BlackBag Technologies is proud to announce the first and only solution to produce a decrypted physical image of Apple’s latest Mac systems utilizing the T2 chip.

Current logical imaging solutions, including functionality available in the previous version of BlackBag’s own MacQuisition tool, and competing solutions like Sumuri Recon and EnCase, miss critical file system information that only this new level of physical access will be able to provide.

This vital imaging functionality will be available in the upcoming MacQuisition 2019 R1 release and the output will be seamlessly ingested for analysis by BlackLight 2019 R1.

• Posted by: blackbag
• Topic: News
• Score: 0 / 5
• (731 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

by Jade James

This article is a recap of some of the main highlights from the Forensics Europe Expo 2019, which took place in London, UK on the 5th and 6th of March.

The Forensics Europe Expo has now run for seven years and is co-located with the Security & Counter Terror Expo at Olympia London. The expo has truly established itself as a must-visit event, with 2,500 professionals visiting exhibitors, attending seminars and workshops, and of course networking over the course of the two days.

The Expo offers the opportunity for visitors to experience first-hand innovative and cost effective solutions in the field of digital forensics and the more traditional wet forensics, provided by over 60 international suppliers. As well as the opportunity to attend the educational features where you can watch live demonstrations, there are also workshops on topics ranging from drone forensics to digital evidence management. All seminar sessions are CPD accredited.

Read More

• Posted by: scar
• Topic: News
• Score: 0 / 5
• (327 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

Every year law enforcement officers identify and save thousands of children around the world from sexual abuse. Technology providers are constantly working on new solutions to help solve more crimes and save more children. And importantly to help the people doing the job who are swamped with thousands of images of CSA every day.

• Posted by: Griffeye
• Topic: News
• Score: 0 / 5
• (442 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

Thomas Chopitea and Aaron Peterson discuss their research at DFRWS US 2018.

Thomas: It’s our first time presenting here at DFRWS. It’s also my first time and Aaron’s first time attending. So, we’re pretty excited to be here. I’m Tom, this is Aaron. We both work at Google. We do forensics and incident response. So, this basically means that we write a lot of code, because we’re lazy and we like to do things automatically. Aaron is the core developer for [Turbinia], I’m one of the core developers of [dfTimewolf], which we will introduce in a minute.

We’re in this sweet position where we can write a lot of code and also use the same code that we write in our daily incidents. So, that’s pretty cool, because we don’t have to follow feature requests [… well, we do … between] both of us. But most of the time, we can get … since we’re in the same team, we can get things solved pretty fast. And we really know what to expect and what we want our tools to do. So, that’s pretty cool.

• Posted by: scar
• Topic: News
• Score: 0 / 5
• (478 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

Amped Software has launched Amped Replay, a new tool which allows frontline police officers and investigators to quickly and easily view, analyze and present video evidence. With Amped Replay, non-specialist units can convert and play videos from a variety of proprietary formats, apply basic enhancements, annotate and redact images for investigations and media release, all while maintaining the integrity of the evidence and without having to rely on the availability of experts in the forensic video lab.

Video footage from CCTV and DVR systems, body-worn cameras, dash cams, mobile phones and social media can be crucial in progressing an investigation, especially in the “golden hour” when time is of the essence. However, with a multitude of proprietary video formats to consider, even playing and viewing the footage can be time-consuming and difficult. Powered by the same CCTV video conversion engine that sits behind Amped Software’s other solutions for forensic experts, Amped Replay solves this problem by enabling users to simply drag and drop the footage into the software, where it is ready to view.

• Posted by: AmpedSoftware
• Topic: News
• Score: 0 / 5
• (1108 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

Welcome to this month's round-up of posts in the Forensic Focus forums.

Can you help honor_the_data with a data recovery question on a 101 partition?

BSides Bristol has put out a call for presentations.

How would you log in to a Windows 10 machine that has been virtualized?

Forum members discuss how to work out the timestamp on an OS change from Windows to Ubuntu.

What anti-virus software would you recommend for a forensic workstation?

• Posted by: scar
• Topic: All
• Score: 0 / 5
• (693 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

New IoT devices with cameras, 5G, and AI analytics coming in 2019 will change the digital forensic landscape forever, says HancomGMD.

In late 2016, South Korea was rocked by one of its biggest political corruption scandals in history that eventually led to former President Park Guen-Hye being impeached and jailed.

A special prosecutor was elected to proceed with the slew of bribery charges.

By law, investigators had limited days to investigate and prosecute. They had confiscated over several hundreds of smartphones as evidence. With more in the form of notebooks and desktops -- from suspects and needed to analyze tens of thousands of phone records and chat messages under a tight deadline. A single piece of evidence from any one of them could have been the smoking gun needed for a successful indictment.

• Posted by: YJOH
• Topic: News
• Score: 0 / 5
• (1550 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

by Christa Miller

Quite a lot has been written over recent weeks about burnout. Not only DFIR-specific posts, first from Richard Bejtlich and then, in follow-up from Eric Huber and Brett Shavers; but also news articles including:

• Why Are Young People Pretending to Love Work? (The New York Times)
• How Millennials Became The Burnout Generation (BuzzFeed)
• 10 Ways To Buck ‘The Cult of Busy’ Habit For A Better Work Life Balance (Forbes)

Clearly, as The Guardian relates, the problem is endemic across industries, professions, and organizations. Yet burnout in the digital forensics world is unique. In addition to more typical work and life pressures, digital forensic examiners are faced with traumatic images and audio, long hours, and justice that often seems to be unevenly applied. Few other people understand the job or its stressors, and for those working counterterror investigations, operational security limits the possibility of “talk therapy” even further.

Read More

• Posted by: scar
• Topic: News
• Score: 0 / 5
• (737 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

Magnet Forensics, the global leader in digital investigation software for mobile, cloud, and computer examinations, is proud to announce Magnet AUTOMATE—an innovative new solution that allows digital forensics labs to complete investigations faster by powering a repeatable forensic workflow that minimizes downtime and maximizes efficiency.

• Posted by: MagnetForensics
• Topic: News
• Score: 0 / 5
• (954 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

Steve: I have a few things to tell you. That when we first proposed this project to DHS, it was about two, two-and-a-half years ago, and then, at that point in time, there was really little industry penetration with drone forensics at that time. There was a couple of … University of New Haven had done some research, [06:13] out of the UK had done some research on drones, but there wasn’t vendor support at that time, and we just saw a gap that needed to be filled. At the same time, drones were coming over the border, they were landing at sensitive government locations, and they were showing up in labs. And labs were needing to know, “How do we get the data off of these devices?”

Our approach for this project is to do a complete physical analysis on the consumer professional drones that were touching, and identification of all the available technical information that’s out there. So, if you go and pull our reports, as an example, that I’ll show you a cover image of, it has not only what we’ve found, but everything else we’ve found online about them. If somebody else has hacked them, if somebody else has done [teardowns], we want to make all of that available to you, so you can find it.

• Posted by: scar
• Topic: News
• Score: 0 / 5
• (883 reads)

• comments?
• Printer Friendly Page
• Send to a Friend