Forensic Focus Forum Round-Up

Welcome to this month’s round-up of recent posts to the Forensic Focus forums.

Forum members help a student with ISO 17025 data sets.

Why do some files have Last Accessed metadata, but no other metadata?

Can you explain why a partition would be showing as Bitlocker protected, even if it’s not running Bitlocker?

What are the main Windows 10 artifacts that are currently under-researched? Add your thoughts on the forum.

Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.

Why does this PDF file have an M timestamp just after the C timestamp?Is it possible to tell when an iOS device was reset?

Are these encrypted NTFS images – or not?

Is it possible to change a directory entry record in exFAT?

What do you do with a chip that’s been damaged during chip-off removal?

Can you help Harold to recover these video fragments?

Leave a Comment

Latest Videos

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles