[WARNING] Need help with a Chromebook

[Haole Boy]

I've been asked to look at a Chromebook for a friend. It belongs to her daughter who was assaulted and she does not remember some things leading up to the incident. Her mother wants me to see what, if anything, I can find on the Chromebook that would add some information about what happened before the assault.

Since there will be legal action involved, I want to be extra careful that whatever I find (or not find) is not modified by me. On a Windows machine, I would just create an image of the hard drive, mount the image and go searching. But creating an image of the local disk on the Chomebook seems to be darned near impossible, and even if you do create one, the user's data is encrypted.

I have the user account and password for the machine, so I can logon to it easily enough. But, how do I document the state of any files that I find to show that I did not alter them? Is there some sort of backup / export utility where I can copy the files to an external drive?

Any suggestions?

P.S.: Yes, I do understand that almost all data associated with a Chomebook is stored on the Google Drive account. But, there is a possibility of something pertinent being stored on the machine, so I'm going to do anything I can to help in this situation.

Mahalo for your assistance,

Harry Z

 

[Markverhyden]

^^^^ What he said. Unless you have a write blocker device from a reputable company that is used by the legal industry there is a very real chance that any data recovered by anybody will be inadmissible since you did not image the device using a write blocker. Meaning something could have been done to the data on the device.

 

[AML]

^^^^ What he said. Unless you have a write blocker device from a reputable company that is used by the legal industry there is a very real chance that any data recovered by anybody will be inadmissible since you did not image the device using a write blocker. Meaning something could have been done to the data on the device.

Beat me to it... couldn't have said it better myself

 

[Haole Boy]

Mahalo to all of you for your advice. I will definitely consult with the mother and let her determine which way to go.

In case anyone else comes upon this thread and wants to do a little reading on forensic examination of a Chromebook, take a look at this link

http://www.dataforensics.org/google-chromebook-forensics/

Update: I contacted the mother of the girl and she agreed that keeping things "kosher" for her lawsuit was more important than quickly finding out what's on the Chromebook. Advised her to NOT even power on the Chromebook, and also do not sign on to the daughter's gmail account on any device.

Harry Z