General Discussion: MacPro RAID
If the disks were RAID1, then they read as a normal drive. The most likely configuration would be RAID-5. You need to find out if the user knows what the original drive capacity was. RAID-5 would...
View ArticleMobile Phone Forensics: iphone5 passcode bypass
I don't have the latest iPhones at my fingertips, but isn't the emergency call trick (will be patched in 6.1.3) enough to access sms?
View ArticleMobile Phone Forensics: Locked Galaxy S3
No, the method we use for some of the Samsung phones that allows us to bypass pattern lock cannot be implemented on the UFED Classic. The S3 family is one of those that are only implemented on the...
View ArticleForensic Software: ADLab index search oddities
I got some odd results recently while doing an index search in ADLab 3.4.2. Looking for instances of a first name, "markus", that is also spelled "m@rkus". I tried two different index searches,...
View ArticleMobile Phone Forensics: iphone5 passcode bypass
Jonathan wrote: Robbo747 wrote: The only way to unlock a handset lock on a iphone 4s or 5 is to submit it over to Apple. Join the cue- according to IACIS members, American law enforcement are...
View ArticleGeneral Discussion: recovering windows(email)password from external hard disk
williamsonn wrote: one of my netbooks is broken and I have extracted the hard drive disk. The problem is I had, stored on the broken computer, authomatic passwords of yahoo and facebook. And those...
View ArticleGeneral Discussion: MacPro RAID
Without more knowledge about the box you are in a bit of trouble. Macs offer a software RAID and optional hardware RAID controller. Macs are very intuitive in that if you put the disks back into the...
View ArticleForensic Software: The X-Ways Forensics Practitioner's Guide
We've created a blog at http://xwaysforensics.wordpress.com for updates to this book. The first chapters are finished, but if there are any suggestions as to what you'd like to see in the book, you can...
View ArticleForensic Software: File creation date - Windows XP
Chisco77 wrote: The question is: if I cut and paste a file in windows xp, is the creation data of the file modified? Sometimes when people say cut and paste, they mean copy and paste. A copied file in...
View ArticleGeneral Discussion: recovering windows(email)password from external hard disk
Passmark wrote: I many (if not all) of the Nirsoft tools only work on the boot drive. So they might not be of much help with an external drive or disk image from another machine. I haven't tested all...
View ArticleMobile Phone Forensics: iphone5 passcode bypass
Quote:: So there is some sort of back door? I'll try to explain this without going into too much technical depth. As far as we know there are no back doors inserted by Apple. One of the main hurdles...
View ArticleMobile Phone Forensics: clean mobile phone
Hey I am studying the way to clean mobile phone from spyware. I am collecting on google as much materials I can. Can you helpme?
View ArticleGeneral Discussion: MacPro RAID
There is an easy and safe way to finish the job. You will need a tool to mount the RAID array without the original RAID controller present, and without knowing the original RAID configuration. For...
View ArticleForensic Software: osTriage version 2
it can be used against anything that has a drive letter in windows, so it does serve as both a live response and dead box searching platform. ideally plugins will get the same data whether live...
View ArticleForensic Software: File creation date - Windows XP
Tucker, you are very kind. This is really fascinating. I'm new at foresncis, but I know I'm goint to learn a lot in this case. At this very moment, I'm creating a virtual machine of the raw image of...
View ArticleMobile Phone Forensics: Samsung Galaxy Note GT-N7000 VS UFED
I have seen my mistake, I forgot to turn off the device during the steps.
View ArticleForensic Software: Anti-virus recommendations for forensic workstations
For the last 10 years I have invested in using Sophos, excellent software never let me down, most councils and LE I know of use this. Mitch
View ArticleGeneral Discussion: screen capture software
Thanks Bithead - I tried camstudio and it crashed - maybe I'll reinstall Paul
View ArticleMobile Phone Forensics: iphone5 passcode bypass
trewmte wrote: Pxtxr wrote: Correct me if I made a mistake somewhere as I'm writing all of this from memory. Peter which area did you work at Apple regarding iPhone?He works at Microsystemation ie XRY...
View ArticleForensic Software: osTriage version 2
EricZimmerman wrote: In short, I am asking for the community's feedback to ensure that osT2 covers the widest possible number of use cases for as many people as possible, so if you have any suggestions...
View Article