Decrypting BitLocker volumes or images is challenging due to the various encryption options offered by BitLocker that require different information for decryption.
This article explains BitLocker protectors and talks about the best ways to get the data decrypted, even for … Read more
Hey everyone, Trey Amick from Magnet Forensics here. Today we’re talking about Mac USB investigations, and what happens when we’ve been alerted that a USB has been inserted into an end point.
Different organisations handle USB policies differently. Some have … Read more
At MSAB, we’re always looking to improve our software and make every product more user-friendly, intuitive, and valuable; and to help save you time.
We’ve recently improved the way that XAMN displays and counts artifacts. Let’s take a look at … Read more
Let’s talk about the exciting new LACE Carver integration with Analyze DI Pro.
Once you have the proper license, you can head over to your Downloads page on MyGriffeye.com and go to the LACE Carver download.
Once the app package … Read more
So before we go to export our files from BlackLight to S21, what we will normally do is we will run the hashes against our case. In this case what we’ve done is we’ve already run these hashes against BlackLight, … Read more
by Blake Sawyer, Amped Software
When I worked for the police department, I was constantly pulled in a lot of different directions. To keep a good turnaround time for the nearly 200 requests we had each month, I was constantly … Read more
Hi, I’m Rich Frawley and I’m the Digital Forensic Specialist with ADF Solutions. Today we are going to conduct a boot scan of a MacBook Air that has APFS and FileVault 2 enabled.
At this point you have decided on … Read more
Written by:
Justin Matsuhara, Solutions Engineer, BlackBag Technologies
Stephanie Thompson, Solutions Engineer, BlackBag Technologies
Depending on the digital forensic imaging tool you have available, creating a forensic image of a Mac computer can be either an anxiety-creating situation, or as … Read more
Due to the rapidly growing need for securing safe environments around the world, digital surveillance systems have become ubiquitous. A significant number of new surveillance systems are installed each year, and the importance of acquiring actionable data from these … Read more
by Michelle Oh, HancomGMD
With an ever-increasing range of features and dramatically increased storage capacity, digital devices have become essential to our daily life. Their ability to store vast amounts of data means that these devices have proliferated and are … Read more
by Yuri Gubanov
Diving deeper may be the key to the eventual success of a digital forensic investigation. This is true not only when it comes to a single given case, but also when it comes to intersections between different … Read more
Welcome to Logicube’s tutorial on the Falcon-NEO forensic imager. The Falcon-NEO allows you to image directly to or from a network repository using SMB or CIFS protocol, or using iSCSI. Two 10GbE ports provide extremely fast network imaging performance. In … Read more
by Yuri Gubanov, Danil Nikolaev & Igor Mikhailov © Belkasoft Research
Carving is an irreplaceable technique widely used in data recovery and digital forensics. By using carving, we essentially perform a low-level scan of media for various artifacts, looking for … Read more
Welcome to Logicube’s tutorial on the optional Thunderbolt I/O card on the Forensic Falcon-NEO. In this session, we’ll show you how to install and use this card.
The optional Thunderbolt I/O card connects directly to Falcon-NEO’s source or destination I/O … Read more
Welcome to Logicube’s tutorial on the Forensic Falcon NEO. In this session, we’ll show you how to use the file browser feature.
The file browser feature of the Falcon NEO provides logical access to source and destination drives connected to … Read more
Welcome to Logicube’s tutorial on the Forensic Falcon NEO. In this episode, we’ll show you how to perform a logical image.
The logical imaging feature of Falcon NEO shortens the evidence collection process by allowing investigators to select and acquire … Read more