±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 34825
New Yesterday: 11 Visitors: 164

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Forensics Experts challenges

Computer forensics training and education issues. If you are looking for topic suggestions for your project, thesis or dissertation please post here rather than the general discussion forum.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Forensics Experts challenges

Post Posted: Sun Nov 19, 2017 12:09 pm

Hello, guys! I would like to ask the following question: What are the problems and challenges forensics experts face with NTFS files system.

Thank you!  

mhibert
Member
 
 
  

Re: Forensics Experts challenges

Post Posted: Tue Feb 06, 2018 5:43 pm

Problems? I think a lot of problems are misunderstanding of MACB times but this is for all filesystems types. Especially when trying to forensically investigate files being transferred to or from a machine via usb.
If you want to be a true forensicator you need to know MACB times like the back of your hand. Timeline analysis is useless if you don't understand MACB.

Also I would advise Mastering The Shim! Smile  

MasterOfTheShim
Newbie
 
 
  

Re: Forensics Experts challenges

Post Posted: Tue Feb 06, 2018 8:01 pm

- mhibert
Hello, guys! I would like to ask the following question: What are the problems and challenges forensics experts face with NTFS files system.

Thank you!


Oh man where to start, but I would probably go with understanding how the Journal File actually works and understanding what is taking place with the file as it is being recorded. I've seen people just flat out guess what they think its doing.  

Randy_Randerson
Member
 
 

Page 1 of 1