SEARCH FOR IMAGES IN WINDOWS VISTA

1. Look out all your recordable media

Any Flash drives, memory cards and sticks, CD-Roms and DVD-Roms, internal and card memory from digital cameras and mobile phones, backup tapes and disks, old unused computers and old hard disks that came out of them. Anything that contains digital storage. It's pointless cleaning up your main hard drive in your computer if you have files elsewhere that you've forgotten about.

If you're ABSOLUTELY sure there can be nothing suspect on something you can ignore it. If not, you need to go through the sections 4 and 5 below for each of themIf you have enough space on your main hard disk it makes life easier to copy them (or restore backups) onto it. Create new directories or folders and copy them into them. If you copy them all to your hard drive, you can search through all files in one go - much quicker. Though at the end you will need to bulk-wipe or physically destroy these media if they had anything risky on them.

The alternative to copying them all over is to connect them one at a time and repeat sections 4 and 5. At steps 4.6 and 5.6, select the drive as described there.

2. Encrypted data, hidden data, data not in partitions

If you have ever deliberately hidden images or encrypted images, this makes things harder. This page doesn't cover these situations, and we'd assume that if you have done this you know how to undo it. Delete them if they're not safe, and make everything visible that might possibly be unsafe and check them as in sections 4 and 5 below.

3. Compressed files

Every PC contains compressed files that contain many other files. Many of them come with Windows and with other software, but you can also download other sorts from usenet news and file-sharing, and these might contain something suspect. Files with the suffix .cab are almost certainly OK. Ones with the suffix .zip and particularly .rar may be files you've saved or downloaded and will need checking if you don't know what they are. Ones you've downloaded are likely to be somewhere under the My Documents directory, unless you have ever deliberately chosen to save to other directories. To find these, in section 5 below, include *.zip *.rar in the list in step 5.12.

As with encypted data, ignore them if you're absolutely sure they're innocuous. If you're not sure, either delete them or decompress and check them. If you decompress, make sure that you delete the original compressed file if there's anything risky in it.

4. HOW TO FIND ALL IMAGE FILES

Note This applies to Windows Vista only. For older Windows, go here.

Click on the Go button on your desktop, and click search on the right-hand panel, not the one at the bottom.

A blank panel will appear
vista panel

Click on the icon to the right of Advanced Search on the right of the toolbar

In the field at the top label Search type kind:pictures
In the white box, click on the drop-down by the right of Location and select Everywhere

wait for the list to be populated. vista panel

Note the extra toolbar that appears. Click on views and you can switch between thumbnail images of various sizes or just a long list. Medium thumbnails should do for most people.

Click on Organise and select folder and search options and you will see general view and search which are on the top tag. Click on the search tag and tick the box which says Include compressed files Zip & Cab.

See section 6 for instructions on how to select and delete or erase any risky files.

You now need to repeat the process in this section, but in step 3, type kind:videos

You can also type a file extension such as jpg in the search box. In fact, only the first letter or two will do. This is useful for files created by applications. If you've edited images in Photoshop, you would type psd.

On the machine these screen shots were taken from a search that returned 1596 items. 6 video files and 2 jpeg pictures were found which were thought to have either been deleted or got dropped into the wrong folder and missed.

6. GETTING RID OF FILES

You need to select the files in the search panel that you want to delete.
Make sure the panel has focus by clicking on its top bar.
To select a file, left-click it once.
To add another file, hold Ctrl and left-click it
To add a set of files, Ctrl and left-click the top one, and Ctrl Shift and left-click the bottom one.
To unselect a selected file, Ctrl and left-click it again.
To unselect all, left-click any file without holding Ctrl. This drops all the selected files. If the file you last clicked is now selected, click it again to unselect it.
To select all the files in the panel, hit Ctrl and a. You can Ctrl left-click to unselect any you want to exclude. When all the files you want are selected, you can delete them. Simply press Shift and Delete (or Shift and Del) and the files will be deleted without going into the Recycle Bin.
In practice you'll have a lot of files to check, so you'll select and delete one or a few at a time. You don't need to select all of them at once.

TECHIES: Instead of Shift-Delete, if you installed Eraser, right-click on any of the files selected and select Erase from the context menu that pops up. Also on the Eraser page there are instructions on how to erase thumbnail cache files.

7. EMPTY THE RECYCLE BIN

Double-click the Recycle Bin icon on your desktop. It will open in an Explorer panel.
Click on File in the bar at the top left, then select Empty Recycle Bin.

TECHIES: if you installed Eraser, instead of Empty Recycle Bin, right-click the Recycle Bin Desktop icon and select one of the options - either Pseudorandom Data 1-pass or any of the 3-pass or 7-pass options if you prefer.

8. DELETING INTERNET TRACES

TECHIES: if you installed Eraser, go to the Eraser page to erase them instead. The Ccleaner program (instructions here) also gives a way to clear internet data and much more. For others, read on.

If you use Internet Explorer, there is an option to delete various types of internet records. This varies in different versions, but all can be found under the taskbar that starts File Edit. Click on Tools, then Delete Browsing History if it exists, or if not on Tools.

You'll probably get the option to delete Temporary Internet Files, Cookies, History and Form data. Click on the delete button for each. It's probably best not to click on Delete passwords unless you are very security conscious and you have saved all your passwords elsewhere.

The Firefox browser's Tools option is called Clear Private Data but is otherwise very similar.

back to the main forensics page