Forensic Focus Forum Round-Up

Welcome to this month’s round-up of recent posts to the Forensic Focus forums.

Forum members help a student with ISO 17025 data sets.

Why do some files have Last Accessed metadata, but no other metadata?

Can you explain why a partition would be showing as Bitlocker protected, even if it’s not running Bitlocker?

What are the main Windows 10 artifacts that are currently under-researched? Add your thoughts on the forum.

Why does this PDF file have an M timestamp just after the C timestamp?Is it possible to tell when an iOS device was reset?

Are these encrypted NTFS images – or not?

Is it possible to change a directory entry record in exFAT?

What do you do with a chip that’s been damaged during chip-off removal?

Can you help Harold to recover these video fragments?

Leave a Comment