Jonathon Poling has published a very useful post about forensicating RDP-related event logs. You will learn a lot about the following event IDs: 1149, 4624, 4625, 21, 22, 24, 25, 39, 40, 4778, 4779, 23, 4634, 4647 and 9009. You can find the post here.

Tom Sela has posted an updated version of his paper originally published in the March 2017 edition of eForensics Magazine. This article discusses two artifacts identified by the author as being significantly helpful when solving incidents: command prompt history and console output.

Sarah Edwards has published the second part of her “iOS Imaging on the Cheap” series. This time the post includes the jailbreaks for iOS 10.3.3 using Meridian and iOS 11 using LiberiOS. You can read the tutorial here.

Here is another post by Another Forensics Blog (Mari Degrazia) about mounting Apple File System (APFS). This time you will learn about how to mount an APFS image in Linux.

In the first post of the new year Mari Degrazia is writing about mounting APFS images in Windows. The thing is, Paragon has a free (preview) driver to mount APFS volumes in Windows! So with conjunction with our favourite Arsenal Image Mounter you can easily mount and browse APFS images with your Windows workstation.

Jessica Hyde (Magnet Forensics) and Brian Moran (BriMorLabs) have presented a document summarizing the URLs to query from Amazon to return some of the Amazon Echosystem data. You can find the results of their research here.

This post by TM4n6 covers the use of the Android Debug Bridge (ADB) command-line tool on Linux. It focuses on the extraction of forensically relevant data from mobile devices packaged with the Android Operating System developed by Google.

With the continuous development of data recovery and digital forensics technology, techniques for forensic data recovery from the logic layer of hard drives are constantly improving. Yet there remains a great challenge: how to recover fragmented files? Through a case study of fragmented files in XFS file system, forensic experts from SalvationDATA will explain in this issue how to recover fragmented files …

In this post Jessica Payne writes about how to use the built in Windows Event Forwarding components of Windows, some PowerShell scripts, and PowerBI desktop to create a fast, free, and effective console for diagnosing problems and finding Indicators of Attack in a network.

Mimikatz is a common tool used by APT in modern cyber attacks to harvest admin’s and user’s login credentials. It’s very important for any analyst dealing with investigations of such attack to clearly understand how it works and what traces he or she might find. Here is the unofficial guide to Mimikatz and command reference by Sean Metcalf.