Welcome to this month’s round-up of recent posts to the Forensic Focus forums.
Forum members help a student with ISO 17025 data sets.
Why do some files have Last Accessed metadata, but no other metadata?
Can you explain why a partition would be showing as Bitlocker protected, even if it’s not running Bitlocker?
What are the main Windows 10 artifacts that are currently under-researched? Add your thoughts on the forum.
Why does this PDF file have an M timestamp just after the C timestamp?Is it possible to tell when an iOS device was reset?
Are these encrypted NTFS images – or not?
Is it possible to change a directory entry record in exFAT?
What do you do with a chip that’s been damaged during chip-off removal?
Can you help Harold to recover these video fragments?
