In many cases when a computer, phone, or mobile device is seized for evidence, the system will have graphic images that might be used as evidence. Obviously, in some cases these graphic images may be the evidence such as in child pornography cases. In other situations, the graphic images may tell us something about where […]

This is the seventh installment in my Digital Forensics series. To read the first 6, please click here. Often, the web browser that a suspect uses can provide us a bounty of information on what the suspect was doing online before the capture of the system. Since so much activity is conducted using the browser […]

This is the sixth tutorial in my Digital Forensics series. If you would like to read the previous 5, go the Forenics tab at the top of the Menu bar to find the first 5. Introduction to the Windows Prefetch System Obviously, Microsoft did not implement the prefetch system for forensic analysis, but rather to […]

In the previous articles in this series, we captured an forensic image of the suspect’s hard drive, we captured a forensic image of the suspect’s RAM and we had used Autopsy to recover deleted files from our first image. In this lab, we will use Autopsy to do file analysis. In order words, we will […]

In the first two parts of this series, we captured a forensically sound image of the hard drive or other storage device and an image of the RAM. In this tutorial, we will recover any files deleted by the suspect. Among the most fundamental skills necessary for a forensic investigator, recovering deleted files is probably […]

Digital forensics is rapidly growing field of information security. The hacker needs to understand what evidence can be recovered and the security engineer needs to know how to find it. These skills are applicable to law enforcement, corporate investigations, network intrusions, malware analysis and incident response, among many others. No matter what area of information […]