General Discussion: Flaw in evidence verification process?
jhup wrote: This goes back to a pet peeve of mine. We do not need exact "bit-by-bit" copies for forensics. Think about it. Is finger print analysis uses 100% of a (already partial copy of) fingerprint?...
View ArticleForensic Software: Quicker Forensic Imaging?
Passmark wrote: Microsoft is no longer allowing WinPE (and thus WinFE) to be licensed and distributed. ... So unless you have something else in writing from Microsoft I would suggest that both selling...
View ArticleGeneral Discussion: Flaw in evidence verification process?
As I see it, the hash done while imaging takes into account the "flux" of data read from the source and written to the target disk. As such when you verify the hash of the written image by comparing it...
View ArticleGeneral Discussion: Tracking Facebook or other Social Media Posts
I really don't think I have the credentials to answer question 1. Just one side note, IP, at least alone, cannot be used to correlate a person to a user account, in court (but you probably already know...
View ArticleMobile Phone Forensics: New Book - RFPS (Radio Frequency Propagation Survey)
Joe Hoy from Forensic Analytics joins us this month at Cell Site Analysis blog to outline the purpose and content for his forthcoming book regarding RFPS (Radio Frequency Propagation Survey). New Book...
View ArticleGeneral Discussion: Issue with recovery from formatted hard disk
Typo, corrected (the math is OK). Of course the start is given with reference to the start of the volume, and for this kind of rough calculation 63 or 2048 sectors before don't make a difference. jaclaz
View ArticleGeneral Discussion: Tracking Facebook or other Social Media Posts
bshavers wrote: An IP address is not a person. A MAC address is not a person. An email is not a person. A posting on Facebook is not a person. Etc... You are right on the problems of attributing...
View ArticleGeneral Discussion: Issue with recovery from formatted hard disk
Thanks Jac and Michael for your valuable inputs. I will follow the procedure recommended by you to see if I can get the $MFT entries. Regards
View ArticleDigital Forensics Job Vacancies: Director of Digital Forensics, London,...
Contact: craig@brimstone-consulting.com Tel: 0207 096 1200 The role: Opportunity with a leading but still niche Consultancy with an excellent reputation in Digital Forensics & e-Discovery. You will...
View ArticleDigital Forensics Job Vacancies: Head of Digital Evidence
A high profile role now exists for an experienced leader and strategic thinker within Forensic Technology to work for a high profile organisation within the city of London. In this role you will manage...
View ArticleGeneral Discussion: Compare multiple files for duplicate data
Nuix Investigator has many of the features which you decribe but it is not cheap. It is very powerful for this type of work though through its's use of Shingle Lists etc....
View ArticleForensic Software: EnScript - Registry - EnCase 7
lance wrote: K- I have never seen the RegClass used this way on a 'static' evidence file. The common use of that class is against a 'live' remote node, not an evidence file. You can certainly mount the...
View ArticleForensic Software: Quicker Forensic Imaging?
To clear up the questions: We don't give WinFE away, we advise anyone using the software to make their own distribution. For users who have assisted us with trials, we have provided the WinFE...
View ArticleGeneral Discussion: Tracking Facebook or other Social Media Posts
Thanks everyone for the posts. I am going to check out that book. From a legal perspective, I want to point something out. The law in every jurisdiction on admissibility of online evidence varies. Some...
View ArticleForensic Hardware: USB3.0 Cards For Tableau Writeblockers
Hello, I am upgrading our forensic workstations, and have a couple of the Tableau T35689iu faceplates to go in them. I didn't get an internal USB3.0 card for the connection though. Is there a specific...
View ArticleForensic Software: Quicker Forensic Imaging?
The posted imaging speeds are really good. So good that it begs to be seen in a test for comparison (that is a good thing). I bet Eric Zimmerman would gladly accept a demo of the tool to add to his...
View ArticleGeneral Discussion: Custom Engraved Padlock Drives
Hello Members of Forensic Focus, This may be an odd question. I am looking to purchase some padlock encrypted drives and would like to have them engraved with our company logo. I figured it would be...
View ArticleGeneral Discussion: Compare multiple files for duplicate data
I would also maybe look into a program called "Ultra Compare" it has worked pretty well for something similar I had to do.
View ArticleForensic Software: EnScript - Registry - EnCase 7
WMIF wrote: Hi Kwilley, First comment: Doing a direct comparison with string data has been problematic in some cases for me in the past. There is a better method which does a text based comparison...
View ArticleDigital Forensics Job Vacancies: EY Switzerland is looking for Senior...
We are looking for Senior Forensic Data analytics - Forensic Investigations and Discovery Services Everyone has their favorite spot – somewhere to think things through, get to grips with exciting tasks...
View Article