Welcome to this month’s round-up of recent posts to the Forensic Focus forums.
Can you help byrlord to find data on a drive that has been accidentally formatted?
How would you demonstrate that a specific user deleted files form a Windows PC?
The largest partition on this Microsoft Surface Pro 4 is showing up as an unrecognized file system – what might have gone wrong?
Why did the hash value change on these Excel files? Share your thoughts on the forum.
Pbeardmore shares some evidence given to the House of Lords about forensics – watch it here.Can you help pbmattingly to acquire a MacBook Pro image?
Forum members discuss why deleted data might be showing up as corrupt.
Do you have any suggestions for safe rooting access to an encrypted data partition on an Alcatel phone? Add your thoughts on the forum.
How would you convert an .e01 to run on vmware?
Forum members discuss the legal implications of using different kinds of forensic tools.
