Sounds very interesting, scalpel usually works well.
Let us know if the Belkasoft Evidence Center results with carving enabled will differ from scalpel's carving results.
You can get incognito and gmail from a memory dump if you have one. Not much will get stored on the disk, everything would be in memory, pagefile might be another option. Obviously anything in memory is time sensitive as you'll likely lose anything historical but it's worth trying.
For Gmail, you'll typically get the "Inbox view" instead of individual messages. Upside is you'll get a snippet of all the email messages, timestamp, sender, etc. in the inbox view, downside is it's only a snippet (first 255 characters) of the message. It's just how the browser data gets cached in memory. You'll likely need to get cloud access to get the full mailbox.
Send me an email if nobody is getting back to you about an IEF/AXIOM trial and I can help get you set up.
Jamie
Magnet Forensics
jamie.mcquaid@magnetforensics.com
Thanks Jamie! I haven't heard anything from Magnet for the demo. I wanted to try IEF, but then I downloaded Axiom over the weekend. I submitted a trial for it this morning as well.
Thanks!
I'm processing the evidence in Axiom as we speak…thanks!