Post data recovery: Can browsing porn sites lead to automatic downloading of photos onto hard drive?

[sibs]

Hi,
I recently ran TestDisk and Photorec on an old Windows XP laptop to recover some previously deleted files for someone. This was my first time with data recovery.

This someone is a male, and I was lightly warned that they downloaded some adult content and used the laptop to stream porn and download photos.

However - there's 1000+ pornographic images that have been recovered. Whilst some of it is just your average porn (which I was warned about) or hardcore porn - there is also a lot of very extreme, disturbing content.

Forgive my ignorance, but my question is this: would he have chosen to download all these images (I know some were deliberate), or is it possible that browsing porn sites on IE (the main, trusted sites that most people use that host videos from other niche sites) and watching videos, downloading other images, might've also automatically downloaded additional images to his hard drive, and Testdisk and Photorec has retrieved them?

Quite a few, but not all, of the images appear to be stills taken from the same film. If it is the case that porn sites can automatically download images - would he have been watching these films in the browser?

I would appreciate any insight and advice. Given the nature of the content and the person - I am quite concerned but don't want to jump the gun just yet.
Thanks in advance

 

[johnb35]

Browsing any website will save images on computer for faster loading later, called temporary internet files or browser cache depending on which browser was used. But its also possible this person saved all these files depending on file location.

 

[Darren]

I'd say there's a 95% chance all those saved files are deliberate, particularly if they're not in a place used as a cache.

I'd use the date/time they were saved (in relation to the rest), resolution, and location of files to make that determination. The ones that are from the same video are likely intentional in particular.

 

[sibs]

Thank you for your replies. Ever so helpful.

The problem is, I recovered these images using TestDisk and Photorec - I didn't chose to recover as such but I copied the files over to an external USB.
The files are all jumbled, in jumbled up directories, and have jumbled up names. I appreciate using the resolution as an indicator, thanks for that tip, but is there any way I can see whether these images were restored from a browser cache?
I.e. If I run the software again and see where they have come from, is there a name for the browser cache directory?
Or is there alternative software that might show a more clear indicator of where these files were stored?

I am now assuming that you're right in that the ones from the same video are likely to be intentional, or at the very least he watched the video - which is why the files have downloaded.

 

[johnb35]

If they are stored in a user directory such as pics or something like that then it was user saved, if they are in a temp or cache folder then its the browser related.

 

[sibs]

Hi again,
I've just checked, and it is the case that some of these images are in the Temporary Internet Files folder under Internet Settings on the laptop.
A typical image name is "[URL='http://img100.xvideos.com/thumbs a load of letters and numbers)"

So, just to clarify, would those images have been automatically downloaded because he was watching those specific videos - or could they have been downloaded automatically via any other way?

I really do appreciate your help. Thank you.

 

[johnb35]

Unable to view that link it forbidden. I tried editing it as you had it screwed up but still won't work. If its in temporary internet files then the browser itself is saving them.

 

[sibs]

Unable to view that link it forbidden. I tried editing it as you had it screwed up but still won't work. If its in temporary internet files then the browser itself is saving them.

Thanks John. Very helpful. Is the browser saving those specific images because he would've been viewing them online - either as a jpeg or as part of a video? i.e. if they're stills from a video - would he have been viewing that video in order for the browser to download stills into the cache?

 

[sibs]

PS. Sorry the link didn't work - I was just trying to give an indication of the type of file name!

 

[johnb35]

The stills could have been on the webpage itself. When you visit a webpage, the browser will store images, text, icons, whatever it wants so that it loads quicker the next time you visit it.