Pieces0310

取证须让证物说话,莫妄以自我心证来给案情下定论.切忌画靶射箭,为找而找. 取证的根基仰赖经验与判断,在IT各领域的经验愈丰富,愈能看出端倪. 取证须善用工具,但不过度依赖工具.工具只能帮你缩小可能范围,但无法告诉你答案,仍需靠人进行分析判断.

首页 新随笔 联系 订阅 管理

Last month Candy was arrested on suspicion of having doing online porn webcam shows, but Candy refused to confess to her crime. The Police extracted data from her iPhone and found lots of chat messages in Skype’s database – main.db.

 

Unfortunately there was no clear evidence in main.db. But forensic guys did not give up easily. Another senior examiner found some interesting chat messages in Skype “chatsync” folder.

 

 

 

According to the chat messages Candy sent, we could see that she gave a link to her client and invited him to create a profile.

 

The examiner visited at that link and found a porn website about online porn webcam shows.

 

 

The Police showed Candy what they have found in her phone. Candy was shocked and admitted her guilty. Candy was wondering why the Police could dig out those chat messages being deleted several months ago.

 

The truth is that those deleted chat messages still could be found in files inside Skype chatsync folders.

 

posted on 2016-08-28 21:26  Pieces0310  阅读(776)  评论(2)    收藏  举报