Title: “LIARS Phase One – A live CD system for extraction of user and owner information from laptop and notebook hard drives”
Authors: Peter Hannay, Andrew Woodward, Nic Cope
Laptop and notebook theft is major issue worldwide. Many laptops are found by Police, but it is rare that the owner is able to be identified, resulting in the device being wiped and sold. This results in a reduced recovery rare for police and increased payouts for insurance companies. The first phase of the LIARS project modified an existing open source program, chntpw, and used the registry hive interrogation feature. The resulting program is run from a forensically sound live Linux CD, and outputs any relevant registry information to the screen in a text format. This paper outlines the method by which this is done, and gives information about the code modification. It goes on to talk about the next phase of the project, using file carving to examine formatted laptop drives.
Files: Full Paper (PDF)