General Discussion: Decrypting I Tunes backup
This is a coming or already feature or Cellebrite PA as well I think
View ArticleGeneral Discussion: Examining a HP Tablet
I'm curious to know if you ever found a way to examine this device? I have one to examine in a C/P case and only have the UFED Touch Ultimate at my disposal. Unfortunately, the Thrive isn't supported...
View ArticleGeneral Discussion: RAID Reconstruction
RAID recovery can be something of a Black Art. Runtime has been my go to company for tools since Captain Nemo (for Novell). However I have run into proprietary cards and NAS boxes that have vexed quite...
View ArticleForensic Software: Email deduplication
Deduplication of e-mail is a touchy subject. What are you going to deduplicate on? In my experience deduplication across multiple mailboxes using to, from, subject, date&time, and sometimes unique...
View ArticleForensic Hardware: WiebeTech Forensic Combodock V5 - good/bad?
Greetings - Has anyone had a good/bad experience using the WiebeTech Forensic Combodock V5? I am about to buy one, but I thought I would ask the community here first. To me - the Combodock V5 seems to...
View ArticleMobile Phone Forensics: Locked my iPhone 4s!
assuming you havent recently synced it and backed it up to your computer, you could probably just plug it in and do it that way if i recall you can change the passcode on an iphone and it will still be...
View ArticleForensic Software: mft2csv - NTFS systemfile extracter and $MFT decoder
Quote:: The tool (correctly) asks for a $MFT, I was perfectly aware that feeding it "something else" I would have probably got an error (though I prefer "aggressive" interfaces, like "You dumb@§§, I...
View ArticleGeneral Discussion: Hexworkshop Examniation
bigmantech Your question makes little or no sense. Few file types provide information about the size of itself, so you are probably not talking about the data within the file. The fact that you are...
View ArticleMobile Phone Forensics: Mobile forensics TIPS [Knowledge Sharing]
Whats the name of the python script that can parse Ms_del.dat? is there any sort of event log file in the nokia and android devices? and where can you find it?
View ArticleForensic Software: mft2csv - NTFS systemfile extracter and $MFT decoder
joakims wrote: Also added this code to satisfy most people: Code:: If @Username = "jaclaz" And $input <> $ValidMFT Then MsgBox(0,"Hey!", You dumb ass fool! what on earth are you trying? Read...
View ArticleGeneral Discussion: RAID Reconstruction
A RAID-0 is normally obvious because the MBR on one drive can indicate a disk of twice the size of the physical disk. As said above, the rest is trival.
View ArticleGeneral Discussion: Ever reported data recovering from broken CD/DVD/HDD?
hello jaclaz. Thanks for your comments. 1 I remembered to have asked already a very similar question before posting this second message about that subject. However, the new hue regarding it(at least...
View ArticleGeneral Discussion: Hexworkshop Examniation
binarybod wrote: * Look at the structure, some of them are not easy, balanced B-Trees can be a nightmare, some however, are a piece of cake in comparison (I'm thinking FAT and NTFS but only probably...
View ArticleGeneral Discussion: Digital Forensics Lab
CopyRight wrote: ...What ISO's are related to digital forensics labs? I27001 and..? While there are many ISO standards that could be applied within a DF lab including ISO 27001, ISO 27037; I'm assuming...
View ArticleMobile Phone Forensics: JTAG & CHip offs
Chip off will cost a lot - you need equipment to take the chips off, equipment to read the chips, and the training that goes along with it Google the NFI memory toolkit.
View ArticleForensic Hardware: WiebeTech Forensic Combodock V5 - good/bad?
I also ordered a UltraDock V5 for testing because we've noticed that the Oxford controller in the T35es cannot use the entire drive when dealing with drives larger than 2.19TB when the T35es is...
View ArticleGeneral Discussion: RAID Reconstruction
If time is a factor, you can try recover it yourself: http://www.youtube.com/watch?v=2EB5hFvBpYg (dont be discouraged by the videos topic) If you are uncertain of anything explained, go with a...
View ArticleGeneral Discussion: Is possible rebuild a cut floppy disk & retrieve data?
keydet89 wrote: It's been possible since the '90s: http://www.csoonline.com/article/219226/computer-forensics-investigations-body-of-evidence Nice! The snodgrass case is THE case that made me...
View ArticleGeneral Discussion: any software for getting secure erased data back?
Only time when you can recover anything from a disc would be in situations like these: 1. The wipe software is defective and reads the harddrive parameters wrong, leaving the beginning or the end of a...
View ArticleGeneral Discussion: Ever reported data recovering from broken CD/DVD/HDD?
jaclaz. thanks for your patience and kindness, but not get angry, please <img src="images/smiles/icon_wink.gif" alt="Wink" title="Wink" /> I appreciate much your interesting information. Now, ALL...
View Article