Artifacts

Archive for April, 2012


Join.Me Screen Sharing

Posted by:  /  Tags: , , ,

Author Name
John Lukach
Submission Title
Join.Me Screen Sharing
Artifact or Program Version
Join.Me on Windows 7
Post Category
Cloud Based
Submission Tags
Join.Me, Cloud, Screen Sharing, Windows
Artifact Description
Join.Me is a cloud screen sharing application that allows remote collaboration and presentations. Additional security information and system requirements can be found by browsing to the product website at: https://join.me

Registry Keys
Join.Me stores information in the following hive structure for each specific user account on the system.

NTUSER.DAT -> \Software\Join.Me\
NTUSER.DAT -> \Software\Microsoft\Windows\CurrentVersion\Uninstall\Join.Me\
USRCLASS.DAT -> \Join.Me\
File Locations
Join.Me has some low hanging fruit in the form of logs that can be found in C:\Users\Username\AppData\Local\Join.Me directory.
Forensic Programs of Use
Using full packet captures you will be able to see network connections communicating to https://secure.join.me during an active screen sharing session.