Author Archives: Forensic Focus

by Robert Craig and Michael Lambert

Samsung devices are a large portion of the Android OS market. Samsung has its own Internet Browser, “sbrowser”, installed onto their devices. All web browsers leave artifacts from user activity. The “sbrowser” cache files were similar to other browsers. An embedded source URL gave insight where the cached image came from. Looking at Internet History, cookies, and the cache file itself, an investigator can gain insight where the cached image came from and the likely web page it came from.

Read More Continue reading Samsung sBrowser – Android Forensics: A Look Into The Cache Files→

by Oleg Davydov, CTO, Oxygen Forensics

Modern smartphones are much more than just a device for voice calls. Now they contain a lot of personal data – contact list, communication history, photos, videos, Geo tags etc. Most smartphones can also work as a modem.

Almost every modem is Hayes-compatible which means it supports commands of the AT language developed in 1977 by Hayes. Every model supports some basic set of commands which is defined by the manufacturer. Sometimes this set can be extended and can contain very interesting commands.

Let us study behavior of an LG smartphone. When you connect it to the computer by USB you get access to the modem automatically (pic. 1). What is peculiar for LG is that the modem is available even if the phone’s screen is locked.

Read More Continue reading Unlocking The Screen Of An LG Android Smartphone With AT Modem Commands→

Keywords are an essential part of many forensic examinations. While running keyword lists shouldn’t be the extent of an investigation, the right keyword list can help examiners quickly get to the relevant evidence for their case.

Magnet AXIOM allows examiners to run several different keyword searches either before or after processing your case. Let’s take a look at some of the options available. Continue reading Using Keywords With Magnet AXIOM→

Keywords are an essential part of many forensic examinations. While running keyword lists shouldn’t be the extent of an investigation, the right keyword list can help examiners quickly get to the relevant evidence for their case.

Magnet AXIOM allows examiners to run several different keyword searches either before or after processing your case. Let’s take a look at some of the options available. Continue reading Using Keywords With Magnet AXIOM→

Reviewed by Scar de Courcier, Forensic Focus

From the 6th-8th of December 2016, AccessData ran a Windows course in a training centre overlooking Trafalgar Square in London, UK. The aim of the course was to familiarise forensic investigators with the Windows operating system and give an in-depth understanding of its potential for analysis in digital forensic investigations.

The course was open to all levels, from those who had never conducted an investigation to those who were more familiar with digital forensic techniques. Some level of familiarity with AccessData’s products was assumed, although everything was explained in great detail throughout the course, making it accessible for those who were just starting out as well.

Read More Continue reading Review Of Windows OS Training From AccessData→

Curated by Phill Moore

Russ McRee updated the Incident Response Hierarchy of Needs to a DFIR Hierarchy of Needs & Critical Security Controls.

Oxygen Forensic Detective released version 9.1.1.

Joshua James demonstrated how to compile The Sleuth K… Continue reading This Month In Forensics→

Welcome to this month’s round-up of recent posts to the Forensic Focus forums.

What remnants does Word leave on the local disk?

Have you done any research on how to reconstruct history from Google Chrome? Chime in on the forum.

Forum members discuss the difference between invasive and pervasive encryption.

Can you help this student with a project about smartwatch forensics?

Join the heated discussion about backdoors in encrypted chat apps.

Forum members discuss how to locate an iPhone that is in a river. Continue reading Forensic Focus Forum Round-Up→

Reviewed by Scar de Courcier, Forensic Focus

From the 1st to the 3rd of November 2016, AccessData ran a live online training course to help forensic investigators understand the specific challenges presented by Windows 10, and how they can be overcome.

The course was aimed at people who already had a level of familiarity with both forensic investigation generally and with AccessData’s products, and took participants through all aspects of investigating a Windows 10 system.

Read More Continue reading Review Of Windows 10 Live Online Training From AccessData→

Including Parsing iCloud Backups, Sorting in Multi-Artifact View, New Exporting Options, Musical.ly Artifact Support, and More.

Customer feedback is essential to maintain the quality of our products. We’ve been able to incorporate customer input on the features they are looking for in our latest release, Magnet AXIOM 1.0.9, which is available for download now..

Here are a few highlights. Continue reading Magnet AXIOM 1.0.9 Brings Improved Reporting and iCloud Backups→

A recording of the webinar “Complex Digital Data Calls for a New Breed of Data Hunters” is now online and available to view here.

Join the forum discussion here.
View the webinar on YouTube here.
Read a full transcript of the webinar here. Continue reading Webinar: Complex Digital Data Calls for a New Breed of Data Hunters→