Forensic Analysis of SQLite Databases
SQLite is a popular database format that is used in programs of both mobiles devices and personal computers. Most of the pop…
HyperLink: Virtual Machine Introspection and Memory Forensic Analysis without Kernel Source Code
Virtual Machine Introspection (VMI) is an approach to inspecting and analyzing the software running inside a virtual machine…
Leveraging Windows Event Logs in Examinations
Black Bag Training Team continues Windows Forensic Essentials Blog Series with a post about forensic examination of Windows …
Mac Dumpster Diving – Identifying Deleted File References in the Trash (.DS_Store) Files – Part 1
If you want to improve your Mac forensics skills, here is a very interesting and useful article by Jonathon Poling. It’…
Email Forensic Tools: A Roadmap to Email Header Analysis Through a Cybercrime Use Case
Email is one of the primary sources of numerous criminal activities, on the Internet, of which some threaten human lives. Em…
The Sleuth Kit 4.4.0 and Autopsy 4.3.0 are released
New versions of your favorite open source digital forensics tools – the Sleuth Kit and Autopsy, – have been rele…
Copy locked files from a live system with RawCopy
RawCopy is a console application that copy files off NTFS volumes by using low level disk reading method. Here are some exam…
Memory Forensics of Linux and Mac Systems
Here is Andrew Case’ presentation on memory forensics of Linux and Mac systems from Enfuse 2016. …
Advanced Mobile Device Forensics with Heather Mahalik
In her 14+ years of experience in digital forensics, Heather Mahalik has worked on many high-profile cases, investigating ev…
Comprehensive Forensic Chat Examination with Belkasoft
Belkasoft has published a fresh article at their website – “Comprehensive Forensic Chat Examination with Belkaso…
