Clik here to view.
Analyzing videos with multiple video streams in digital forensics
In this article, we will review a special case of video files: files with multiple video streams. What does this mean and why is it important in course of a digital forensic (and, perhaps, incident...
View ArticleClik here to view.
How to analyze different types of devices and find connections between them
Modern digital forensics and incident response cases may involve quite different types of devices. The variety of electronic gadgets increases every day, from traditional smartphones to yet uncommon...
View ArticleMalcom: Malware Communication Analyzer
Malcom is a tool designed to analyze a system’s network communication using graphical representations of network traffic, and cross-reference them with known malware sources. This comes handy when...
View ArticleClik here to view.
The Most Essential Image Data Retrieval for Digital Forensic Experts
This article is a general explanation why and how forensic experts and first responders could benefit from a tool that provides Image data retrieval. The product under review is a first-line tool for...
View ArticleRefined VirusShare Hash Sets
MantaRay Forensics team converted VirusShare.com 0-337 hash sets to RAW, EnCase and Autopsy format. The new set contains 31,908,993 MD5 notable hash values. The RAW hash set is compatible with AXIOM...
View ArticleExtract forensic timeline from memory dumps with AutoTimeliner
Andrea Fortuna created the AutoTimeliner, a tool that “automagically extract forensic timeline from volatile memory dumps.” It constructs the timeline based on the output of the following Volatility...
View ArticleRBCmd: Recycle Bin artifact parser
Eric Zimmerman has released a new tool. This time it’s Recycle Bin artifact parser called RBCmd. It supports both INFO2 and $I formats. You can download the tool here.
View ArticleCAINE 10.0 “Infinity” is out
A new version of CAINE (Computer Aided INvestigative Environment) has been released. Version 10.0 includes new OSINT, Autopsy 4.9, it’s APFS ready, has BTRFS foresic tool, NVME SSD drivers ready. Learn...
View ArticleLearning Android Forensics – Second Edition
Packt Publishing has annonced the second edition of Learning Android Forensics. The new book by Oleg Skulkin, Donnie Tindall, and Rohit Tamma is expected to be published in January 2019.
View ArticleBackstage Parser
Arsenal’s Brian Gerdon presented Backstage Parser – a python tool that can be used to parse the contents of Microsoft Office files found in the...
View ArticleAcquire Volatile Memory from FreeBSD with FreeBmAM
Free-B-sd m-emory A-cquisition M-odule Tool/Kernel Module allows acquisition of volatile memory from FreeBSD. You can learn more about the tool at GitHub.
View ArticleDEFT X Virtual Appliance is Available for Downloading
The latest version of the system dedicated to forensic analysis and incident management, DEFT X, is released and available for downloading here.
View ArticleGiftStick: 1-Click Push Forensics Evidence to the Cloud
GiftStick allows an inexperimented user to easily (one click) upload forensics evidence (such as some information about the system, a full disk image as well as the system’s firmware, if supported)...
View ArticleAutopsy 4.9.0 and the Sleuth Kit 4.6.3 released
New versions of our open source DFIR tools have been released: Autopsy New Features: Removed data from table that are time intensive and can be found in content viewers (such as hash set hits) Added...
View ArticleAmcache_Scan Autopsy Plugin
This Autopsy plugin by Rebecca Anderson won Autopsy Plugin Contest this year at Open Source Digital Forensics Conference (OSDFCon). It searches Virus Total for SHA1 hashes of executables from amcache....
View ArticleDFRWS IoT Forensic Challenge (2018 – 2019)
DFRWS presented a new challenge – this year they continue to motivate forensicators to research and develop in the field of IoT forensics. Here is this year’s scenario: On 17 May 2018 at 10:40, the...
View ArticleMagnet AXIOM Incident Response Examinations (AX310)
Magnet Forensics announced a new expert-level four-day training course. It is designed to give you the knowledge and skills needed to track incidents where unauthorized computer access and file usage...
View ArticleUsing hashcat to decrypt iOS notes for Cellebrite’s Physical Analyzer
This video will show you how to decrypt encrypted notes (password protected) on iOS devices and enter the password into Cellebrite Physical Analyzer for decryption and processing. Tested on iOS 11.4...
View Articlewinmem_decompress: Extract Сompressed Memory Pages from Page-Aligned Data
Maxim Suhanov presented winmem_decompress – a program that tries to extract compressed memory pages from page-aligned data. Such compressed memory pages can be found in virtual memory of Windows 8.1...
View ArticleHands-On Network Forensics: Investigate network attacks and find evidences...
A new book by Arthur Salmon has been announced by Packt Publishing. The book is titled “Hands-On Network Forensics: Investigate network attacks and find evidences using common network forensic tools”,...
View Article
![[imports/adg/photos/213899875_Police-Car-Lights-2.jpg]](http://wehco.media.clients.ellingtoncms.com/imports/adg/photos/213899875_Police-Car-Lights-2_t600.jpg?4326734cdb8e39baa3579048ef63ad7b451e7676)
