Collaborate Disseminate
Welcome to this month’s round-up of recent posts to the Forensic Focus forums.
Forum members advise on producing E01 images in reverse sector order.
How would you convert an AD1 image to a dd?
Can you help roncfluey to image a MacBook Pro with X-Wa… Continue reading Forensic Focus Forum Round-Up
If you’re looking to dive deep into iOS examinations and the use of the GrayKey device and expand your knowledge of advanced forensics, then be the first to reserve your spot for the latest course from Magnet Forensics & Grayshift: MAGaK (Magnet AX… Continue reading Sign Up For MAGaK (Magnet AXIOM And GrayKey) Advanced iOS Examinations (AX301)
Did you know that Passware Kit can create a snapshot of a password recovery process at any time and resume it on a different computer?
Running a password recovery attack, especially for multiple files or drives, might be a long process that requires a… Continue reading How To Transfer A Password Recovery Process To A Different Computer
Did you know that Passware Kit can create a snapshot of a password recovery process at any time and resume it on a different computer?
Running a password recovery attack, especially for multiple files or drives, might be a long process that requires a… Continue reading How To Transfer A Password Recovery Process To A Different Computer Using Passwa
Beginning with version 19, Griffeye Analyze DI Pro and Core will start using the new Griffeye Intelligence Database, or GID, to replace the legacy intelligence manager.
In this video, we’re going to discuss the changes that the GID brings to the Analy… Continue reading How To Use The Griffeye Intelligence Database
by Oleg Skulkin
Windows Prefetch files were introduced in Windows XP, and since that time they have helped digital forensics analysts and incident responders to find evidence of execution.
These files are stored under %SystemRoot%\Prefetch, and are … Continue reading Hunting For Attackers’ Tactics And Techniques With Prefetch Files
Decrypting BitLocker volumes or images is challenging due to the various encryption options offered by BitLocker that require different information for decryption.
This article explains BitLocker protectors and talks about the best ways to get the dat… Continue reading How To Decrypt BitLocker Volumes With Passware
Oleg Afonin talks about the forensic analysis of Synology NAS devices.
Alexis Brignoni shares a realm database storage primer for digital forensic examiners.
Amped show how to resize images with Amped Replay.
Passware announce a new partnership with… Continue reading What’s Happening In Forensics – Nov 20, 2019
Hey everyone, Trey Amick from Magnet Forensics here. Today we’re talking about Mac USB investigations, and what happens when we’ve been alerted that a USB has been inserted into an end point.
Different organisations handle USB policies differently. So… Continue reading How To Use Magnet AXIOM In Mac USB Investigations
by Christa Miller, Forensic Focus
Emoji are everywhere — including in your evidence. Used across private-messaging apps and email, social media, and even in passwords and account names, emoji are pictographic representations of objects, moods, and wor… Continue reading Can Your Investigation Interpret Emoji?