±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36121
New Yesterday: 0 Visitors: 139

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Search found 214 matches

Re: MFT Data

Post Posted: May 03, 19 05:32

It could point to the offset from before the format, but have really no idea what may have happened on this volume. If you know exactly how many bytes was "prepended", you could try extract that from ...
joakims
Topic: MFT Data
Replies: 3
Views: 938
 

Re: MFT Data

Post Posted: May 02, 19 21:45

Could be the whatever tool you used, could not handle $ATTRIBUTE_LIST. Grab 26 clusters from LCN 15670. That is from volume offset (15670 x cluster size). Then upload those bytes.

Btw, what tool di ...
joakims
Topic: MFT Data
Replies: 3
Views: 938
 

Re: NTFS external drive

Post Posted: Feb 28, 19 15:56

You should also consider UsnJrnl records from unallocated and slack. And, remnants of earlier memory snapshots may be found within the hibernation file if present (outside the current and active part) ...
joakims
Topic: NTFS external drive
Replies: 14
Views: 2743
 

Re: USN Journal and Log file analysis

Post Posted: Oct 01, 18 23:18

They are both recycled, but in different ways. Don't know which tools you used. It is rather a decoding and dump of data into csv, than a convert. Anyways, importing to Excel should work, at least wit ...
joakims
Topic: USN Journal and Log file analysis
Replies: 11
Views: 5370
 

Re: USN Journal and Log file analysis

Post Posted: Sep 30, 18 22:17

You could also try analyzing the $LogFile. It is recycled though, so if you are looking at FS transactions from some time back, then it might be overwritten. Unless you already found a tool for decodi ...
joakims
Topic: USN Journal and Log file analysis
Replies: 11
Views: 5370
 

Re: Password-Protected Windows 10

Post Posted: Jul 19, 18 20:28

Yes you're right. I forgot to mention that it applies only for the edge case mentioned where system had not been hibernated previously. That said and given what I previously described, it is thus pote ...
joakims
Topic: Password-Protected Windows 10
Replies: 25
Views: 15013
 

Re: Password-Protected Windows 10

Post Posted: Jul 19, 18 15:10

One thing about the hibernation method suggested. I agree that it is of course disasterous for the purpose of finding data in unallocated on disk. But the level of disasterousness may actually be slig ...
joakims
Topic: Password-Protected Windows 10
Replies: 25
Views: 15013
 
Page 1 of 31
Page 1, 2, 3 ... 29, 30, 31  Next