码迷,mamicode.com
首页 > 其他好文 > 详细

Volume serial number could associate file existence on certain volume

时间:2015-08-05 17:57:17      阅读:217      评论:0      收藏:0      [点我收藏+]

标签:

When it comes to lnk file analysis, we should put more emphasis on the volume serial number. It could help forensic guys to identify whether files exist(ed) on certain volume or not. Let‘s take a look at lnk files as below:

1. Take a look at AndroidGestureSHA1.txt.lnk, and you could see the vol serial is "149F-651D". Also you could use DOS command "vol" to check it out. Yes, the volume serial number of my C partition is "149F-651D".

技术分享

 

2. Next we take a look at EN2015061801.html.lnk. The vol serial is "B3A6-DB3C" and it‘s a Removable drive which volume name is "XPE".技术分享

 

3. But one thing which is very important: if you format the volume..guess what? Yes, the volume serial change after formatting. Let me show you the effect of formatting to volume serial number.

Before formatting the volume serial number is "B3A6-DB3C"

技术分享

 

Now I format it.

技术分享

 

After formatting the volume serial number becomes "7887-6B77"

技术分享

 

Now you know that if the volume being formated and the volume serial number will change. Don‘t forget the effect of formatting to volume serial number. Take it into consideration whenever you analyze volume serial number association with another clues.

 

Volume serial number could associate file existence on certain volume

标签:

原文地址:http://www.cnblogs.com/pieces0310/p/4705065.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!