A family member recently bought a house and they found a USB key in a desk that was left by the previous owner. On the key is a hidden folder called Xbox360 and has files called Data0000 to Data0005. I do not have an Xbox360 only a PC. Is there any way I can determine if there is any data in there?
those data files are usually created when an xbox 360 configures the USB for usage. there shouldn't be anything important on there, but if you want to see for your self, check out the tool "partybuffalo" its a FATX explorer tool.
Thanks, I just tried that as well as USBXTAFGUI and they show the data and cache to be empty. However if I open Data0000 in a hex editor, I can see some text: It goes on from there. What could that text be from? I already looked in Data0001 (because it was the smallest) and it appears to be empty.
Use Horizon it will help identify the game, a quick search on google for horizon xbox 360 will get you to the download.
I am going to have to suggest Party Buffalo like stipo, Horizon is cool and all but lately it bundles way too many "offers" with it's installer.
I will try Horizon out later today. Not having used a 360 before, is it possible that browser cache or chat data is stored in Data0000?
All the Xbox360 tools I have tried say there is no data present. No saves, games, avatars, cache, etc. I have tried Horizon, USBXTAF, Xplorer360 and Party Buffalo. I will look at these files more tomorrow, but I will leave you with this present. Being a former Quake modder, one tool I used back then was Dragon Unpacker which was used to manage the PK archives. It was, at the time, one of the few archivers that natively supported the PK archive format. It also has a function called HyperRipper which looks for headers within ANY type of file, not just archives. I used HyperRipper on the Data0000 and it found photos of people... or someone's photos. Many have a person's face in them and didn't want to use that as an example, so I found one without a person in it to show.
Maybe someone decided to just put their photos in a folder called xbox 360? Doesn't have to be xbox related? That is what it looks like here, especially with the data you found in Hex editor, which was probably just a description of the photograph, plus no xbox related software even recognized it.
First to start, screenshots of how various applications see the files. The file system on the USB key is FAT32, so Xplorer360 cannot be used in this case. Here is the header for Data0000 which is different for sure. It contains this value "X852198-001" and a date (I believe) of 11-24-10. Google search finds only 1 file with the same X number in it, an Xbox save game file with a .svg extension for whatever reason. Here is the Header for the Data0001 which shows you the expected entry So it appears these are valid Xbox 360 files. The interesting thing is that all of the Xbox tools tested show there is nothing in these files, yet this is obviously not correct. I will go through each Data000x file and see what is actually stored within, and post anything I find as long as it isn't someone else's personal information.
It's pretty obvious... Someone has formatted a USB to an xbox 360, and then transferred pictures to it, using the xbox 360 system. Mystery solved
I can confirm there is no game related data. The "strange" text strings are from Word documents, as evidenced by contents such as: ---- CODE START ---- \pard\nowidctlpar\nooverflow\sl240\slmult1{\f0\lang1033\fs24\kerning28 Ashbrook, T. (2009, October 8). {\i On point} [Audio podcast]. Retrieved from \tab{\ul\cf1 {{\field{\*\fldinst{ HYPERLINK "http://onpoint.wbur.org/2009/10/08/whats-next-for-advertising" }}{\fldrslt{\pard\nowidctlpar\nooverflow\sl240\slmult1 http: //onpoint.wbur.org/2009 /10/08/whats-next-for-advertising}}}}} \par} ---- CODE END ---- And paths such as word/_rels/document.xml and word/document.xml showing up. Images do not appear to have any EXIF data. Summary: Data0000 has 104 images and videos. Also contains HTML and Word "Documents" Data0002 has 175 images and videos. Data0003-0005 are zeroes. I personally have no further interest into looking at these files as nothing is all that interesting. However this information may be interesting to anyone doing any forensics on an Xbox 360 hard disk or USB drive.
One outstanding question remains. The photos I could understand, but how could the Word documents have ended up in the Xbox data? I didn't post about it, but I used a forensics tool called Photorec to extract all the .docx files from Data0000. In my research, at the time of July 2012 there was no Word editors/viewers and SkyDrive (now OneDrive) didn't come to the 360 until December 2012.
