Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//20340424
(S/NF) 1. The accessed date and time for the files collected are modified during the
collection process.
(U) Live State Examination
(U) A live state examination was not conducted.
(U) Post-Mortem Examination:
(S/NF) The following artifacts were retrieved from a forensic image of the Subject
following the installation and utilization of the tool:
(U) Subject A: Dell Vostro 200 with Windows XP Professional SP2 64 Bit installed
(S/NF) A1. The tool modifies the accessed date and time for the files collected. Table A2
lists the filenames with modified accessed date and time.
(U) Table A2. Accessed Files
(S/NF) Path: Varies
Name File Created
*.eft 04/24/09 08:31:42 AM – 08:32:59 AM
*.ldf 04/24/09 08:31:42 AM – 08:32:59 AM
*.mdf 04/24/09 08:31:42 AM – 08:32:59 AM
SECRET//20340424
10

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh