Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →

Forensic Focus

Malicious Phone Call Legislation in the UK

First published February 2009 by Greg Smith Mobile Telephone Evidence & Forensics trewmte.blogspot.com It is being noted that there is an exponential growth in harassing and intimidating calls from financial companies, card companies and from outsource debt collection firms chasing

SonyEricsson Hidden Evidence

First published February 2009 by Greg Smith Mobile Telephone Evidence & Forensics trewmte.blogspot.com I have discovered that it is possible when manually examining some SonyEricssons (such as “K” range etc) that after a user has deleted the Last Number Dialled

TomTom GPS Device Forensics

First published January 2009 Written by Ben LeMere ([email protected]) & Andy Sayers ([email protected]) For more information visit GPSForensics.org Introduction: The sales of portable navigation devices are at an all time high. Last year, more than forty million portable GPS devices

Passive Network Security Analysis with NetworkMiner

First published January 2009 by Erik Hjelmvik networkminer.sourceforge.net It is disturbing how often networks are not properly documented in terms of IP plans, network segmentations and network security. Having a good view of the network is essential when performing a

A Discussion of Virtual Machines Related to Forensics Analysis

First published November 2008 by Brett Shavers (PDF version here) The Virtual Machine (VM)Description of the Virtual Machine The Virtual Machine Concept in Brief Virtual machines are not new and have been in use for well over a half century.

Email Evidence – Now You See it, Now You Don’t!

First published October 2008 By Sandy Boucher and Barry Kuang, Intelysis Corp. Background With the ever increasing role of computers and electronic communications in both our business and personal lives, emails have taken on a key evidentiary role in many

Linux ‘dd’ basics

First published March 2008 Linux dd can be a powerful and flexible tool to have in your box.You will find it installed by default on the majority of Linux distributions available today and it can be used for a multitude

The International Society of Forensic Computer Examiners (ISFCE)

by Joleyn Smithing, ISFCE The International Society of Forensic Computer Examiners (ISFCE)is dedicated to the advancement of the science of forensic computer examinations. Established in 2002, the ISFCE began as a result of the efforts of Mr. John Mellon. A

Computer Evidence in the Casey Anthony Trial – A Post Mortem

"In the recent case of the State of Florida vs. Casey Anthony, a recovered Firefox 2 history from Unallocated Space became the focal point of the State's case surrounding arguments of "premeditation". During the course of the trial, two different

Looking Forward To A Career In Digital Forensics

First published January 2008 by James Hooker I am rapidly approaching my final year of University, studying for a Forensic Computing degree, and like all students across the globe on a similar course, I am on a mission to find

Potential Impacts of Windows Vista on Digital Investigations

First published December 2007 by Christopher Hargreaves and Howard Chivers Paper received 30th April, 2007. C.J.Hargreaves, Cranfield University, Defence Academy of the United Kingdom, Shrivenham, SN6 8SW (+44 (0)1793 785753; e-mail: [email protected]).H.Chivers, Cranfield University, Defence Academy of the United Kingdom,

A Forensic Analysis Of The Windows Registry

First published November 2007 Derrick J. Farmer Champlain College Burlington, Vermont [email protected] (click here for a revised, quick reference PDF version of this paper) AbstractThis paper will introduce the Microsoft Windows Registry database and explain how critically important a registry

Corporate Investigations and the UK Data Protection Act

First published September 2007 by Rowenna Fielding INTRODUCTION A number of requirements of the Data Protection Act apply to workplace monitoring. While the DPA does not prohibit employee monitoring and investigation, any such activity must conform to the requirements of