Articles Archives - Page 32 of 45

Investigation and Intelligence Framework (IIF) – an evidence extraction model for investigation

12th May 202029th November 2014

Authors Alan, Kelvin, Anthony and Zetta (VXRL) Disclaimer This framework was first introduced in DFRWS EU 2014 (the first DFRWS conference in Europe) at Amsterdam held in May and later presented at Hacks in Taiwan 2014 (HITCON) which is a

Extracting data from dump of mobile devices running Android operating system

12th May 202028th October 2014

In this article, we are going to tell about opportunities of utilizing programs that are used on a day-to-day basis in computer forensics and examination for analysis of mobile devices running Android operating system. Introduction Most of the mobile devices

Development of Digital Forensic Tools on Mobile Device, a Potential Area to Consider?

12th May 202019th October 2014

Case Study: MobileTriage – JPEG Metadata Triage – Automated Extraction of Information using Mobile Forensic Tools Background Mobile devices are now becoming part of our daily lives. These devices can now perform tasks or activities that were normally being processed

Can You Get That License Plate?

12th May 20208th October 2014

We find ourselves analyzing new surveillance videos almost every day, and in most cases we can either solve the problem very quickly or understand (even quicker) that there is no information to recover in the video. In special cases though,

How To Decrypt WeChat EnMicroMsg.db Database?

12th May 20201st October 2014

WeChat is a smartphone application where users can chat with their friends, share pictures, videos and audio chats. Users can also make free video calls and voice calls with their friends as long as they have Internet connection. Recently, we

A guide to RegRipper and the art of timeline building

12th May 202025th September 2014

Background I have often heard RegRipper mentioned on forums and websites and how it was supposed to make examining event logs, registry files and other similar files a breeze (the event logs and the other files isn’t per say examined

Recovering Evidence from SSD Drives in 2014: Understanding TRIM, Garbage Collection and Exclusions

12th May 202023rd September 2014

We published an article on SSD forensics in 2012. SSD self-corrosion, TRIM and garbage collection were little known and poorly understood phenomena at that time, while encrypting and compressing SSD controllers were relatively uncommon. In 2014, many changes happened. We

Why Offender Profiling is Changing Thanks to Mobile Forensics and Increasingly ‘Social’ Criminal Activity

12th May 202026th August 2014

by Yuval Ben-Moshe, senior director of forensic technologies at Cellebrite Mobile forensics has changed the methodology when it comes to offender profiling. The frequent use of mobile devices has provided investigators with another source for profiling criminal suspects, as well

Understanding Cyber Bullying – Notes for Digital Forensics Examiners

12th May 20204th August 2014

by Carole Phillips The phenomenon of cyber bullying has received a significant amount of attention in the last decade and literature in this field has grown exponentially with advice and guidance on how to deal with cyber bullying. Yet the

Investigating the Dark Web – The Challenges of Online Anonymity for Digital Forensics Examiners

12th May 202028th July 2014

The recent rise in the number of people who suspect they may be being tracked on the internet, whether by government agencies, advertisers or nefarious groups, has led to increased interest in anonymising services such as TOR. TOR, or The

The Complete Workflow of Forensic Image and Video Analysis

12th May 202028th July 2014

In this article we’ll describe the complete workflow for image and video forensics. In fact, just like computer forensics is not only simply copying and looking at files, forensic video analysis is broad and complex and there are many steps

Browser Anti Forensics

12th May 20205th July 2014

This write-up is just to demonstrate that how one’s browser history can go off track misleading the examiner. An investigator can identify it by noticing the odd in history, sample given in Figure 2. Let’s first take a closer look

Coming apart at the SIEMs …

12th May 202017th June 2014

Security Information and Event Management (SIEM)1 systems are all the rage at the moment – and with good cause. As you are all aware, one item of data2 does not a case make, it is the combination & correlation between

WeChat Forensics

12th May 20202nd June 2014

Rapid growth of the usage of OS X has inspired forensic researchers to analyze devices such as the iPad, iPhone and Mac deeply. Therefore, OS X forensics, starting from Jonathan Zdziarski in 2008, became a very hot topic. However, most

Considering A Career in Audio-Video Forensics? Enhance Your Prospects With Continuing Education

12th May 202026th May 2014

Have you ever discovered a software feature that, had you known of it sooner, could have helped you in a prior case? Have you been using the same software methods and workflow procedures for the least two years? If you

Windows Logon Password – Get Windows Logon Password using Wdigest in Memory Dump

12th May 202028th April 2014

1. Introduction The former way to acquire the Windows logon password of user is to get a NTML hash value through the Windows logon session and registry then crack it. [Figure 1] shows the well-known ways to get a NTML