±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 4 Visitors: 174

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Search found 242 matches

Re: Reliability of an external enclosure hardware write bloc

Post Posted: Feb 13, 20 20:51

[quote]but that doesn't mean that the counterpart in a trial won't use this hash mismatch to grill you on the stand and attempt to invalidate each and every one of your (BTW perfectly valid) findings[ ...
thefuf
Topic: Reliability of an external enclosure hardware write blocker
Replies: 11
Views: 2991
 

Re: Reliability of an external enclosure hardware write bloc

Post Posted: Feb 13, 20 20:40

[quote]alter last mount time, last write time, mount count and a byte at location 0x0178 within the superblock of some ext2/3/4 volumes[/quote]

Don't forget that the words quoted are true for a sim ...
thefuf
Topic: Reliability of an external enclosure hardware write blocker
Replies: 11
Views: 2991
 

Re: Unallocated vs Free Space

Post Posted: Feb 11, 20 14:18

[quote]you seemingly intentionally made a filesystem "hiding" some data (this is steganography).[/quote]

No, I just formatted a virtual drive.

[quote]Both contain (not everywhere but in spots) s ...
thefuf
Topic: Unallocated vs Free Space
Replies: 12
Views: 1396
 

Re: Unallocated vs Free Space

Post Posted: Feb 11, 20 12:48

That doesn't make sense. This data, by its nature, doesn't belong to a current file system (it was created before the format), but it's listed as allocated (and as [u]active file data[/u]) by that fil ...
thefuf
Topic: Unallocated vs Free Space
Replies: 12
Views: 1396
 

Re: Unallocated vs Free Space

Post Posted: Feb 11, 20 12:24

[quote="jaclaz"]Let's try to draw a line.

Free space is what you can actually see in many OS tools, it means "available space that can be written to".

When you start from a wiped device and crea ...
thefuf
Topic: Unallocated vs Free Space
Replies: 12
Views: 1396
 

Re: Large hard drive imaging

Post Posted: Feb 02, 20 21:57

[quote="minime2k9"]I'm honestly shocked that people still use FTK or Encase for imaging.
Or Encase for anything actually[/quote]

Just read this: https://www.reddit.com/r/computerforensics/comments ...
thefuf
Topic: Large hard drive imaging
Replies: 16
Views: 2504
 

Re: NTFS, number of runs/extents

Post Posted: Feb 02, 20 10:05

[quote="CyberGonzo"]Hi,

I have an NTFS parsing implementation that works well.

As an improvement action I'm now looking to see if I can determine the amount of data runs without parsing the actu ...
thefuf
Topic: NTFS, number of runs/extents
Replies: 2
Views: 584
 
Page 1 of 35
Page 1, 2, 3 ... 33, 34, 35  Next