letters

Building wordlists from Forensic Images

Encryption has become widespread and it's common to encounter at least a few encrypted files during an investigation. Bruteforcing a password is always an option, however, depending on the type of encryption that has been…

forensic software

TESTED: Forensic imaging tools

There are a few good imaging tools out here. When creating a forensic image you always try to pick the best tool for the job. In this post, I will compare six forensic imagers. This is…

wipe files

File deletion vs wiping (HDD vs SSD)

As you might know, there is a difference between deleting a file and wiping a file. For the user they seem to have the same outcome, the requested file has been removed. However, when you…

who is behind the camera

TESTED: Camera Ballistics 2

Last week Brett Shaver's had a good post on his blog about placing the suspect behind the camera (Link). Phill Moore named this post in his excellent weekly roundup This week in 4N6 and also…

live online training

AccessData Live Online Training

When working in forensics you will have to keep yourself informed of the latest developments in the field, that's one of the reasons I started creating this blog. Recently I have been attending several Live…