Collaborate Disseminate
I’m working on a case involving an Apple silicon Mac and it has me stumped. It has a user password, which I don’t know, is running the latest OS and has Filevault enabled.
Without the user password, my forensic tools can’t do anything as t… Continue reading Is guessing the password forensically sound?
I have a .dmg file on my MacBook. I have forgotten the password of the .dmg file and now I’m not able to access the files in it.
I tried using John the Ripper. However, whenever I run john –format=dmg-opencl (*insert filename here), I alw… Continue reading How to create a hash file of a .dmg file for use in JTR?
I have a disk image divided in 4 files, image.E01, image.E02, image.E03 and image.E04. I created a case in autopsy and I’m trying to recover the Product ID and the Product Key.
The product ID I already found it in the Operating System Info… Continue reading How can I get the Product Key with Autopsy or FTK viewer? [closed]
I was presented with a task. I have .vmdk disk available and I have to check its contents – forensically check the data on it without modifiying it and then check whether some data on this disk has been deleted. I also have to check whethe… Continue reading How to forensically check if some data on .vmdk disk has been hidden/deleted?
I am experiencing some issues when using mmls command after having created an image with dcfldd/guymager in some particular situations. Usually this approach seems to be working fine to create physical images of devices, but with some USBs… Continue reading MMLS (Sleuth Kit) not working in some situations
I want to image a drive with FTK Imager’s feature ‘Create Disk Image’ but the external hard drive has some issues. The external HDD does not appear in Windows File Explorer but it appears in Disk Management as Online and Unallocated. The d… Continue reading Creating disk image with FTK Imager: Failure: The specified network resource or device is no longer available. (55)
I want to make a VMWare (VMWare is first preference but any alternative can be used as well) virtual machine completely digital forensics-proof. I am protecting against someone getting physical access to my computer when I am not there (I … Continue reading How to make a virtual machine forensics-proof – completely or to the maximum possible level?
It just doesn’t make any sense to me. Any owner of a original PS game disk has full access to it, so it shouldn’t be a problem to create an identical disk, isn’t it? And PS won’t be able to tell apart identical disks, will it?
Continue reading How is PlayStation (4/5) protected from disk-copying piracy?
I was wondering if it’s reasonable and forensically correct to use Clonezilla for the image of an attacked machine.
Since some of the commercial products are very expensive I’m turning to open source solutions.
Provided that:
is an offlin… Continue reading Clonezilla for forensic disk image
I am looking into M.2 docking stations such as the Maiwo K3016S as shown below.
Is it possible to use such docking stations optionally in combination with a USB- or software write-blocker, in order to make forensic images of (Bitlocker en… Continue reading Can M.2 docking stations be used to make forensic images of (Bitlocker encrypted) M.2 disks?