Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
they often do a pretty lousy job of disappearing. Temp files are often abandoned, frequently
as a consequence of a program lock up, power interruption or other atypical shut down.
When the application is restarted, it creates new temp file, but rarely does away with the
predecessor file. It just hangs around indefinitely. Even when the application does delete the
temp file, the contents of the file tend to remain in unallocated space until overwritten, as with
any other deleted file.
As an experiment, search your hard drive for all files with the .TMP extension. You can
usually do this with the search query “*.TMP.” You may have to adjust your system settings
to allow viewing of system and hidden files. When you get the list, forget any with a current
date and look for .TMP files from prior days. Open those in Notepad or WordPad and you
may be shocked to see how much of your work hangs around without your knowledge. Word
processing applications are by no means the only types which keep (and abandon) temp
files.
Files with the .BAK extensions (or a variant) usually represent timed back ups of work in
progress maintained to protect a user in the even of a system crash or program lock up.
Applications, in particular word processing software, create .BAK files at periodic intervals.
These applications may also be configured to save earlier versions of documents that have
been changed in a file with a .BAK extension. While .BAK files are supposed to be deleted
by the system, they often linger on.
If you’ve ever poked around your printer settings,
you probably came across an option for spooling
print jobs, promising faster performance. See
Figure 12 for what the setting box looks like in
Windows XP. The default Windows setting is to
spool print jobs so, unless you’ve turned it off,
your work is spooling to the printer. Spool
sounds like your print job is winding itself onto a
reel for release to the print queue, but it actually
is an acronym which stands for (depending upon
who you ask) “simultaneous peripheral
operations on line” or “system print operations
off-line.” The forensic significance of spool files
is that, when spooling is enabled, anything you
print gets sent to the hard drive first, with the
document stored there as a graphical
representation of your print job. Spool files are
usually deleted by the system when the print job
Figure 12
has completed successfully but here again, once
data gets on the hard drive, we know how tenacious it can be. Like temp files, spool files
occasionally get left behind for prying eyes when the program crashes. You can’t read spool
files as plain text. They must either be decoded (typically from either Windows enhanced
Page 29