Using hashcat to decrypt iOS notes for Cellebrite’s Physical Analyzer
This video will show you how to decrypt encrypted notes (password protected) on iOS devices and enter the password into Cell…
winmem_decompress: Extract Сompressed Memory Pages from Page-Aligned Data
Maxim Suhanov presented winmem_decompress – a program that tries to extract compressed memory pages from page-aligned …
Hands-On Network Forensics: Investigate network attacks and find evidences using common network forensic tools
A new book by Arthur Salmon has been announced by Packt Publishing. The book is titled “Hands-On Network Forensics: In…
libfsapfs: Library and Tools to Access the Apple File System (APFS)
libfsapfs is a library and tools by Joachim Metz to access the Apple File System (APFS). Source code is available at GitHub.…
Evidence Generation X
Test evidence lies at the heart of our field. We need to be able to test our tools to make sure that they parse data correct…
SANS Hunt Evil Poster Updated
SANS has updated their Hunt Evil poster. It includes information about typical Windows processes, evidence of remote access …
Forensic analysis of multiple device BTRFS configurations using The Sleuth Kit
The analysis of file systems is a fundamental step in every forensic investigation. Long-known file systems such as FAT, NTF…
How to Put a Qualcomm Phone into EDL Mode
In this post Magnet Forensics talks about Emergency Download (EDL). This is a Qualcomm feature that can be used for data rec…
Join our Telegram DFIR group!
Guys, we have created a Telegram group, where we will do our best to answer all your questions. We will be very happy if you…
Eric Zimmerman Updated Most of His Tools
Eric Zimmerman has updated most of his tools: WxTCmd, Hasher, Timeline Explorer, ShellBags Explorer, AppCompatCacheParser, A…
