±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 7 Overall: 36096
New Yesterday: 4 Visitors: 182

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Search found 42 matches

Re: Cannot access H partition to image

Post Posted: Jul 18, 15 00:18

I am obviously making some assumptions here, but, take a physical image of the hd using dd, dcfld, or FTK Imager Lite (free). Then open the image file in WinHex or X-Ways, or, Autopsy (any number of ...
sgware
Topic: Cannot access H partition to image
Replies: 9
Views: 5461
 

Re: Pagefile.sys

Post Posted: Jun 30, 14 23:10

I'm late to this discussion, so forgive that please. About the IP. IP reputations change frequently. A family machine behind an ISP IP could be sending malware call backs to a C2 from an IP used b ...
sgware
Topic: Pagefile.sys
Replies: 24
Views: 18648
 

Re: Identifying the Major challenges of DF Investigations

Post Posted: Feb 12, 14 01:03

This is, of course, only my opinion. A primary purpose of digital forensics is the use of science to answer questions about digital evidence for the legal community. The major challenge is to provid ...
sgware
Topic: Identifying the Major challenges of DF Investigations
Replies: 8
Views: 5971
 

Re: What's the best Linux distribution for Forensic Computin

Post Posted: Feb 08, 14 20:24

I suggest, along with @athulin and @jaclaz that you look at the distributions already configured for forensic response and investigation, i.e., SANS SIFT, CAINE, or RAPTOR.

Once you have a grip on ...
sgware
Topic: What's the best Linux distribution for Forensic Computing?
Replies: 3
Views: 9424
 

Re: Windows 7 MBR system unable to view Windows 8 GPT HDD

Post Posted: Feb 08, 14 20:07

I think this discussion is heading in the right direction. Having read the MS docs and Toshiba specs 4K/AF compatibility with Win 7, the write blocker, or others such as drivers etc could be part of ...
sgware
Topic: Windows 7 MBR system unable to view Windows 8 GPT HDD
Replies: 27
Views: 37404
 

Re: Windows 7 MBR system unable to view Windows 8 GPT HDD

Post Posted: Feb 07, 14 21:38

Have you examined the image to determine if the PMBR and GPT header are where they are supposed to be and have the correct structure/data?

For example, the PMBR should be in physical sector 0 and h ...
sgware
Topic: Windows 7 MBR system unable to view Windows 8 GPT HDD
Replies: 27
Views: 37404
 

Re: Advanced forensics concepts

Post Posted: Oct 30, 13 01:07

Isn't "advanced" or "intermediate" really dependent on the aptitude, drive, and experience required to master the topic? That is where I was going, albeit not clearly, in my post.
sgware
Topic: Advanced forensics concepts
Replies: 36
Views: 32499
 
Page 1 of 6
Page 1, 2, 3, 4, 5, 6  Next