BlackBerry Wireless...
 
Notifications
Clear all

BlackBerry Wireless Handheld Devices .....

3 Posts
2 Users
0 Likes
524 Views
novadonuk
(@novadonuk)
Posts: 26
Eminent Member
Topic starter
 

Hey Guys and gals.

I have a new case to work on as part of my self directed learning.
I have a Hard disk, which was a cloned image from a clients PC.
The clients PC was used as a family PC and occasionaly a member of the family connected their BlackBerry PDA.

Not knowing the model or make of the BlackBerry - is there a chance data could be held on the Hard Disk, even though I cannot prove or disprove the Device had actually sync'd

I have looked at the registry and as of yet havent found any relavent entries - using EnCase4.

Could anyone suggest

1- Where to look on the disk for data (compressed or not?)
Key word seraches produced no significant results, using FTK or EnCase

2 - Where in the registry would you look?

Cheers again.

iconSerf

 
Posted : 16/06/2006 12:46 pm
 samr
(@samr)
Posts: 119
Estimable Member
 

Hi,

Take a look in the System registry (assuming you are looking at a 2000/XP machine) at the appropriate control set\Enum\USB\. There should be a list of USB devices that have been used in the system that you will need to look through one by one. Hopefully, if a blackberry has been used in the system it will be listed here.

Sam

 
Posted : 16/06/2006 2:05 pm
novadonuk
(@novadonuk)
Posts: 26
Eminent Member
Topic starter
 

Hey Sam,

Thanks for the advice, however I have looked through these, and it doesnt appear to state BlackBerry, or anything of relavence, any suggestions?

Cheers,

 
Posted : 16/06/2006 4:08 pm
Share: