General Discussion: truecrypt formatted volume
joakims wrote: bombone wrote: terrible. I formatted on a wrong disk. It's a truecrypt hard disk. I stopped the process after two/three seconds. Now the system doesn't recognize it as formatted volume!...
View ArticleGeneral Discussion: Artifacts of wiping
armresl wrote: Why is 0x57 an odd choice? As long as 0x56 and 0x58 are evenchoices, it sounds fine to me <img src="images/smiles/icon_wink.gif" alt="Wink" title="Wink" /> .<img...
View ArticleGeneral Discussion: Document Metadata Extraction
There is a perl script that can parse a folder of documents, grab the EXIF data, then dumps it into an SQLite database. You can then export this into a CSV file. It supports doc, .docx, .xls, .xlsx,...
View ArticleGeneral Discussion: Memory Acquisition & Analysis Presentation
Very good talk on the anti-forensics side: http://www.youtube.com/watch?v=KwEaRKBWsaw http://events.ccc.de/congress/2012/Fahrplan/events/5301.en.html
View ArticleForensic Software: Bitlocker issues with Linux forensic tools
I currently have a closer look on CERTs ADIA: http://www.cert.org/forensics/tools/ scroll down to ADIA ADIA used to have the latest software installed and get regulary updates. With CERTs ADIA you can...
View ArticleMobile Phone Forensics: UFED Touch/Physical with BB Bold 9900
Hello Colin, UFED touch ultimate can perform Logical Extraction (GSM) for 9900 Bold. Offers to extract Phonebook, Phone Content and memory card, in detail it excludes Apps Data, Email and IM. If the...
View ArticleGeneral Discussion: Facebook Forensics
CMIIW but, I don't think you could do it straight away, except probably if you are using gtalk or yahoo, then yo do file sending activity, then probably you will be able to see the ip of the other...
View ArticleGeneral Discussion: Memory Acquisition & Analysis Presentation
In fact, I do. Check out http://forensic.belkasoft.com/en/live-ram-forensics , and if you find it useful, PM me for PowerPont slides.
View ArticleForensic Software: True Crypt Hidden Container - Optimal Size?
Briefly, 1) I have installed TrueCrypt on a USB thumb drive for use on several computers. 2) Initially, I wish to encrypt a 2 TB USB external hdd. 3) What is the optimal size for the "hidden container"...
View ArticleForensic Software: Looking for a Windows utility to forensically copy files
Free: Upcopy. http://dmares.com/maresware/tz.htm#UPCOPY FTK Imager http://www.accessdata.com/support/product-downloads#.UdnsdKwkyrg Not free: Just about any forensic software can copy files (export,...
View ArticleForensic Software: Looking for a Windows utility to forensically copy files
http://www.nuix.com/Nuix-evidence-mover
View ArticleMobile Phone Forensics: UFED Touch/Physical with BB Bold 9900
Thanks both of you for taking the time to answer. Colin
View ArticleMobile Phone Forensics: BEE 1100
Don't the MTK devices usually work better over BT? Have you tried that? It's been a loooong while since I examined one but I have that memory stuck in my head. Colin
View ArticleDigital Forensics Job Vacancies: Incident Response Consultant, London or...
Salary £55,000 - £85,000 Location London or Dubai Job title Incident Response Consultant job, London or Dubai base, global consulting firm Summary Must have incident response job, a-player wanted with...
View ArticleDigital Forensics Job Vacancies: Cyber Security Investigstor, Surrey, £25,000...
Salary £28,000 - £47,000 Location London Description Technical Investigator A global consulting firm is looking to appoint a Technical Investigator to join their growing Cyber Security practice. The...
View ArticleGeneral Discussion: Detection of Forged Documents
Wht exactly do you mean by forged documents? Fake ID's/passports, faked seals, or photoshopped pictures?
View ArticleGeneral Discussion: Facebook Forensics
It's not even necessary to send an email containing a link. Just create an HTML message and embed pictures linked to your Web site (with <img src="http://mytrackingsite..... ). Yes, some email...
View ArticleGeneral Discussion: Finding hidden encrypted files
Regardless of *how* the encrypted files were hidden, probably the best way would be running stochastic analysis on the entire disk content (in low level). Any sectors on the disk containing some very...
View ArticleForensic Software: True Crypt Hidden Container - Optimal Size?
With the utmost respect to Mark for taking time to answer my question, I must agree with you Phobby. Quote:: If you only need to store a small amount of encrypted data in the hidden container, then...
View Article