Author Archives: Forensic Focus

Arsenal Consulting President Mark Spencer’s article in Digital Forensics Magazine (Issue 27, published May 1) describes how his firm uncovered evidence tampering which led to the wrongful imprisonment of Turkish investigative reporter Baris Pehlivan and his colleagues at Odatv. Odatv runs one of the most popular news websites in Turkey and has a reputation for being critical of the current government, controlled since 2002 by the Justice and Development Party. Mr. Pehlivan and his colleagues are currently on trial and accused of supporting the Ergenekon terrorist organization. Ergenekon is an alleged secularist “deep state” in Turkey with ties to the military, academia, NGOs, and the media whose supporters are charged with plotting to overthrow the government. Continue reading Arsenal Reveals Sophisticated Evidence Tampering Involving Turkish Journalists→

In the first part of this article, we reviewed different kinds of the most commonly used modern SSDs (M.2, PCI-E, NVMe devices) and talked about acquisition of these devices. In this part of the article, we will talk about external SSDs and eMMC and wi… Continue reading SSD and eMMC Forensics 2016 – Part 2→

We’re pleased to announce the latest version of BlackBag’s mobile device triage tool, Mobilyze 2016 R1! This newest release features Android 6.0 Marshmallow support and an updated drivers pack. In addition, BlackBag regularly maintains an online resources page for troubleshooting Android devices and locating special brand and device specific ADB drivers.

Mobilyze, for those not already familiar with it, was first launched in 2014 and is designed for ease of use, with no need for extensive specialized training. It’s a versatile mobile forensics tool for logically acquiring Android and iPhone/iPad devices and quickly triaging the data. Continue reading BlackBag’s Mobilyze 2016 R1 Now Available→

Among the challenges facing digital forensic investigators today, the instantaneous nature of online communication is arguably one of the most persistent. Trying to investigate whether a crime has occurred, and if so to bring its perpetrators to justice in a space that is constantly changing, is no simple task. With the Apple App Store alone reportedly growing by up to 1,000 applications per day, keeping up to date with the necessary methods of communication becomes increasingly difficult.

Just in the past twelve months, there have been instances of paedophiles using within-game messaging services to groom youngsters, as well as the wave of recent discussion regarding Isis’ purported use of encrypted messaging app Telegram to communicate.

For those whose specialism is investigating crimes against children, there is another element of online life that makes the job even more challenging: live streaming.

Read More Continue reading The Investigative Challenges Of Live Streamed Child Abuse→

A man has been held in prison for seven months after failing to decrypt two hard drives that investigators suspect contain indecent images of children.

A court order says the man will remain jailed “until such time that he fully complies” with an orde… Continue reading Man Jailed For Failing To Decrypt Hard Drives→

The first set of new MSAB Ecosystem products for mobile forensics have just been launched.

The new MSAB Ecosystem is an evolution of the current products to adapt to the latest developments in digital forensics focused around the needs of law enforcem… Continue reading MSAB Launches New Ecosystem Products→

Sifting through data is a very time consuming process- the average US smartphone user takes up 10.8GB of storage capacity on their device*, and taking into account different data recovery options in UFED Physical Analyzer, this process may take up to several hours to complete. UFED 5.0 came out with major time-savers that drastically decrease your investigation time, and lets you focus on the data that is most crucial to your investigation. Version 5.0 brings five crucial industry-first features, and support for 19,203 device profiles and 1,528 app versions.

Release Highlights:
• Unify multiple extractions
• Original file source validation
• Common Image Filter
• Extract Data from Blocked Apps
• Temporary root (ADB) solution for Selected Android Devices
• Support for newly released Devices Continue reading UFED 5.0 Drastically Decreases Your Time to Evidence→

A recording of the webinar “Data Visualisation: The Step Forward For Digital Forensics” is now online and available to view here.

Join the forum discussion here.
View the webinar on YouTube here.
Read a full transcript of the webinar here. Continue reading Webinar: Data Visualisation: The Step Forward For Digital Forensics→

This article is a recap of some of the main highlights from DFRWS EU which took place at the University of Lausanne, Switzerland, from the 29th-31st of March 2016.

The conference began with a discussion of virtual currencies by André Fischer, Jakob Hasse and Thomas Gloe from dence GmhH. The speakers covered public perception of virtual currencies, particularly the idea of cryptocurrencies providing a theoretically “free” and international form of currency that is virtually untraceable. They focused primarily on Bitcoin, giving an overview of its usage to date and a demonstration of how the setup works.

Following on from this was a discussion of evidence exchange between courts in Europe. Mattia Epifani and his colleagues presented the work they have done so far on the EVIDENCE project, which helps the European Commission with issues surrounding data exchange across borders.

Read More Continue reading DFRWS EU – Recap→

by Yuri Gubanov, Oleg Afonin

This publication continues the series started with an article on SSD forensics we published in 2012. We investigated the issues of SSD self-corrosion, demystified trimming, garbage collection and data remapping. Two years … Continue reading SSD and eMMC Forensics 2016→