±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36449
New Yesterday: 1 Visitors: 189

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Search found 502 matches

Re: last access of USB

Post Posted: Jan 13, 20 16:53

First make a physical image (E01) of the USB drive using a hardware or software writeblocker.

Then open the resulting forensic image using your forensic tool of choice.

Look for $S files which a ...
UnallocatedClusters
Topic: last access of USB
Replies: 3
Views: 807
 

Re: last access of USB

Post Posted: Jan 13, 20 16:50

First make a physical image (E01) of the USB drive using a hardware or software writeblocker.

Then open the resulting forensic image using your forensic tool of choice.

Look for $S files which a ...
UnallocatedClusters
Topic: last access of USB
Replies: 3
Views: 807
 

Re: AXIOM MAGNET OCR

Post Posted: Dec 25, 19 23:04

OSForensics has the capability to OCR files.
UnallocatedClusters
Topic: AXIOM MAGNET OCR
Replies: 3
Views: 1996
 

Re: Evidence of youtube and other socials

Post Posted: Dec 25, 19 23:01

Use OSForensics’ Recent Activity button pointed at the physical forensic image.

After the Recent Activity function has created a timeline of machine and user activity, only check the boxes for in ...
UnallocatedClusters
Topic: Evidence of youtube and other socials
Replies: 3
Views: 2382
 

Re: Android imaging

Post Posted: Dec 25, 19 22:48

Please refer to page 66 of the DEFT Linux manual: https://paper.bobylive.com/System/EN-deft7.pdf

Imaging a rooted Android phone can be accomplished using the Android Debugging Bridge (ADB) by basi ...
UnallocatedClusters
Topic: Android imaging
Replies: 4
Views: 1948
 

Re: iOS meaning of "networkKnownBSSList Key"?

Post Posted: Dec 21, 19 01:06

Would take some effort, but could you factory reset a test phone and then image it, then connect to specific wireless access points, etc, record network name and time, then reimage the iPhone for anal ...
UnallocatedClusters
Topic: iOS meaning of "networkKnownBSSList Key"?
Replies: 3
Views: 1498
 

Re: Encase verification errors E01 image, Imaged using Guyma

Post Posted: Dec 15, 19 20:03

1. Verify the image files using Guymager or another tool. It has been my experience that different tools can generate different MD5 hash values for the same exact evidence source; I have no explan ...
UnallocatedClusters
Topic: Encase verification errors E01 image, Imaged using Guymager
Replies: 4
Views: 1358
 
Page 1 of 72
Page 1, 2, 3 ... 70, 71, 72  Next