Author Archives: Forensic Focus

Tuesday, March 28 at 1:00PM EST / 10:00AM PST / 5:00PM GMT
Wednesday, March 29 at 9:00AM EST / 6:00AM PST / 1:00PM GMT

Every day new mobile applications are launched and made available. Often these new apps contain chat functions or other storage that can be crucial evidence in a case. However, parsing and carving for the data from these apps isn’t always immediately available from commercial forensic tools. Join Jessica Hyde, Director of Forensics at Magnet Forensics to explore new methods for discovering and parsing data from these unsupported applications. Learn how to test, find, parse, and script to obtain forensic evidence in new applications using a physical forensic image.

Presenter: Jessica Hyde, Director of Forensics, Magnet Forensics

Register here Continue reading Webinar: Methods For Parsing New Applications→

The new version of Passware Kit Forensic recovers passwords for iOS 10.2 iTunes backups, WPA/WPA2 WiFi connections. Instantly extracts passwords stored in iOS Keychain. Acquires images (including deleted ones) from iCloud Photo Library. Improves perfor… Continue reading Passware Kit 2017 v2: Supports iOS 10.2, iOS Keychain And iCloud Photo Library→

The new version of Passware Kit Forensic recovers passwords for iOS 10.2 iTunes backups, WPA/WPA2 WiFi connections. Instantly extracts passwords stored in iOS Keychain. Acquires images (including deleted ones) from iCloud Photo Library. Improves perfor… Continue reading Passware Kit 2017 v2: Supports iOS 10.2, iOS Keychain And iCloud Photo Library→

James Habben at 4n6ir explores the SCCM database in two posts, and Mark Mckinnon wrote an Autopsy Plugin to extract the relevant data.

Didier Stevens shows how to extract password history from the ntds.dit file.

Roberto Rodriguez shows how to build a… Continue reading Phill Moore’s Round-Up Of This Month In Forensics→

James Habben at 4n6ir explores the SCCM database in two posts, and Mark Mckinnon wrote an Autopsy Plugin to extract the relevant data.

Didier Stevens shows how to extract password history from the ntds.dit file.

Roberto Rodriguez shows how to build a… Continue reading Phill Moore’s Round-Up Of This Month In Forensics→

Belkasoft rolls out a major usability and performance update to Belkasoft Evidence Center 2017. The new release features brand new layout to simplify common tasks and speed up the routine, and comes with a 64-bit edition that significantly boosts perfo… Continue reading Belkasoft Evidence Center 8.3 Is Out with New UX and 64-bit Edition→

Belkasoft rolls out a major usability and performance update to Belkasoft Evidence Center 2017. The new release features brand new layout to simplify common tasks and speed up the routine, and comes with a 64-bit edition that significantly boosts perfo… Continue reading Belkasoft Evidence Center 8.3 Is Out with New UX and 64-bit Edition→

Welcome to this month’s round-up of recent posts to the Forensic Focus forums.

Do you have any recommendations for image enhancement? Add your suggestions on the forum.

Forum members discuss deleted files and allocated space in EnCase.

Which job category do you put down on your car insurance forms?

Forum members help a student with questions about recovering data from a virtual machine.

Can you recommend a hex viewer that works on Mac?

Forum members discuss decompressing hyberfil.sys.

What might make the last printed date appear to be before the metadata creation date of a Word document? Chime in on the forum.

Forum members discuss how to work out which machines a specific USB device has been connected to.

Forum members give advice about how to see if an external drive with Bitlocker has been mounted on a machine.

Is it possible to truly delete a file, and if so, how? Add your thoughts on the forum. Continue reading Forensic Focus Forum Round-Up→

Welcome to this month’s round-up of recent posts to the Forensic Focus forums.

Do you have any recommendations for image enhancement? Add your suggestions on the forum.

Forum members discuss deleted files and allocated space in EnCase.

Which job category do you put down on your car insurance forms?

Forum members help a student with questions about recovering data from a virtual machine.

Can you recommend a hex viewer that works on Mac?

Forum members discuss decompressing hyberfil.sys.

What might make the last printed date appear to be before the metadata creation date of a Word document? Chime in on the forum.

Forum members discuss how to work out which machines a specific USB device has been connected to.

Forum members give advice about how to see if an external drive with Bitlocker has been mounted on a machine.

Is it possible to truly delete a file, and if so, how? Add your thoughts on the forum. Continue reading Forensic Focus Forum Round-Up→

Devon, tell us a bit about yourself. What’s your background, and what’s your current role?

My name is Devon Ackerman, and I am currently a Senior Director in Kroll’s Cyber Security and Investigations practice. In this role, I have leadership over an Incident Response team as well as client engagement responsibilities and hands-on investigations.

Prior to Kroll, I served as a Supervisory Special Agent and Senior Digital Forensic Examiner for the FBI. I began my career with the FBI back in 2006 and in 2008 entered the Academy to complete training as an FBI Special Agent. After graduation from the FBI Academy, I was assigned to North Carolina, or more specifically, the “Charlotte Division” of the FBI. I was initially assigned national security investigations and related matters that shared a cyber nexus, later gaining experience in cyber and DFIR matters across the board, to include traditional criminal matters.

Read More Continue reading Interview With Devon Ackerman, Senior Director, Kroll→