Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →

Forensic Focus

Interview With Yuri Gubanov, CEO, Belkasoft

Check why the interview with Yuri Gubanov, CEO of Belkasoft, is special and also find a secret deal inside Yuri’s talk! Yuri, you told me that this interview is a bit unusual, what did you mean? To be honest, I

New Version 7.2 of XRY Released

Released this week, this latest version of XRY supports 20,128 mobile forensics profiles, including 1352 different apps, to make sure you stay ahead. You will also find new features added to XAMN Spotlight v1.3. Highlights in XRY v7.2: »» Enhanced

Attributing A Third Party To A Recovered (Deleted) IOS SMS Message

In a recent forensic case involving recovered deleted sms messages from an sms.db file on an IOS mobile device none of the mainstream mobile phone forensic software made the link between sender and recipient for the recovered records of interest.

Review: Advanced FTK Training From AccessData

Reviewed by Azeem – Cyber Security Professional At the end of the three-day, instructor-led AccessData Advanced FTK (Forensic Toolkit) class, students have been exposed to and trained in the effective use of advanced analysis with FTK, FTK Imager, Password Recovery

Advanced FTK Training From AccessData

Reviewed by Azeem – Cyber Security Professional At the end of the three-day, instructor-led AccessData Advanced FTK (Forensic Toolkit) class, students have been exposed to and trained in the effective use of advanced analysis with FTK, FTK Imager, Password Recovery

Forensic Focus Forum Round-Up

Welcome to this month’s round-up of recent posts to the Forensic Focus forums. Forum members discuss how they manage their inventory. Do you have any tips to help giandega acquire a Western Digital 1TB hard disk? Is the date-time counter

Forensic Implications of iOS Lockdown (Pairing) Records

In recent versions of iOS, successful acquisition of a locked device is no longer a given. Multiple protection layers and Apple’s new policy on handling government requests make forensic experts look elsewhere when investigating Apple smartphones. In this publication, we’ll

Forensic Implications of iOS Lockdown (Pairing) Records

by ElcomSoft In recent versions of iOS, successful acquisition of a locked device is no longer a given. Multiple protection layers and Apple’s new policy on handling government requests make forensic experts look elsewhere when investigating Apple smartphones. In this

Interview With Ezra Kohavi, CEO, MediaClone

Ezra, you're CEO at MediaClone. Tell us a bit about your role – what does a typical day look like for you? MediaClone is a small company where every employee wears many “hats,” works extremely efficiently, and performs different functions,

Ezra Kohavi, CEO, MediaClone

Ezra, you're CEO at MediaClone. Tell us a bit about your role – what does a typical day look like for you? MediaClone is a small company where every employee wears many “hats,” works extremely efficiently, and performs different functions,

Touch Screen Lexicon Forensics (TextHarvester / WaitList.dat)

By Barnaby Skeggs Since the release of Windows 8, and the ‘Metro’ interface, touch screen input has been implemented in a rapidly rising number of Windows devices including Microsoft Surface Pro/Book, 2-in-1s, convertible laptops and tablets. Microsoft has catered for

Touch Screen Lexicon Forensics (TextHarvester / WaitList.dat)

By Barnaby Skeggs Preamble Since the release of Windows 8, and the ‘Metro’ interface, touch screen input has been implemented in a rapidly rising number of Windows devices including Microsoft Surface Pro/Book, 2-in-1s, convertible laptops and tablets. Microsoft has catered

Malware Can Hide, But It Must Run

It’s October, haunting season. However, in the forensics world, the hunting of evil never ends. And with Windows 10 expected to be the new normal, digital forensics and incident response (DFIR) professionals who lack the necessary (memory) hunting skills will

Malware Can Hide, But It Must Run

by Alissa Torres, SANS Certified Instructor It’s October, haunting season. However, in the forensics world, the hunting of evil never ends. And with Windows 10 expected to be the new normal, digital forensics and incident response (DFIR) professionals who lack

The “I’ve Been Hacked” Defence

by Yuri Gubanov, Oleg Afonin(C) Belkasoft Research, 2016 AbstractThis article was inspired by an active discussion in one of the forensic listservs. Original post was asking on how to fight with an argument “This is not me, this is a

The “I’ve Been Hacked” Defence

By: Yuri Gubanov, Oleg Afonin (C) Belkasoft Research, 2016 Abstract This article was inspired by an active discussion in one of the forensic listservs. Original post was asking on how to fight with an argument “This is not me, this