Counterfeit Examina...
 
Notifications
Clear all

Counterfeit Examination

12 Posts
7 Users
0 Likes
711 Views
(@cloudy)
Posts: 59
Trusted Member
Topic starter
 

Hi

Currently working on a counterfeit case, and am drawing a bit of a blank.

We have checked jpeg, gif, bmp, doc, xls, ppt files etc and cant find any evidence of counterfeit notes. We have also searched unallocated files.

A printer scanner was seized, and we are thinking that it may have been used to scan the notes and then print them without saving them to the computer.

If this was the case would there be any evidence files on the computer showing this????

Cheers

 
Posted : 11/09/2007 3:42 pm
(@rich2005)
Posts: 535
Honorable Member
 

There can be many more types than that, on a recent similar job, there were a ton of files of different types AI (adobe illustrator), PSD (Adobe Photoshop), cpt (Corel PhotoPaint), cdr (Corel Draw), PDF files, and proprietary card reader image format files.
And yes, often there would be image files stored on the computer, whether as temp files or actually saved somewhere.
If my memory serves me correctly (it does very occasionally) i think you can keyword search for 8PSD for the start of PSDs in unallocated, and then attempt to view any hits as images.
Rich

 
Posted : 11/09/2007 5:24 pm
(@bithead)
Posts: 1206
Noble Member
 

If you can grab some remnants of the spool files perhaps that would give you some information as to the source of the images, narrowing the search. As Rich points out, if you have good counterfeits they were likely produced in one of the more advanced image processing programs (Illustrator, FreeHand, Photoshop and InDesign being favorites).

 
Posted : 11/09/2007 5:40 pm
(@cloudy)
Posts: 59
Trusted Member
Topic starter
 

Thanks for the info

I have already checked the spooler files and can find no remnants of any relevance.

I have checked and there doesn't seem to be any software which would fit the bill so to speak.

Might be showing my naivety here but what are PSD??

 
Posted : 11/09/2007 5:57 pm
(@rich2005)
Posts: 535
Honorable Member
 

I described what the files were next to the extension in my post wink

 
Posted : 11/09/2007 6:23 pm
(@cloudy)
Posts: 59
Trusted Member
Topic starter
 

sorry, brain seems to be on a bit of a go slow today…… this week…. this month…. wink

 
Posted : 11/09/2007 6:44 pm
andy1500mac
(@andy1500mac)
Posts: 79
Trusted Member
 

Hi,

You may want to try looking for TIF and MDI image formats as well.

 
Posted : 11/09/2007 7:27 pm
(@rich2005)
Posts: 535
Honorable Member
 

Oh yeah and thought i'd add whilst this isnt a 'file type' to look for, if you're drawing a blank, i always tend to have a look through the larger files on the drive,just in case theres stuff i haven't thought of, or proprietary formats etc, just sorting by logical size and seeing if there's anything out of the ordinary (as a high quality image file is likely to be a few MB - or much bigger if in an uncompressed form - there usually arent TOO many to flick through that aren't obviously recognisable).
Rich

 
Posted : 11/09/2007 9:41 pm
(@cloudy)
Posts: 59
Trusted Member
Topic starter
 

Thanks for the help i'll let you know what find

 
Posted : 12/09/2007 2:48 pm
(@j2222)
Posts: 36
Eminent Member
 

Cloudy, how about look at what apps are installed and what have been run recently? Prefetch and recent folders … then look to see what file types these use.

Hope this helps, James

 
Posted : 13/09/2007 7:44 pm
Page 1 / 2
Share: