Articles Archives - Page 31 of 44

A guide to RegRipper and the art of timeline building

12th May 202025th September 2014

Background I have often heard RegRipper mentioned on forums and websites and how it was supposed to make examining event logs, registry files and other similar files a breeze (the event logs and the other files isn’t per say examined

Recovering Evidence from SSD Drives in 2014: Understanding TRIM, Garbage Collection and Exclusions

12th May 202023rd September 2014

We published an article on SSD forensics in 2012. SSD self-corrosion, TRIM and garbage collection were little known and poorly understood phenomena at that time, while encrypting and compressing SSD controllers were relatively uncommon. In 2014, many changes happened. We

Why Offender Profiling is Changing Thanks to Mobile Forensics and Increasingly ‘Social’ Criminal Activity

12th May 202026th August 2014

by Yuval Ben-Moshe, senior director of forensic technologies at Cellebrite Mobile forensics has changed the methodology when it comes to offender profiling. The frequent use of mobile devices has provided investigators with another source for profiling criminal suspects, as well

Understanding Cyber Bullying – Notes for Digital Forensics Examiners

12th May 20204th August 2014

by Carole Phillips The phenomenon of cyber bullying has received a significant amount of attention in the last decade and literature in this field has grown exponentially with advice and guidance on how to deal with cyber bullying. Yet the

Investigating the Dark Web – The Challenges of Online Anonymity for Digital Forensics Examiners

12th May 202028th July 2014

The recent rise in the number of people who suspect they may be being tracked on the internet, whether by government agencies, advertisers or nefarious groups, has led to increased interest in anonymising services such as TOR. TOR, or The

The Complete Workflow of Forensic Image and Video Analysis

12th May 202028th July 2014

In this article we’ll describe the complete workflow for image and video forensics. In fact, just like computer forensics is not only simply copying and looking at files, forensic video analysis is broad and complex and there are many steps

Browser Anti Forensics

12th May 20205th July 2014

This write-up is just to demonstrate that how one’s browser history can go off track misleading the examiner. An investigator can identify it by noticing the odd in history, sample given in Figure 2. Let’s first take a closer look

Coming apart at the SIEMs …

12th May 202017th June 2014

Security Information and Event Management (SIEM)1 systems are all the rage at the moment – and with good cause. As you are all aware, one item of data2 does not a case make, it is the combination & correlation between

WeChat Forensics

12th May 20202nd June 2014

Rapid growth of the usage of OS X has inspired forensic researchers to analyze devices such as the iPad, iPhone and Mac deeply. Therefore, OS X forensics, starting from Jonathan Zdziarski in 2008, became a very hot topic. However, most

Considering A Career in Audio-Video Forensics? Enhance Your Prospects With Continuing Education

12th May 202026th May 2014

Have you ever discovered a software feature that, had you known of it sooner, could have helped you in a prior case? Have you been using the same software methods and workflow procedures for the least two years? If you

Windows Logon Password – Get Windows Logon Password using Wdigest in Memory Dump

12th May 202028th April 2014

1. Introduction The former way to acquire the Windows logon password of user is to get a NTML hash value through the Windows logon session and registry then crack it. [Figure 1] shows the well-known ways to get a NTML

Windows Forensics and Security

12th May 202014th April 2014

By Adrian Leon Mare www.ExpertDataForensics.com The world we live in today is a technologically advanced world. While on one hand, commercialization of IT (Information technology) revolutionized our modern day lifestyle, it has raised a big question mark about the confidentiality

Samsung Galaxy Android 4.3 Jelly Bean acquisition using Joint Test Action Group (JTAG)

12th May 202011th March 2014

There have been some issues during data acquisitions with Samsung Galaxy having the Android 4.3, Jelly Bean as the operating system even if using the recommended steps for Logical File Dump, File System, or Physical Acquisitions for Cellebrite UFED Touch,

Webmail Forensics – Digging deeper into Browsers and Mobile Applications

12th May 20201st February 2014

Almost everyone who uses the Internet has a web-based email account. Many people have two or more, so the likelihood of a forensic investigator coming across a case involving webmail communication is very high. While law enforcement examiners can ask

Forensic analysis of the ESE database in Internet Explorer 10

12th May 202010th December 2013

———————————————————— Due to me not being able to reformat our thesis in a good way I strongly suggest you look at the whole paper in PDF format here: http://hh.diva-portal.org/smash/get/diva2:635743/FULLTEXT02.pdf /Philip ———————————————————— Forensic analysis of the ESE database in Internet Explorer

WhatsApp – discovering timestamps of deleted messages

12th May 20205th December 2013

ABSTRACT: This is a procedure for locating and parsing deleted messages timestamps in Android WhatsApp database. I did a little reverse engineering, using the hexadecimal tool of Physical Analyzer (UFED by Cellebrite), of the database of the popular messaging app