How to Mount Mac APFS Images in Windows
In the first post of the new year Mari Degrazia is writing about mounting APFS images in Windows. The thing is, Paragon…
Correlate Cases and Get Intelligence
Starting with Autopsy 4.5.0, you can now determine when a file or phone number (or other artifact) was seen in a previous ca…
Introduction to Plaso Heimdall
As a continuation of the “Introduction to Windows Forensics” series by Richard Davis, this video introduces Plas…
The third edition of Practical Mobile Forensics has been announced
Packt Publishing has announced the third edition of Practical Mobile Forensics by Rohit Tamma, Oleg Skulkin,…
Forensic State Acquisition from Internet of Things (FSAIoT): A general framework and practical approach for IoT forensics through IoT device state acquisition
IoT device forensics is a difficult problem given that manufactured IoT devices are not standardized, many store little to n…
Getting Started with the SIFT Workstation Webcast with Rob Lee
An international team of forensics experts helped create the SANS Investigative Forensic Toolkit (SIFT) Workstation and made…
MemTri: A Memory Forensics Triage Tool Using Bayesian Network and Volatility
This work explores the development of MemTri. A memory forensics triage tool that can assess the likelihood of criminal acti…
iOS 11 Isn’ t All Fun and Games
SANS instructors Heather Mahalik and Domenica “Lee” Crognale discuss iOS 11 messages and the differences they ha…
How to Remove the Backup Password in iOS 11
Cindy Murphy from Gillware has published a very interesting post on how to reset the backup password in iOS 11. Here is an&n…
LNK Files and Jump Lists
Richard Davis continues his “Introduction to Windows Forensics” series. This video introduces the ubiquitou…
