±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36583
New Yesterday: 6 Visitors: 152

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Counterfeit Examination

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

cloudy
Senior Member
 

Counterfeit Examination

Post Posted: Sep 11, 07 15:42

Hi

Currently working on a counterfeit case, and am drawing a bit of a blank.

We have checked jpeg, gif, bmp, doc, xls, ppt files etc and cant find any evidence of counterfeit notes. We have also searched unallocated files.

A printer scanner was seized, and we are thinking that it may have been used to scan the notes and then print them without saving them to the computer.

If this was the case would there be any evidence files on the computer showing this????

Cheers  
 
  

Rich2005
Senior Member
 

Re: Counterfeit Examination

Post Posted: Sep 11, 07 17:24

There can be many more types than that, on a recent similar job, there were a ton of files of different types: AI (adobe illustrator), PSD (Adobe Photoshop), cpt (Corel PhotoPaint), cdr (Corel Draw), PDF files, and proprietary card reader image format files.
And yes, often there would be image files stored on the computer, whether as temp files or actually saved somewhere.
If my memory serves me correctly (it does very occasionally) i think you can keyword search for 8PSD for the start of PSDs in unallocated, and then attempt to view any hits as images.
Rich  
 
  

BitHead
Senior Member
 

Re: Counterfeit Examination

Post Posted: Sep 11, 07 17:40

If you can grab some remnants of the spool files perhaps that would give you some information as to the source of the images, narrowing the search. As Rich points out, if you have good counterfeits they were likely produced in one of the more advanced image processing programs (Illustrator, FreeHand, Photoshop and InDesign being favorites).  
 
  

cloudy
Senior Member
 

Re: Counterfeit Examination

Post Posted: Sep 11, 07 17:57

Thanks for the info

I have already checked the spooler files and can find no remnants of any relevance.

I have checked and there doesn't seem to be any software which would fit the bill so to speak.

Might be showing my naivety here but what are PSD??  
 
  

Rich2005
Senior Member
 

Re: Counterfeit Examination

Post Posted: Sep 11, 07 18:23

I described what the files were next to the extension in my post Wink  
 
  

cloudy
Senior Member
 

Re: Counterfeit Examination

Post Posted: Sep 11, 07 18:44

sorry, brain seems to be on a bit of a go slow today...... this week.... this month.... Wink  
 
  

andy1500mac
Senior Member
 

Re: Counterfeit Examination

Post Posted: Sep 11, 07 19:27

Hi,

You may want to try looking for TIF and MDI image formats as well.
_________________
Andrew 
 

Page 1 of 2
Page 1, 2  Next