General Discussion: best solution for periodically checking HDD&prevent error ?
1- What about chkdsk scan? 2- Regarding the SMART function, can be used any pre-made tool?
View ArticleGeneral Discussion: wipng free space(shadow copy, system restore)
electronic_x wrote: In any case, if your PC stored any copy of such a file, would be enough for deleting it, to clean free space with zeros? Who knows? As said it may depend on a number of factors IF...
View ArticleMobile Phone Forensics: iPhone 4S iOS 6 Data Recovery
A couple of days ago I moved some camera roll photos to a new album then deleted the originals thinking they were duplicates. I now know different and have obviously lost them. Unfortunately they...
View ArticleMobile Phone Forensics: Help with Android Gallery3D
I have a case in which pictures of interest were found in the com.sec.android.gallery3d folder (imgcache.0 and imgcacheMicro.0 files) Does anyone have whitepapers or advice on how to get more...
View ArticleEducation and Training: Skimmer forensics training
I'm looking for training on skimmer forensics (ATM and point-of-sales terminals) ? We are looking for a training covering the following topics: - The technologies that can be used to steal credit/debit...
View ArticleGeneral Discussion: wiping free space in encrypted containers
X:(or any other letter you choose on Truecrypt)is, in fact, the name of the encrypted container(which, although irrelevant, is in the HDD, E:) Inside X: there are some folders. I want to wipe all free...
View ArticleGeneral Discussion: Interview with Kathryn Seigfried-Spellar, Alabama University
Is there a place we can read the document referenced (Does deviant ...) for free?
View ArticleEducation and Training: cellebrite training
None that I know of, and there are no obvious colleges on the training calendar. Have you contacted Cellebrite about this? What counts as accredited? You must have a very hard time finding any...
View ArticleGeneral Discussion: Deleted truecrypt container
Thanks for all the advice, very helpful forum! Unfortunately NTFS has some issues with very large files and the MFT that complicate file recovery. The file shows up as 0 bytes long in any tools that...
View ArticleForensic Hardware: anyone knew more about TD2 e01 Compression Methodology?
the downside to compression by most tools is that it tries to compress everything vs just compressible things. when that happens, the image isnt stored as as efficiently as it could be
View ArticleGeneral Discussion: wiping free space in encrypted containers
electronic_x wrote: 1.in current version 1.61 -z is for filling with zeroes and -c is for filling with random data, but, as I think you meant that the best option, always, for securely wiping was a...
View ArticleLegal Issues: Online Documents as Evidence, Software License, Case Notes
icyalkn1 wrote: Hey Guys & Gals, . This sounds like a theory crafting set of questions from a course exercise.
View ArticleGeneral Discussion: [Need] Software to convert spreadsheets to single TIFF
How about writing an Excel VBA script to iterate through all xls/xlsx files in a folder (can do this with subfolders recursively if you need). You can then use the print command to print each worksheet...
View ArticleDigital Forensics Job Vacancies: Forensic Technology Analyst - Belfast,...
Great team, excellent location!
View ArticleForensic Software: Encase installation help
akkas wrote: Thank you for your replies, I found the email with the link to download Encase 7 and I am going through the Encase Essentials OnDemand training. I have following questions: a) during the...
View ArticleGeneral Discussion: Interview with Kathryn Seigfried-Spellar, Alabama University
I see it on Hellsevier, but it is for a fee.
View ArticleGeneral Discussion: Video chat artefacts
Give Internet Evidence Finder a try. Not sure about Chatrandom, but IEF does have support for Omegle and can also recover fragments of web video in some cases. You can request a free trial here:...
View ArticleForensic Software: Scanning Windows XP with NMAP
Hi, I am running Windows 7, and also running a virtual machine (Windows XP). I am using NMAP to scan the VM (WinXP) from my Windows host to visualize that the host is up, and also to list ports open. I...
View ArticleGeneral Discussion: Deleted truecrypt container
For large fragmented files the MFT $DATA record might not contain the file 'runs'. A run represents information about a fragment of the file (Cluster offset & number of clusters). Instead it might...
View ArticleMobile Phone Forensics: FTK Mobile Phone Examiner
Lee is going out of his way to help me figure this out, and the only reason it hasn't happened yet is my schedule and technology limitations (namely, I don't put my forensic computers on the Internet)....
View Article