Category: Defensive Security

Welcome back, my hacker apprentices! Network forensics is key element of most digital forensics and incident response (DFIR) investigations. When our systems have been compromised by an attacker, its up the DFIR investigator to determine the who, what, where and how of the attack. In other words, what can a DFIR investigator learn about the […]

Over the past decade or so, the growth of the mobile market has been the fastest growing segment of the IT industry. We now have portable smart phones and tablets being used throughout the consumer and business market. These add an extra challenge to the forensic investigator, but can also contain a cornucopia of information […]

In many cases when a computer, phone, or mobile device is seized for evidence, the system will have graphic images that might be used as evidence. Obviously, in some cases these graphic images may be the evidence such as in child pornography cases. In other situations, the graphic images may tell us something about where […]

This is the seventh installment in my Digital Forensics series. To read the first 6, please click here. Often, the web browser that a suspect uses can provide us a bounty of information on what the suspect was doing online before the capture of the system. Since so much activity is conducted using the browser […]

This is the sixth tutorial in my Digital Forensics series. If you would like to read the previous 5, go the Forenics tab at the top of the Menu bar to find the first 5. Introduction to the Windows Prefetch System Obviously, Microsoft did not implement the prefetch system for forensic analysis, but rather to […]