We are employers that had to do a data recovery on an employee's
computer. "databeam" appears as the file format, in much of our
forensic data recovery report. What is this? We think the employee
copied many files before leaving. The specialists we hired said that
'databeam' as the file format, doesn't mean anything. Our employee was
very 'tech-savvy' and we think she may have used the infrared or
blue-tooth capability to beam lots of data from her desktop, to a new
laptop. Is that possible? The recovery company we're using doesn't
seem to be familiar with 'beaming'.

---

Clarification of Question by restoreintegrity-ga on 23 Jun 2003 15:30 PDT

I was told that its possible to zip large data files and them beam
them to a palm or other handheld device. However, the amount that was
copied is significant.  I am adding the clarification that the
operating systems are: laptop is Windows 98 2nd Edition 4.10.2222a,
with built-in infrared port and the Desktop is Windows XP. The desktop
comes with a detachable infrared recipient port.

The Desktop had file extensions that vary, as you mentioned. Some are
.doc, .rbf, .wmf, .jpg, .s90. Then, the next column is 'File Type'.
This always says "DataBeam". Then,next column is 'File Category'. This
always says
'Pictures'.	We did not see the word 'infrared' appear in this report.

On the laptop, in the File name column, we found several:

Smart Publisher.lnk	
Infrared Recipient.lnk	
WEBVW.DLL	
Web Publishing Wizard.lnk	
winamp.exe
The laptop is set up with an icon in the c: drive called 'infrared
recipient' and the recipient is 'active'.

---

Clarification of Question by restoreintegrity-ga on 23 Jun 2003 15:31 PDT

It just occurred to me that I've described an existing laptop. The
employee would have purchased a new laptop to trfr data to, not our
Windows 98 system.

Hi restoreintegrity,

[ I was not able to answer your primary question:

..."What does infrared beaming of data look like in forensic data
report? ..."

...so I have given you my findings as a comment. ]

DataBeam is shareware, available for a free 30 day trial, very easy to
use, and yes, DataBeam is used to move data between computers;
specifically between Palmtops and Handheld computers using an infrared
port.

At first glance, it does in fact appear as if your ex-employee could
have transfered some files onto a portable device, or from one
portable device to another. The palmtops and handhelds are very
concealable...

Reference:

http://pdacentral.ozbytes.net.au/wince/preview/32487.html
DataBeam will aid the user in transferring any Windows CE database and
any record/records of a Windows CE database and any text file from one
Windows CE device to another. DataBeam beams (transfers) your data
between Palmtop and Handheld computers. It works on Window CE devices
transferring text files, full database or just partial database in the
form of records. All you need to do is to select a file or the
database and send it to the destination Windows CE device via the
infrared port. So you can get rid of tedious synchronization
procedures using desktop PCs.


I would contact the maker of the DataBeam software: ITIL, for more
information:

About ITIL
http://www.itil.com/infoitil.htm
Contact info is at the bottom of the page.

They may be able to help you figure out what has happened.


About DataBeam
http://www.palmix.itil.com/newpalmix/products/databeam_home.htm
..."DataBeam beams (transfers) your data between two Palmtop or
Handheld computers. It works on Window CE devices transferring files,
full databases or just partial database in the form of records. All
you need to do is to select a file or the database and send it to the
destination Windows CE device via the infrared port. So you can get
rid of tedious synchronization procedures using desktop PCs..."

Also, scroll down a bit to see more.

THERE IS ONE MORE POSSIBILITY:

If your company does teleconferencing, it *could* be software made by
the DataBeam Corporation, however if that was the case, you would
already be aware of the DataBeam file type:

..."DataBeam’s main product is software for teleconferencing.
DataBeam’s technology is licensed to other companies to enhance their
products in teleconferencing. In addition, DataBeam also sells
products that do teleconferencing..."

Here's the contact information for the DataBeam Corporation:

DataBeam Corporation
3191 Nicholasville Road
Lexington, Kentucky 40503
USA

Phone: (606) 245-3500 (circuts were busy at time of posting)
Fax: (606) 245-3528
E-Mail: info@databeam.com
Web Page: http://www.databeam.com (web page is down at time of
posting)


Here's a File Extention List so you can compare the .XXX you are
refering to to the list to locate the most likely program that created
it.
http://www.seniormag.com/compcorner/definitions/ext/biglistd.htm

~~Cynthia

Hello again,

(As per our previous conversation, I had the accidental answer
removed. I am however able to answer most of your question now.) Like
my colleague Cynthia, I am a little perplexed at the main topic :

"What does infrared beaming of data look like in forensic data
report?"

Data that had been transferred is not likely to be found unless you
have some sort of 'data logging' tool for all ports. I am not certain
about IR ports, thus my semi-complete answer.

Unfortunately, we researchers are only authorized to communicate with
clients via this interface. I will do all I can to assist you though,
as will other researchers that might be able to help.

Most of Databeams line of products is for Windows CE, so the company
that did your recovery may be talking about images of this file type
instead. (.DBX) Since you saying this was a laptop and a desktop, I
would go out on a limb and assume we are not in the right area with
this software, rather some type of third party Databeam telephony
client, that has images saved in Databeam propriety format.

Two computers with Windows (98,2000,ME even some 3.1 and 95 support)
set up on them can transfer files in this fashion (IR). You can read
more about this here :
 

http://www.wown.info/j_helmig/irw9xcnf.htm


The laptop in question does have a device that is IR (Infrared)
compatible, and is capable of copying files in this manner if the
computer that is suspected of hijacking the files has a supported
operating system and device driver as well.

A clarfication might allow us to assist you further :

1) What operating systems are on both computers?


Thanks in advance -
SgtCory