±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35503
New Yesterday: 0 Visitors: 113

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Print screen - clipboard / RAM?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

research1
Senior Member
 

Print screen - clipboard / RAM?

Post Posted: Nov 14, 11 22:50

I'm trying to find some info on artefacts created from a user pressing 'print screen' on a Win7 system, without the action of paste afterwards.

I'm assuming lost with RAM, possibly partially stored in sys vol. Thoughts?

Thanks in advance,  
 
  

jaclaz
Senior Member
 

Re: Print screen - clipboard / RAM?

Post Posted: Nov 15, 11 00:49

- research1
I'm trying to find some info on artefacts created from a user pressing 'print screen' on a Win7 system, without the action of paste afterwards.

I'm assuming lost with RAM, possibly partially stored in sys vol. Thoughts?

Thanks in advance,


What happens is simply that a whole screen bitmap is stored in the clipboard, so it is "volatile" by definition (and overwritten at next Ctrl+C or Copy comand in almost *any* application) AFAIK.

I don't think that anything changed in 7.

You can play a bit with this:
www.nirsoft.net/utils/...board.html


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

research1
Senior Member
 

Re: Print screen - clipboard / RAM?

Post Posted: Nov 15, 11 02:16

Thanks jaclaz. So I'm guessing you 'could' potentially get the bitmap from hybersys, if your lucky...  
 
  

joethomas
Senior Member
 

Re: Print screen - clipboard / RAM?

Post Posted: Nov 15, 11 14:40

I would assume that it keeps it in memory as a bitmap, and since the size of the screen can be quite large, this is potentially a very large amount of RAM being used so it is conceivable that it might be swapped out to the pagefile quite quickly. Goodness knows how fragmented it would be though.  
 

Page 1 of 1