We help IT Professionals succeed at work.

Scouring Imac for porn...

mousemen
mousemen asked
on
1,240 Views
Last Modified: 2013-11-24
I was hired by a client who is proceeding with a court case to examine a family member's computer for pornographic material, and to catalog anything I might find.  I have all my legal bases covered, but that is not the issue.

The issue is technical.  On a Mac running 10.4.8, I really don't know where to start or of any utilities that might help.  I have no way of knowing if the user was savvy and used Safari Private Browsing.  

Where would you start if this was your task?  Thanks in advance to all of you.
Comment
Watch Question

Commented:
I don't know about your legal system.  However, for me, they are assume innocent until proven guilty.  That means if there is no evidence on their system, they are innocent, whether they are smart enough to cover up their trail using safe browsing, anonymous VPN, etc.

What I would first do is to clone the harddrive.  You might want to get a hardware device like http://www.diskology.com/djstandard.html so that no computer access to the original harddrive (since it might be viewed as tempering of evidence).  If you use computer to access the original harddrive, a lawyer can just ask questions like is the information on the harddrive changed.  Unless the OS is for forensic use, it will write log files, etc which can be viewed as the information changed on the harddrive.

After cloning the harddrive, keep the original safe, and work on the cloned version.  You can then use any software to search through some keywords, image files, etc.  It is time consuming work, most of the time, you have to look manually.
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Commented:
pheidius,

Your link (http://www.blackbagtech.com/software.html ) is non-existent....



Commented:
Blackbag re-organized their website, try: http://www.blackbagtech.com/products/software.htm or simple from http://www.blackbagtech.com/

Commented:
wow sorry worked when I posted it.
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.