IT Forensics – Windows

Forensic analysis of Windows Nearby Sharing – Reconstructing local file transfers

Nearby Sharing enables files and links to be shared between Windows devices in close proximity via Bluetooth and WLAN. Depending on the version of Windows and the configuration, this may result in artefacts that provide information about transfers, the devices involved or user settings.

Enquire without obligation

In a professional IT forensic investigation, these artefacts are never assessed in isolation. Only by correlating them with Bluetooth artefacts, WLAN artefacts, user profiles, event logs, registry data and other digital traces is it possible to carry out a robust technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of Nearby Sharing artefacts, reconstruction of possible file transfers, correlation with other Windows artefacts, and full documentation of all investigation steps.

Typical areas of application

•Investigation into potential data leaks
•Insider cases
•Incident Response
•Corporate Forensics
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, any artefacts present are identified, analysed and technically categorised alongside other digital traces.

Why is Nearby Sharing relevant from a forensic perspective?

These artefacts may provide evidence as to whether files have been exchanged between Windows devices. The significance and scope of this evidence depend on the traces available and the specific system configuration.

Frequently Asked Questions

What data can be analysed?+
Depending on the version of Windows, configuration data, device information and details of file transfers may be present.
Can all transfers be verified?+
No. This depends on the available artefacts and the system settings.
Are you working on the original system?+
No. Only a forensic copy or forensic image is analysed.
Are Nearby Sharing artefacts sufficient on their own?+
No. They are always assessed alongside other digital evidence.

LanCologne – Windows Forensics in Cologne

LanCologne supports you in carrying out a legally admissible analysis of Windows Nearby Sharing and the objective reconstruction of digital file transfers.

Get in touch now