Eraser Artifacts

by **David.Knutson** » Wed Jul 08, 2009 5:54 pm

I am a forensic examiner and have come across a computer that has artifacts from Eraser 586 in the NTUSER.dat file of the registry. I also see many files that have a 241 character file name. The first 238 characters are zeros the lase three characters are alphanumeric. The file size is zero.

Question: Does Eraser 586 leave the long file name artifacts?

by **loveranger** » Tue Dec 13, 2011 9:12 pm

Seems like he works for the FBI... what is he stumbled upon?

http://www.forensic.org/index.php?optio ... Itemid=153

Eraser Artifacts

Eraser Artifacts

Re: Eraser Artifacts

Who is online