Articles

SSD and eMMC Forensics 2016

What Has Changed in 2016 in the Way SSD Drives Self-Destruct Evidence. Demystifying eMMC, M.2, NVMe, and PCI-E. by Yuri Gubanov, Oleg Afonin © Belkasoft Research 2016 This publication continues the series started with an article on SSD forensics we

BitLocker: What’s New in Windows 10 November Update, And How To Break It

BitLocker is a popular full-disk encryption scheme employed in all versions of Windows (but not in every edition) since Windows Vista. BitLocker is used to protect stationary and removable volumes against outside attacks. Since Windows 8, BitLocker is activated by

Peering Through The Cloud

by Shahaf Rozanski Obscured by clouds With there now being more mobile phones on the planet than people and smartphones set to achieve saturation in just 10 years, unlocking the data held on them has increasingly needed to be used

Multi-Factor Authentication in Digital Forensics

Two-factor authentication is probably the best secure thing since passwords were invented. Two-factor authentication goes a long way towards protecting one’s accounts against being hacked. A password alone, no matter how long or secure, is no longer enough to provide

Forensic Acquisition of Google Accounts

Google collects and retains massive amounts of data about everyone who uses their services. Gaining access to that data is essential for solving many types of crimes. Learning what Google knows about the suspect can be a matter of utter

Virtual Hard Disk Image Format – A Forensic Overview

by Anil Kumar Types of Virtual Hard Disk Image Format The hard disk of a VM is implemented as the files, which live on their native file systems of the host machine. MS Virtual PC & MS Virtual Server support

Forensic Analysis Of Third Party Applications: Instagram

by Nor Zarina Binti Zainal Abidin Abstract Forensic analysis of mobile phones’ third party applications is a new area that needs to be explored. There are a lot of third party applications available in App store. Mobile forensic software tools

The Future of Mobile Forensics: November 2015 Follow-Up

by Oleg Afonin, Danil Nikolaev, Yuri Gubanov Mobile forensics is a moving target. In our recent article, “The Future of Mobile Forensics”, we described acquisition techniques that used to be state-of-the art back then. Weeks later, some things had changed

Countering Anti-Forensic Efforts – Part 2

by Oleg Afonin, Danil Nikolaev, Yuri Gubanov © Belkasoft Research 2015 In the first part of this paper we talked about the most common – and also some of the simplest – ways suspects can try to cover their tracks

Windows 8 Touch Keyboard Forensics

Microsoft released Windows 8 in 2012. With this new version, Microsoft made a fundamental shift in Windows 8 as compare to older versions of Windows. It does not only target netbooks, laptops and traditional computers, instead they decided to use

Countering Anti-Forensic Efforts – Part 1

by Oleg Afonin, Danil Nikolaev & Yuri Gubanov © Belkasoft Research 2015 Computer forensic techniques allow investigators to collect evidence from various digital devices. Tools and techniques exist allowing discovery of evidence that is difficult to get, including destroyed, locked,

Linux Timestamps, Oh boy!

Timestamps are critical for analysts; they usually deal with different filesystems and understanding how the file timestamps work on each is crucial to what they do. If you do an online search for linux timestamps, you’ll get ton of information

Standard Processes in Windows 10

by Robin Brocks On the 29th of June, Microsoft announced  the release of Windows 10, so it is time to have a deeper look at this new Operating System from the perspective of an Incident Responder. To make it easier

NAS Forensics Explained

by Oleg Afonin, Danil Nikolaev & Yuri Gubanov © Belkasoft Research 2015 Network Attached Storage (NAS) have a long track history of corporate deployments. Their scaled-down versions (ranging from single-bay to four-drive enclosures) are frequently used at homes and in