XBOX 360 Forensics

Chapter 7. XBOX 360 Hard Drive

Documenting the Artifacts after the Initial System Update and Live Account Creation

Information in This Chapter

•Initial differences

•Examination of the post–system updated drive

•PIRS files after the initial system update

•CON and LIVE file examination

•New images added after the system update

•Other artifacts

This chapter continues with the research and documentation of the artifacts located on the drive. Once the initial settings have been configured for the console, the next step is to connect to XBOX Live and recover the Gamertag or create a Gamertag. This initial connection requires the end user to accept an end user license agreement, which then requires a download to the hard drive of the console. If the end user ...