Advertisement
Tips
Subscribe to Tips

The Lead

One should not expect to find all user information sitting in the default folder or default location for a given type of file (e.g. Application Data or similar folder). Searching the entire hard disk is required in order to locate all unencrypted log and

Retrieving Obscured Files

September 19, 2014 10:00 am | Articles | Comments

One should not expect to find all user information sitting in the default folder or default location for a given type of file (e.g. Application Data or similar folder). Searching the entire hard disk is required in order to locate all unencrypted log and history files. 

First Responder Electronic Crime Scene Investigation

September 12, 2014 8:50 am | by NIJ | Articles | Comments

First responders must use caution when they seize electronic devices. Improperly accessing...

Finding Good Cookies

September 5, 2014 12:14 pm | Articles | Comments

Over the years, cookies have been overlooked in forensic examinations. For the most part,...

Data Search Character Classes

August 21, 2014 4:01 pm | Articles | Comments

One important basic concept to grasp is working with character classes, or sets. A character...

View Sample

SUBSCRIBE TO FREE DFI News EMAIL NEWSLETTER

Triaging a computer can be a methodology to avoid many issues inherent with “pulling the plug.” For instance, capturing the system volatile information can very quickly provide investigators valuable information.

When Not to 'Pull the Plug'

August 15, 2014 8:52 am | Articles | Comments

Triaging a computer can be a methodology to avoid many issues inherent with “pulling the plug.” For instance, capturing the system volatile information can very quickly provide investigators valuable information.           

Digital forensic science is not a matter of recovering a file that proves   somebody’s guilt; it is about wading through hundreds of thousands, possibly   millions, of a wide variety of digital artifacts and making very pointed   critical judgments about

Find the Context

July 30, 2014 3:50 pm | Articles | Comments

Digital forensic science is not a matter of recovering a file that proves somebody’s guilt; it is about wading through hundreds of thousands, possibly millions, of a wide variety of digital artifacts and making very pointed critical judgments about which provide some sort of inculpatory or exculpatory evidence relevant to the case.

Realistically, Live RAM analysis has its limitations, lots of them. Many types of artifacts stored in the computer’s volatile memory are ephemeral.

Limitations of Volatile Memory Analysis

July 25, 2014 8:51 am | Articles | Comments

Realistically, Live RAM analysis has its limitations, lots of them. Many types of artifacts stored in the computer’s volatile memory are ephemeral. While information about running processes will not disappear until they are finished, remnants of recent chats, communications, and other user activities may be overwritten with other content any moment the operating system demands yet another memory block.

Advertisement

The Switch to Private Sector Digital Forensics

July 18, 2014 9:05 am | Articles | Comments

There is clearly a difference in the type of investigations and examinations being performed versus what are encountered in the public sector. The private sector examiner can be expected to provide evidence to private attorneys, corporations, private investigators, and corporate security departments.

Flasher Box or No Flasher Box?

July 11, 2014 9:27 am | Articles | Comments

Let’s be very clear before we go down the flasher box path, there is no replacement or substitute for the automated forensic tools produced by mobile forensic manufacturers. Unfortunately, with growing consumer demand for newer and more technologically advanced mobile phones, these automated and safe solutions do not meet some investigative requirements.

SSD drives employ a completely different way of storing information internally, which makes it much easier to destroy information and much more difficult to recover it.

SSD Evidence Issues

June 27, 2014 8:55 am | Articles | Comments

Solid-state drives represent a new storage technology. They operate much faster compared to traditional hard drives. SSD drives employ a completely different way of storing information internally, which makes it much easier to destroy information and much more difficult to recover it.

Network investigations can be far more difficult than a typical computer examination

Network Investigations

June 19, 2014 12:16 pm | by Gary C. Kessler and Matt Fasulo | Articles | Comments

Network investigations can be far more difficult than a typical computer examination, even for an experienced digital forensics examiner, because there are many more events to assemble in order to understand the case and the tools do not do as much work for the examiner as traditional computer forensics tools.

Tool Validation

June 13, 2014 8:25 am | Articles | Comments

The premise that an effective digital forensic examiner must be able to validate all of the tools that he or she uses is universally accepted in the digital forensic community. I have seen some less-educated members of the community champion a particularly insidious, and I will argue, invalid method of tool validation, often referred to as the two-tool validation method.

Advertisement

Do You Know Where Your Data Is?

June 6, 2014 8:12 am | by Gary Torgersen | Articles | Comments

The Bring Your Own Device (BYOD) phenomenon is affecting forensic data acquisition because it creates crossover between data that is controlled by an individual versus by a company. People are using their personal devices for work-related tasks because it can seem easier than trying to use typical work resources. 

Unsupported Smartphone Extractions

June 3, 2014 8:53 am | Articles | Comments

What happens when a smartphone is locked and unsupported by forensic tools? Flasher box, JTAG, or chip-off extraction methods become necessary. All three enable physical extraction — a logical examination cannot be performed on an unsupported locked device. However, even this capability can be limited.

Boot Loaders Produce Forensic Soundness

May 30, 2014 8:34 am | Articles | Comments

Boot loaders are currently considered the most forensically sound physical extraction method. While they do involve loading a piece of code onto the device, this happens before the forensic tool accesses any evidentiary data.       

Evidence: Get It While You Can

May 23, 2014 8:46 am | Articles | Comments

For the digital crimes of today, specialists need to examine a much more complex environment. Investigators need to image digital media of a multitude of types: magnetic, solid-state, or optical, for example.            

No Forensics for Old Apps

May 16, 2014 10:45 am | Articles | Comments

Apps, not just available for iPhone or Android but also through device vendors like Samsung, Nokia, and LG — as well as from mobile carriers like T-Mobile and retailers like Amazon — are a digital forensics challenge.         

Advertisement

Don't Get Burned by Prepaid Phones

May 9, 2014 9:38 am | Articles | Comments

Prepaid phones have been a problem for some time, and continue to be a problem for law enforcement in particular.                                       

Inspecting Metadata

April 25, 2014 8:40 am | by Daniel Cabezas and Bram Mooij | Articles | Comments

The term metadata is sometimes defined with the abstract expression: “data about data.” When any data is defined, described, or created, it can always be characterized in terms of similarities, structure, or related data.        

Binary Files Analysis

April 18, 2014 8:40 am | by Daniel Cabezas and Bram Mooij | Articles | Comments

There are multiple techniques for comparing the code of two binaries, where none or only partial source code is present. A trivial way is to use a binary diffing utility. This utility is used in a similar way as plaintext code comparison listing.

Ropin' in Facebook, Twitter, LinkedIn

April 11, 2014 8:54 am | by Gary Torgersen | Articles | Comments

Each social media platform is different, with unique code and variations. Each one runs on its own hardware and software platform, and some, such as Facebook, have even developed custom technology to run their sites. Because of that, each requires its own method of forensically collecting data. 

A Smartphone is Never Just a Smartphone

April 4, 2014 9:09 am | by Ronen Engler and Christa M. Miller | Articles | Comments

Vendors and operating systems can vary widely, particularly with Android, but also even within iOS and BlackBerry user groups. More than 40 iOS versions are commercially available, and are spread among six different iPhones, five iPads, and five iPod Touch devices.

Physical Memory Acquisition

March 28, 2014 8:15 am | by Dr. C Andras Moritz, Kristopher Carver, Jeff Gummeson | Articles | Comments

Once a password has been bypassed, an investigator has full access to the computer, allowing them to gather any evidence necessary, including the contents of the DRAM in the system. You can then use a PCI Express or ExpressCard device for memory acquisition.

Investigator Turns Eyewitness

March 21, 2014 8:21 am | by Benjamin Wright | Articles | Comments

In today’s world of social media, investigators are taking on a new role; they are becoming a form of eyewitness. As the eyewitness, an investigator observes evidence that might not be visible to any other available investigator. The investigator is wise to create a record of what he or she sees at any particular point in time, including print outs of screenshots.  

Challenges in Smartphone Forensics: Passwords and Encryption

March 10, 2014 6:20 am | by Ronen Engler and Christa M. Miller | Cellebrite USA, Inc. | Articles | Comments

Not only does data storage vary from device to device and OS to OS, but devices may also be passcode-protected and/or encrypted. iPhone passcodes fall into two categories: simple and complex. A mobile data extraction tool should be able to reveal a simple passcode automatically for most devices.

Education in Digital Forensics

March 7, 2014 8:36 am | by John J. Barbara | Articles | Comments

A question often asked is, “What education and training is necessary to work in digital forensics?” There is not one easy, simple answer to this question. First of all, an individual has to make a choice of career pathways, namely do they wish to work in the public sector or in the private sector. 

Plaintext Files Analysis

February 23, 2014 11:41 pm | Articles | Comments

Source code and text comparison is an established, well-known analysis technique. Using a program capable of simply listing file A in the left window and file B in the right window and highlighting the differences between each and every line, preferably in a different color, is frequently an easy way to detect copied text. Some of the more advanced analysis utilities can also compare, merge, and synchronize files and directories. 

The Need for a Faraday Bag

February 21, 2014 9:44 am | by Eamon P. Doherty | Articles | Comments

It is very important that the digital evidence be preserved from the time of seizure until it is presented as evidence in court. If evidence is suspected of being tampered with, it could be ruled as inadmissible in court. Therefore, it is important for CCEs to preserve digital evidence by using a Faraday bag and noting its usage on the chain of evidence form.

Smartphone Challenges: Prepaid Phones

February 7, 2014 10:10 am | Cellebrite USA, Inc. | Articles | Comments

Prepaid phones have been a problem for some time, and continue to be a problem for law enforcement in particular. That’s because the disabled data port on these devices cannot be enabled, and vendors don’t make the devices’ APIs available to commercial forensic extraction tools’ developers.  

X
You may login with either your assigned username or your e-mail address.
The password field is case sensitive.
Loading