCaseMouseMouse Pad
Corsair HX750 Fractal Design Define Nano S Razer Deathadder 2013 Stelseries QCK+ 
AudioOther
Astro A40 TR+ Mixamp Pro AKRacing Arctica Gaming Chair 
CPUCPUCoolingPower
Antminer S3 Antminer S3 4x Cougar Vortex V12-HP PWM Fans EVGA 500B 500W PSU, Corsair GS700 700W PSU 
Case
2x Factory S3 Steel Cowl Case 
CPUMotherboardGraphicsGraphics
i5 750 EVGA P55 Classified 200 XFX Radeon 6850 Refrerence XFX Radeon 5770 XXX 
RAMHard DriveCoolingOS
16GB Kingston HyperX Genesis DDR3 WD Caviar RE 250GB Coolermaster Hyper 212+ windows 7 64 bit 
Power
Corsair GS600 
  hide details  
Reply
Orange Angel
(23 items)
 
 
BOINC me! (TM)
(9 items)
 
CPUMotherboardGraphicsRAM
i5 2500k @ 4.8Ghz ASUS P8Z77-I Deluxe  Visiontek RX 480 [EK FC nickel/Acetal] 16GB Mushkin Blackline 2133mhz @11-11-11-31-1T 
Hard DriveHard DriveHard DriveCooling
Samsung 840 EVO 120GB Crucial M300 1TB Seagate Firecuda 2TB EK Supreme LTX CSQ [Canadian Special Edition] 
CoolingCoolingCoolingCooling
MCP 35X 10W W/ EK CSQ X-TOP EK Coolstream PE 240 Bitspower Multi Tank 80 Bitspower Matte Black Rotary Fittings/ Feser Ma... 
OSMonitorMonitorKeyboard
Windows 10 Professional 64-Bit Samsung 32 Inch 4K TV Acer S231H NKPC V60 65% custom  
PowerCaseMouseMouse Pad
Corsair HX750 Fractal Design Define Nano S Razer Deathadder 2013 Stelseries QCK+ 
AudioOther
Astro A40 TR+ Mixamp Pro AKRacing Arctica Gaming Chair 
CPUCPUCoolingPower
Antminer S3 Antminer S3 4x Cougar Vortex V12-HP PWM Fans EVGA 500B 500W PSU, Corsair GS700 700W PSU 
Case
2x Factory S3 Steel Cowl Case 
CPUMotherboardGraphicsGraphics
i5 750 EVGA P55 Classified 200 XFX Radeon 6850 Refrerence XFX Radeon 5770 XXX 
RAMHard DriveCoolingOS
16GB Kingston HyperX Genesis DDR3 WD Caviar RE 250GB Coolermaster Hyper 212+ windows 7 64 bit 
Power
Corsair GS600 
  hide details  
Reply
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Hard Drives & Storage
Overclock.net › Forums › Components › Hard Drives & Storage › URGENT: Information Stolen from Flash Storage- Able to track what happened???