Articles

Forensic Imaging of Hard Disk Drives- What we thought we knew

By Todd G. Shipley and Bryan Door (A complete copy of this white paper and its figures and diagrams can be found at www.nfdrtc.net). WHAT WE HAVE BEEN TAUGHT Imaging of hard drives has been the main stay of the

Can Your Digital Images Withstand A Court Challenge?

The term “digital” in law enforcement is almost immediately associated with digital forensics, i.e.; computer crimes, cyber terrorism, child porn on computer hard drives, and other areas that require special training, expertise, and equipment to investigate these types of digital

Review: Proof Finder by Nuix

Reviewed by Jonathan Krause of Forensic Control Well, this is an interesting proposition. Early last December Nuix, the respected producers of eDiscovery software, released an intriguing, and as far as I know in this sector, unique, application. Called Proof Finder,

Forensic Toolkit v3 Tips and Tricks ― Not on a Budget

A couple of weeks ago, Brian Glass posted a very helpful comment, Forensic Toolkit v3 Tips and Tricks — on a Budget.  His comment focused on how to “get close to SSD performance on the cheap” and he discussed the

iPhone Tracking – from a forensic point of view

– Introduction – iPhoneTracking is sexy!!! Every mobile forensic suite, at least the ones dealing with iPhones, are providing it proudly. iPhoneTracking also has been a hot topic in the media all around the globe. People stated, that there is

Android Forensics Study of Password and Pattern Lock Protection

Let’s see what Pattern Lock is, how to access, determine or even get rid of it? We’ll also speak about Password Lock Protection and find out what it has in common with Pattern Lock. And finally we’ll try to understand 

Skype in eDiscovery

Author: Stuart Clarke, 7Safe The EDRM (Electronic Discovery Reference Model) is a widely accepted workflow, which guides those involved in eDiscovery. Typically, the identification and collection phases see email and common office documents harvested, but as technology moves forward is

Forensic Toolkit v3 Tips and Tricks – On a budget

While researching FTK 3X and Oracle, you just recently discovered that the best configuration of your Oracle database would be on a solid state drive (SSD). Solid state drives give the maximum level of performance to Oracle databases and in

Anonymous, what does it mean?

Anonymous, a word which Merriam-Webster describes as: of unknown authorship or origin, not named or identified, or lacking individuality, distinction, or recognizability. There are some in this world that wish to remain anonymous, not named or identified. Sure I am

Advice for Digital Forensics Job Seekers

by Joe Alonzo [email protected] You see the job advertisements posted on the web everyday, Digital Forensics Analyst, Internet Investigator, Computer Forensic Associate.  You hit the Apply Now button, often never hearing back from said company. Your background may consist of

Forensic Toolkit v3 Tips and Tricks – Re-indexing a case

This is the first in a series of articles that will cover topics concerning AccessData Forensic Toolkit (FTK) version 3. So you’ve created a case in FTK 3.X / Oracle and added 20 forensic images of seized computers and assorted

What is “good enough” information security?

by Simon Biles I have, occasionally in the past, mentored people in (on?) Information Security – once for money (this is not a revenue stream that I’ve mastered by any stretch of the imagination!), but more often than not, informally

Google History Forensics

by Craig Ball In my last Forensic Focus column, I touched on migration to handhelds and the cloud, mushrooming drive capacities and encryption-by-default as just some of the factors auguring the eventual extinction of conventional digital forensics. But an end