{"id":1396,"date":"2024-10-06T14:52:56","date_gmt":"2024-10-06T20:52:56","guid":{"rendered":"https:\/\/fallingstuff.net\/blog\/?p=1396"},"modified":"2025-10-24T13:27:58","modified_gmt":"2025-10-24T19:27:58","slug":"tales-of-ebay-part-6","status":"publish","type":"post","link":"https:\/\/fallingworks.com\/blog\/2024\/10\/06\/tales-of-ebay-part-6\/","title":{"rendered":"Tales of eBay &#8211; Part 6"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Coming into the home stretch now, keeping up from <a href=\"https:\/\/digitalstuffy.com\/officehours\/2022\/06\/12\/tales-of-ebay---part-5\/\">Part 5<\/a> and moving onto the next drive. This drive I spent easily the most time on and had to wrangle back in the searching .. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"288\" src=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_04_07-Local-Disk-F_-1024x288-1.png\" alt=\"\" class=\"wp-image-2718\" srcset=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_04_07-Local-Disk-F_-1024x288-1.png 1024w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_04_07-Local-Disk-F_-1024x288-1-300x84.png 300w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_04_07-Local-Disk-F_-1024x288-1-768x216.png 768w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Again connecting the drive to my laptop and autorun opened &#8230;<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"945\" height=\"271\" src=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_03_35-System-Reserved-E_.png\" alt=\"\" class=\"wp-image-2719\" srcset=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_03_35-System-Reserved-E_.png 945w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_03_35-System-Reserved-E_-300x86.png 300w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_03_35-System-Reserved-E_-768x220.png 768w\" sizes=\"auto, (max-width: 945px) 100vw, 945px\" \/><figcaption class=\"wp-element-caption\">&#8230; opened twice actually<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"553\" src=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_05_20-Window-1024x553-1.png\" alt=\"\" class=\"wp-image-2720\" srcset=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_05_20-Window-1024x553-1.png 1024w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_05_20-Window-1024x553-1-300x162.png 300w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/2022-04-29-20_05_20-Window-1024x553-1-768x415.png 768w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">And Hex Editor backs up there is data on the drive <\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"656\" height=\"908\" src=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-27-202054.png\" alt=\"\" class=\"wp-image-2721\" srcset=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-27-202054.png 656w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-27-202054-217x300.png 217w\" sizes=\"auto, (max-width: 656px) 100vw, 656px\" \/><figcaption class=\"wp-element-caption\">Lots of files to recover <\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"830\" height=\"873\" src=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-27-202022.png\" alt=\"\" class=\"wp-image-2722\" srcset=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-27-202022.png 830w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-27-202022-285x300.png 285w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-27-202022-768x808.png 768w\" sizes=\"auto, (max-width: 830px) 100vw, 830px\" \/><figcaption class=\"wp-element-caption\">&#8230; and a bunch of structures to recover<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"514\" height=\"1017\" src=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-27-204817-1.png\" alt=\"\" class=\"wp-image-2723\" srcset=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-27-204817-1.png 514w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-27-204817-1-152x300.png 152w\" sizes=\"auto, (max-width: 514px) 100vw, 514px\" \/><figcaption class=\"wp-element-caption\">Applying some Forensics this time for a deeper dive and look at more than files <\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"520\" height=\"912\" src=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-20-231933-1.png\" alt=\"\" class=\"wp-image-2724\" srcset=\"https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-20-231933-1.png 520w, https:\/\/fallingworks.com\/blog\/wp-content\/uploads\/2024\/10\/Screenshot-2022-05-20-231933-1-171x300.png 171w\" sizes=\"auto, (max-width: 520px) 100vw, 520px\" \/><figcaption class=\"wp-element-caption\">&#8230; specifically emails <\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This drive I spent the most time on, the file carving took nearly 3 days. 67000 images, 876 word documents, 617 pdfs, and 4714 emails of multiple users. Among all those files &#8230; <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Adult Images \/ Videos <\/li>\n\n\n\n<li>Family pictures <\/li>\n\n\n\n<li>Pay stubs<\/li>\n\n\n\n<li>Bank documents<\/li>\n\n\n\n<li>Divorce papers <\/li>\n\n\n\n<li>Tax documents <\/li>\n\n\n\n<li>Cisco test prep materials <\/li>\n\n\n\n<li>Hardware Manuals<\/li>\n\n\n\n<li>Network configurations and maps (many years old though)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This was by far the worst drive that I looked at in this little adventure. The fact that the user left adult photos and movies right next to the family pictures is mind blowing to me, but it was the piece de resistance of the whole project. To top it off, this is the 3rd drive out of the stack with the same names attached to it &#8230; That is right the drives from Part 4, 5, and now 6 were all from the same person and from a little poking around, this person was an IT Manager, a person who should have known the meaning of data destruction. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">5 Down, 1 to go&#8230; <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Coming into the home stretch now, keeping up from Part 5 and moving onto the next drive. This drive I spent easily the most time on and had to wrangle back in the searching .. This drive I spent the most time on, the file carving took nearly 3 days. 67000 images, 876 word documents, &hellip; <a href=\"https:\/\/fallingworks.com\/blog\/2024\/10\/06\/tales-of-ebay-part-6\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Tales of eBay &#8211; Part 6<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_bluesky_dont_syndicate":"","_bluesky_syndication_accounts":"","_bluesky_syndication_text":"","footnotes":"","_share_on_mastodon":"0"},"categories":[48,45],"tags":[],"class_list":["post-1396","post","type-post","status-publish","format-standard","hentry","category-data-recovery","category-privacy"],"share_on_mastodon":{"url":"","error":""},"_links":{"self":[{"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/posts\/1396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/comments?post=1396"}],"version-history":[{"count":2,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/posts\/1396\/revisions"}],"predecessor-version":[{"id":2725,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/posts\/1396\/revisions\/2725"}],"wp:attachment":[{"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/media?parent=1396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/categories?post=1396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fallingworks.com\/blog\/wp-json\/wp\/v2\/tags?post=1396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}