Computer Forensics Porn Scanner Program needed

Ooops i apologize,,i have the laptop in posession at the moment...I should have been clear that in the future the laptop would be in a remote place so to view logs or any info would be nice that way..For now i am just looking to pull all traces of information regarding dates, pictures, website links..temp files....And looking for a scanning program that can facilitate finding all explicit info and logging dates. Im really trying to tie in the users with the time that the explicit material was put on the computer.

Like i said before... use Easeus and you will be able to recover the files along with the dates they were originally created.  In the future you will have to remote/vnc the machiine and repeat the process as there is no known software to do what you want.

You could try logginig internet activity i suppose.  Look at Microsoft ISA server or web logging software to see what your users accessed

Pearl im not looking for data recovery...Im looking for a program to scan for anything relating to porn....A porn scanner...All the data is easily recoverable ..i want basically a program that searches for all criteria based on porn related information. Thats it

Assuming you know how to address your remote connection requirement (e.g., via RDC), I'd recommend using Nirsoft's IEHistoryView v1.40 <www.nirsoft.net/utils/iehv.html>. Download and run it on the host computer, configure and create (in HTML) the desired report, and then upload it to some off-site location you control. The dates and times your target accessed the porn sites, and the duration s/he spent there will be clear as day.

Whilst I don't think that there is a dedicated scanner for finding porn (imagine how difficult it would be for a computer to detect whether something is porn or not) there are products which can be used to extract content from a computer in such a way as to be useful in a court of law.  

One that comes to mind is EnCase forensic
http://www.guidancesoftware.com/computer-forensics-ediscovery-software-digital-evidence.htm
which is an industry leader in forensic software and would allow you to create an image of the machine and then perform a forensic analysis of the image.

Personally I think it would be impossible to tie in the actions of a specific person to content found on their machine - they could simply say they forgot to log-off and someone else must have used it - you could probably not prove otherwise.

Having said above, forgot to include another tool that you will be interested in.
- File Audit from Guardware (it run off the thumbdrive and no software need to install, provide also incident report ...) - http://www.guardware.com/ts_overview.php

"....a turnkey solution for identifying potentially pornographic images, video and music stored on Windows-based PCs and Laptops. It runs on a compact and portable USB (thumb) drive that allows IT or HR managers to audit computers for inappropriate usage and unauthorized file storage. "

Related solution is an offline classifier system called URLChecker (not as relevant as targeting ISP but still good to know)- http://www.guardware.com/ulc_overview.php

Hope it helps

Forgot to mention, make sure you use a write blocker when inspecting the drive or using a scanner. If your scanner changes the access date of the file, it will be unusable in a civil, professional, or criminal case. If the date is changed your suspect could easily say that you planted the files.

First off, if this is a forensic investigation you should not be accessing the system by booting it up and poking around. You should acquire an image of the hard drive preferably in a dd format. One method that you could use is to disconnect the suspect computers drive and attach it to your investigation system via a hardware write blocker and create the dd image using FTK Imager Lite which is free and can be found here:

http://www.accessdata.com/downloads/current_releases/imager/Imager%20Lite%202.6.1.zip

Once you have acquired a dd image of the drive you can use this with most forensic tools to do your investigation. One tool that I would recommend is X-Ways Forensics. It is a great tool that offers a feature they call skin color detection. Taken from their site here is a description of the feature:

"Skin color detection (e.g. a gallery view sorted by skin color percentage greatly accelerates a search for traces of child pornography)"

It costs 748.90 Euros for the Forensic Edition which is roughly $1,085 US dollars. and can be found at:

http://www.x-ways.net/forensics/index-m.html

This tool will give you the ability to recover deleted files and find files with renamed extensions, such as jpegs renamed to .txt files for example. You can then use the skin color detection to sort all of the found images by their percentage of skin colors contained within the image.

After finding all of the images that you are interested in you can use the freely available SANS Investigative Forensic Toolkit (SIFT) Workstation found at:

https://computer-forensics2.sans.org/community/downloads/

It is a Linux distribution that comes installed in a virtual machine. You will need VMWare Workstation to run it and you can download a 30 day evaluation here:

https://www.vmware.com/tryvmware/?p=workstation-w

Using the SANS Investigative Forensic Toolkit (SIFT) Workstation you can create a timeline of file activity that can show you other activity that may have happened around the same time that the images were accessed/created/modified. You can then use these times to check against the times that a user loggged on to determine what user account is responsible for the activity.