Voom Technologies Releases HardCopy 3

Voom Technologies (www.voomtech.com) has released HardCopy 3 (HC3), a faster, upgraded and enriched version of their renowned HardCopy 2 computer forensics hard-drive duplicator. HC3 offers data transfer speeds of up to 7.5 GB/min., eclipsing Voom’s own HardCopy 2. The HC3 runs single-pass data integrity validation (SHA256) and creates two forensically-sound copies of a suspect hard-drive, all simultaneously, without slowing down…Jerry Hatchett, Certified Computer Examiner, Licensed Private Investigator, Evidence Technology Houston, (www.evidencetechnology.net) says of the HC3, I’ve used Voom’s HardCopy units to acquire hard-drives across the country and around the world, and the new HardCopy 3 gets my enthusiastic recommendation. It’s faster, smaller, more featured, and still affordable for any size digital forensic practice. Go Voom!

Aaron Weiss, President, Abyte Solutions, Inc., (www.abytesolutions.net) recommends the HC3 as well. As a smaller forensic data acquisition company, the speed and simplicity of the HC3 allows me to take on much larger data acquisition projects.

Voom’s CEO, David Biessener, emphasizes that Voom focuses on delivering high performance, easy to use computer technology. With the HardCopy 3, Voom continues our commitment to provide law enforcement the latest in computer forensics tools. For more information contact Voom Technologies, Inc., at 1-800-442-1243 or email [email protected]

Leave a Comment

Latest Videos

Quantifying Data Volatility for IoT Forensics With Examples From Contiki OS

Forensic Focus 22nd June 2022 5:00 am

File timestamps are used by forensics practitioners as a fundamental artifact. For example, the creation of user files can show traces of user activity, while system files, like configuration and log files, typically reveal when a program was run. 

Despite timestamps being ubiquitous, the understanding of their exact meaning is mostly overlooked in favor of fully-automated, correlation-based approaches. Existing work for practitioners aims at understanding Windows and is not directly applicable to Unix-like systems. 

In this paper, we review how each layer of the software stack (kernel, file system, libraries, application) influences MACB timestamps on Unix systems such as Linux, OpenBSD, FreeBSD and macOS.

We examine how POSIX specifies the timestamp behavior and propose a framework for automatically profiling OS kernels, user mode libraries and applications, including compliance checks against POSIX.

Our implementation covers four different operating systems, the GIO and Qt library, as well as several user mode applications and is released as open-source.

Based on 187 compliance tests and automated profiling covering common file operations, we found multiple unexpected and non-compliant behaviors, both on common operations and in edge cases.

Furthermore, we provide tables summarizing timestamp behavior aimed to be used by practitioners as a quick-reference.

Learn more: https://dfrws.org/presentation/a-systematic-approach-to-understanding-macb-timestamps-on-unixlike-systems/

File timestamps are used by forensics practitioners as a fundamental artifact. For example, the creation of user files can show traces of user activity, while system files, like configuration and log files, typically reveal when a program was run.

Despite timestamps being ubiquitous, the understanding of their exact meaning is mostly overlooked in favor of fully-automated, correlation-based approaches. Existing work for practitioners aims at understanding Windows and is not directly applicable to Unix-like systems.

In this paper, we review how each layer of the software stack (kernel, file system, libraries, application) influences MACB timestamps on Unix systems such as Linux, OpenBSD, FreeBSD and macOS.

We examine how POSIX specifies the timestamp behavior and propose a framework for automatically profiling OS kernels, user mode libraries and applications, including compliance checks against POSIX.

Our implementation covers four different operating systems, the GIO and Qt library, as well as several user mode applications and is released as open-source.

Based on 187 compliance tests and automated profiling covering common file operations, we found multiple unexpected and non-compliant behaviors, both on common operations and in edge cases.

Furthermore, we provide tables summarizing timestamp behavior aimed to be used by practitioners as a quick-reference.

Learn more: https://dfrws.org/presentation/a-systematic-approach-to-understanding-macb-timestamps-on-unixlike-systems/

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_i0zd7HtluzY

A Systematic Approach to Understanding MACB Timestamps on Unixlike Systems

Forensic Focus 21st June 2022 5:00 am

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...