±Forensic Focus Partners

Become an advertising partner

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 3
New Yesterday: 11
Overall: 28692
Visitors: 70

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Search found 126 matches

Re: Thumb drives/SSD USB forensics

Post Posted: Fri Jun 26, 2015 2:33 pm

We have a comprehensive whitepaper on the subject: http://belkasoft.com/en/ssd-2014

Basically, it answers all the questions asked in the original post while adding even more uncertainty about how t ...
Belkasoft
Topic: Thumb drives/SSD USB forensics
Replies: 5
Views: 651
 

Re: Forensic Collection in Japan

Post Posted: Tue Jun 23, 2015 3:14 pm

[quote="UnallocatedClusters"]Hello,

Would anyone be willing to share their experiences with performing forensic collections in Japan from a technical standpoint?

Any unanticipated hiccups such a ...
Belkasoft
Topic: Forensic Collection in Japan
Replies: 4
Views: 670
 

Re: Windows phone 8.1 forensic artifacts

Post Posted: Tue Jun 23, 2015 3:11 pm

[quote="ddave93"]I cannot find any potential tool or technique to do windows phone 8.1 forensics.
[/quote]

You can read our article at [url=http://belkasoft.com/en/jtag-analysis]http://belkasoft. ...
Belkasoft
Topic: Windows phone 8.1 forensic artifacts
Replies: 7
Views: 960
 

Re: iOS SQLite database deleted data

Post Posted: Tue Jun 23, 2015 3:09 pm

[quote="wotsits"]Given how on the newer models of iphone and ios the only way of accessing any kind of deleted data is by carving the sqlite database, please tell me what kind of data might be found h ...
Belkasoft
Topic: iOS SQLite database deleted data
Replies: 8
Views: 906
 

Re: File in unallocated space appears several times

Post Posted: Tue Jun 23, 2015 6:55 am

[quote="enafor"]I'm investigating a case where the name of a file (the same file) appears 7 times in the unallocated space.[/quote]

enafor,

Judging from the size of the two partitions, it seems ...
Belkasoft
Topic: File in unallocated space appears several times
Replies: 4
Views: 456
 

Re: Partial Drive Image

Post Posted: Mon Jun 15, 2015 11:10 am

E01 partial drive image is usually not too stable. We've had success when processing such images with [url=http://belkasoft.com/get]Belkasoft Evidence Center, but it is about 50/50 I would say. So I s ...
Belkasoft
Topic: Partial Drive Image
Replies: 5
Views: 1290
 

Re: Internet evidence - RAM or ROM?

Post Posted: Mon Jun 15, 2015 9:46 am

RAM only stores data until the computer is switched off, so yes, that makes it an unreliable place to STORE data, you are correct. However, the question is - will a suspect WANT to store data? Probabl ...
Belkasoft
Topic: Internet evidence - RAM or ROM?
Replies: 4
Views: 899
 
Page 1 of 18
Go to page 1, 2, 3 ... 16, 17, 18  Next