±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35750
New Yesterday: 4 Visitors: 125

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Forensics Experts challenges

Computer forensics training and education issues. If you are looking for topic suggestions for your project, thesis or dissertation please post here rather than the general discussion forum.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

mhibert
Member
 

Forensics Experts challenges

Post Posted: Nov 19, 17 19:09

Hello, guys! I would like to ask the following question: What are the problems and challenges forensics experts face with NTFS files system.

Thank you!  
 
  

MasterOfTheShim
Newbie
 

Re: Forensics Experts challenges

Post Posted: Feb 07, 18 00:43

Problems? I think a lot of problems are misunderstanding of MACB times but this is for all filesystems types. Especially when trying to forensically investigate files being transferred to or from a machine via usb.
If you want to be a true forensicator you need to know MACB times like the back of your hand. Timeline analysis is useless if you don't understand MACB.

Also I would advise Mastering The Shim! Smile  
 
  

Randy_Randerson
Member
 

Re: Forensics Experts challenges

Post Posted: Feb 07, 18 03:01

- mhibert
Hello, guys! I would like to ask the following question: What are the problems and challenges forensics experts face with NTFS files system.

Thank you!


Oh man where to start, but I would probably go with understanding how the Journal File actually works and understanding what is taking place with the file as it is being recorded. I've seen people just flat out guess what they think its doing.  
 

Page 1 of 1