Author Archives: Forensic Focus

Guidance Software (Now OpenText) has recently released EnCase® Forensic and EnCase Endpoint Investigator 8.05 supporting mobile device acquisitions in addition to the all-new EnCase Mobile Investigator, which offers powerful mobile data review and reporting capabilities for acquired mobile data.

Working with the forensic community, we developed EnCase Mobile Investigator with the needs of examiners in mind. Our new mobile forensics solution delivers the same level of visibility to mobile devices as delivered to traditional endpoints through EnCase Forensic. With continuous updates to mobile operating systems and popular apps, the broadest mobile device support available, and powerful investigation features, EnCase Mobile Investigator stands out from the pack — empowering examiners to find, analyze, and report on the evidence they need to close cases. Continue reading Three Things You Need To Know About EnCase Mobile Investigator→

We live in a truly digital age. The Internet of Things (IoT) is at the forefront of almost everything we touch as consumers. From the Amazon Echo to smart door locks, we are integrating IoT devices into daily life. However, users often don’t realize how much data these devices collect and store.

The IoT is also fuelling a frenetic pace for new and changing technology. The evolution of a cell phone from the first models in the 1990’s to today’s iPhone x took 20 years. On the other hand, IoT technology is changing much more quickly. With more devices connected than ever – according to Gartner, we will hit 20 billion IoT devices by 2020 – the digital forensic community faces several unique questions: Continue reading Why You Need Forensics In An IoT World→

We live in a truly digital age. The Internet of Things (IoT) is at the forefront of almost everything we touch as consumers. From the Amazon Echo to smart door locks, we are integrating IoT devices into daily life. However, users often don’t realize how much data these devices collect and store.

The IoT is also fuelling a frenetic pace for new and changing technology. The evolution of a cell phone from the first models in the 1990’s to today’s iPhone x took 20 years. On the other hand, IoT technology is changing much more quickly. With more devices connected than ever – according to Gartner, we will hit 20 billion IoT devices by 2020 – the digital forensic community faces several unique questions: Continue reading Why You Need Forensics In An IoT World→

Latest release of MOBILedit Forensic Express brings many great additions including support of iOS 11 and Apple’s new photo format HEIF, Android user dictionary analysis, determine Android clock/time-zone manipulation, and improved deleted data and cell… Continue reading MOBILedit 4.2 Supports New Apple HEIF Photo Format, Improves Cell Tower Data→

Latest release of MOBILedit Forensic Express brings many great additions including support of iOS 11 and Apple’s new photo format HEIF, Android user dictionary analysis, determine Android clock/time-zone manipulation, and improved deleted data and cell… Continue reading MOBILedit 4.2 Supports New Apple HEIF Photo Format, Improves Cell Tower Data→

Welcome to this month’s round-up of recent posts to the Forensic Focus forums.

Apple have announced a new file system – share your thoughts on the forum.

Are these encrypted files, and if so, how would you access them?

Forum members discuss last written times on MountPoints2.

What do you think of balloon powered internet? Chime in on the forum.

Can you help marcyu to decrypt Microsoft Word 2003 40-bit encryption? Continue reading Forensic Focus Forum Round-Up→

AccessData is offering a series of live training webinars based on some of our most popular sessions of the recent past. Our trainers have 30 years of experience in delivering superior training and certifications for digital forensics and legal e-discovery. Your seat is free, so register soon—they won’t last long!

http://marketing.accessdata.com/bydemandwebinars Continue reading Free Live Webinars Of Our Most Requested AccessData Training Sessions→

by Frank Block and Andreas Dewald

The analysis of memory during a forensic investigation is often an important step to reconstruct events. While prior work in this field has mostly concentrated on information residing in the kernel space (process lists, network connections, and so on) and in particular on the Microsoft Windows operating system, this work focuses on Linux user space processes as they might also contain valuable information for an investigation. Because a lot of process data is located in the heap, this work in the first place concentrates on the analysis of Glibc’s heap implementation and on how and where heap related information is stored in the virtual memory of Linux processes that use the Glibc heap implementation. Up to now, the heap was mostly considered a large cohesive memory region from a memory forensics perspective, making it rather hard manual work to identify relevant information inside.

Read More Continue reading Linux Memory Forensics: Dissecting the User Space Process Heap→

by Haider H. Khaleel

Since the end of the 19th Century until the current time, law enforcement has been facing a rapid increase in computer-related crimes. In the present time, digital forensics has become an important aspect of not only law enforceme… Continue reading Focused Digital Forensic Methodology→

This year at DFRWS EU, Jan Peter van Zandwijk from the Netherlands Forensic Institute presented research into bit-errors.

Take a look at the video and the full transcript here. Continue reading Video: Bit Errors As A Source Of Information In Nand Flash MemoryBit Errors→