±Forensic Focus Partners
±Your Account

![]() |
![]() |
![]() |
![]() |
±Latest Articles
±Latest Videos
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
Search found 403 matches
Re: Extract $J
I did try getting my tool to re-create the file path. The issue is, that with the 2,000,000 records that were usually extracted, it took ages!
I may look at re-doing this in the future or a newer v ...
I may look at re-doing this in the future or a newer v ...
- minime2k9
- Topic: Extract $J
- Replies: 17
- Views: 1575
Re: Extract $J
I do have a tool that will recover all records from a disk, deleted and live.
Its usually used internally here, but I'll make it available to those who want it.
As a general rule, I get at least x2- ...
Its usually used internally here, but I'll make it available to those who want it.
As a general rule, I get at least x2- ...
- minime2k9
- Topic: Extract $J
- Replies: 17
- Views: 1575
Re: Extract $J
I thought that the $usnjrnl (and by association $J ADS) were not included as part of the volume shadow copies.
If that is the case, then it should give you the same data as the one from the current s ...
If that is the case, then it should give you the same data as the one from the current s ...
- minime2k9
- Topic: Extract $J
- Replies: 17
- Views: 1575
Re: Snapchat data from Graykey extraction?
See here:
https://support.magnetforensics.com/s/article/New-in-Magnet-AXIOM-3-7-0-16279
https://support.magnetforensics.com/s/article/New-in-Magnet-AXIOM-3-7-0-16279
- minime2k9
- Topic: Snapchat data from Graykey extraction?
- Replies: 4
- Views: 1304
Re: E01 Image format / tools
My understanding of reverse disk imaging is to do with caching of sectors.
AFAIK, When a disk reads sequentially it caches the sectors after it in anticipation. Where a disk is damaged, this can ca ...
AFAIK, When a disk reads sequentially it caches the sectors after it in anticipation. Where a disk is damaged, this can ca ...
- minime2k9
- Topic: E01 Image format / tools
- Replies: 16
- Views: 3057
Re: Noob carving query
No. Carving is a process for purely finding data based of attributes of data (header/footer) etc.
Deleted file recovery uses metadata to recover files and this may provide that information, even if ...
Deleted file recovery uses metadata to recover files and this may provide that information, even if ...
- minime2k9
- Topic: Noob carving query
- Replies: 2
- Views: 798
Re: ACPO Principles Revised
[quote="trewmte"]
The FSR Guidance does refer to analysis but nothing for digital forensics. Moreover, the Guidance refers to experience and expertise in the subject matter, not testing or calibratio ...
The FSR Guidance does refer to analysis but nothing for digital forensics. Moreover, the Guidance refers to experience and expertise in the subject matter, not testing or calibratio ...
- minime2k9
- Topic: ACPO Principles Revised
- Replies: 63
- Views: 9690