I can't wrap my head around it, has volatility3 been left for dead to be replaced by memproc fs or something else? Is there a plugin that fixes all the output issues among all the features it lacks from volatility2.

I am by NO means super intelligent (im pretty dumb), but I could make a new version of volatility in a month with no output issues, a way easier setup, all the plugins from vol2 and more (I might do this to learn memory forensics better)

Essentially I am asking if I am missing something or should I make a plugin that fixes all the problems with volatility3?

I ordered my new machine for processing cellphones today, built to the optimum specs for Cellebrite Inseyets , hopefully it handles it well cause it was 3x the cost I had initially planned to replace my cell phone machine with. The old machine didn't like running PA 8 so I have been stuck on the 7 Track till the new machine arrive.

Hi All- someone sent me a pdf file with the creation/modification properties listed as today, while claiming it was sent weeks ago. I need to know if this file was actually created weeks ago or if it was created today. Is there a free tool I can use to determine the date of the file's actual creation? Thanks

I'm learning how to use arsenal and attempting to mount a newly created image.

Here's my setup:

Ubuntu Bare metal machine hosting a W10 VM (Vbox) and creating an image with FTK

W10 OOBE with C:\ <-- image created of this disk (Vdisk)

D:\imgs\ <-- img will be placed here (Secondary Vdisk)

the image is mounted read only and is "online" but shows uninitalized in disk management.

Here's some hopefully helpful info:

https://preview.redd.it/7fx92z2xfwxd1.png?width=752&format=png&auto=webp&s=86c8e5ecb0d632ee8abca5d7b88dcb287b9f010e

https://preview.redd.it/c5mgcs3xfwxd1.png?width=988&format=png&auto=webp&s=f76f6e1472323ff6f937e273850048849747192e

https://preview.redd.it/g5y9513xfwxd1.png?width=673&format=png&auto=webp&s=273373dc288e63d7af2a1a0d283c9860fd6d30be

I read on the FAQ (for mounting read/write disks) that read/write mode is required for vm launching virtual machines, im not sure if that applies here, the core forensic feature is the read only mode (for the learning module im doing) and if i recall i was unable to get the disk to mount in either mode

Arsenal is being run w/ elevated permissions.

Any help appreciated

edit: image mounts fine in FTK

I'm not a good test taker. Still managed to get my undeegrad in IT and MS in digital forensics. Now I have about 8 years directly in the field. I have the Ence from back when Encase was cool. But I can't pass this damn Sans GCFA. I've failed it twice, about to take it a third time and just bracing I'll fail.

I only fail by 2 or 3 points each time. If I fail I might throw in the towel on this one. Do you consider this cert make or break in this field? Would you hire someone with experience, who took the class (twice) but doesn't have the cert? I know a lot of jobs prefer it and I promise I understand the material and do the actual job just fine. Just can't pass the test. It's just unreasonable to put what feels like our entire career knowledge into a 3 hour test.

I need to extract the SMS text messages from a Samsung Galaxie Note 10+. I have a Magnet Axiom extraction from a year ago but I now need to access and print relevant SMS messages for the last year and do not have access to Axiom at this time. I have a backup of the phone in Google Drive and Samsung Cloud as well, as the text messages are currently still on the phone. I am looking for advice on any free software to extract the messages from the phone or backups or a way that isn't too expensive. I cannot justify the price of Axiom for such limited use. Any help or recommendations would be greatly appreciated.

Is it easy to transfer between Police Digital Forensics (specialise in phones but have some computer background) and private company incident response? What skills are needed to transfer? What should I train up on?

I was thinking of starting an on the side forensics business. I was talking to another friend who offered to throw me some of his extra business and said just come up with a referral contract and we could work something out. What percentage do you normally give the referring company? Is there a standard in the forensics community?

Are there any tools I can get specifically certified in? Like how palo alto and such have certs for their tools.

The latest 13Cubed episode is out! Join us for a complete walkthrough of KG Distribution, the 13Cubed challenge created for XINTRA Labs. Learn more at xintra.org/labs.

Episode:
https://www.youtube.com/watch?v=A7Bh7vnAooQ

More at youtube.com/13cubed.

In the context of application support, finding the root cause of a problem in the host environment is often a challenging task. We often are reported issues which are caused by its host environment but the root cause is unknown until discovered based on experience or through hit and trial.

Some times, windows logs are helpful but a lot of times the cause of the problems is in changes made to security policies which in some way restrict the way application works thus causing problem.

I want to know how people have solved this problem by knowing any minute change being made to the host environment, and what tools and techniques do they use or suggest to make know exactly what change is made to the host environment.

https://preview.redd.it/djwu8gzrugxd1.png?width=804&format=png&auto=webp&s=b886e24deac81e3b134bd8ecab97b901bb3103b1

Hello everyone. Thank you admin for approving this article. I want to buy a used tableau forensic bridge t35689iu device with both parts as in the picture. If anyone has it, please contact me or contact me via email: Thangtt0204@gmail.com

Has anyone here dealt with the Yeap app?
The share stories one, not the parent transport one.

I know that filecaving can be done using a separate plug-in in autopsy. What plug-ins are available? I'd appreciate it if you could answer.

I'm really interested in digital forensics and want to explore it further, but I'm not quite sure where to start. Can someone guide me on how to begin this journey?

I've already read about half of "A Practical Guide to Digital Forensics Investigations", but I’d love more direction on what steps to take next, whether it’s additional resources, courses, or practical experiences I should pursue.

Any advice would be greatly appreciated!

Is anyone familiar with identityservices on ios and macos? I keep running into logs within the idstatuscache.plist and ids-pub-id.db that have "com.apple.private.alloy.nearby" and I can't for the life of me figure out what is triggering these logs. I am aware that com.apple.madrid is imessage, for instance, and I am also aware that the logs are for apple id authentication. I just need to determine what action/app is correlated to the nearby logs. I also have determined that it is NOT at all actually nearby, because I have confirmation that multiple of the logs are from devices in other cities or even other states. Please let me know if you have any knowledge on this or even any guidance on where I can look. Thank you so much!

Hi, I'm in high school and I'm considering being a digital forensics analyst as a potential career option.

I heard that a good way to get work experience is to be a sworn law enforcement officer or be in the military. I don't want to do either of these.

What are some other entry level positions that I can do to get experience for a few years before becoming a digital forensics analyst?

Hi everyone, I have a special request. Could anyone give me advice on performing forensic analysis on a TKSTAR GPS tracker? I’m looking to retrieve information like location history, on/off timestamps, and similar data.

Here’s the link to the tracker model: https://amzn.eu/d/6W6a5M2

Thanks in advance!

Hello all!

We did a recent collection for teams + mailbox data using ediscovery premium. Each was done separately, but we added sharepoint/onedrive to the custodians (including private chats/their sharepoint location) and then defined in the search query what we wanted.

In the search for mailboxes, we limited the export to email, meetings, metadata headers, recalls, resend. However, we found a folder for sharepoint in the export. I checked the load file and all the docs in sharepoint (docx, pdf, etc) are marked as attachment, some with no parent as well. Their locations were also from other people's sharepoint and some teams chats.

I'm tempted to just ignore the folder as I don't imagine the processing engine going to the sharepoint and linking any doc their to its content (since the Fam ID/File ID etc don't match), however I'd still prefer to understand what happened. The theory is these are unindexed items that were included and orphaned from their original messages (waiting on the report that IT missed to see) or they're attachments for private teams messages that were orphaned.

Has anyone ecer faced this or has an idea what it could be?

Thank you!

I graduate in May, majoring in Criminology and double minoring in Cyber crime and computing tech applications. I am considering applying to either a graduate certificate program for computer forensics, or a masters in cybersecurity with a concentration in DFIR. I'm leaning towards the latter. I am completing all my graduation requirements this semester, so with my last semester I plan to take classes in math and python to help makeup for my lack of technical experience in my course work, which has been heavily legally focused.

What certifications that are reasonably affordable or skills/languages should I be learning in my free time now and next semester to best prepare myself for grad school and be a better internship candidate?

Hey, I’m relatively new to digital forensics and still gaining knowledge in the field, but I’m determined to succeed. Recently, I was assigned a case involving a company’s Windows PC. A customer from this company had remote access to the computer via Microsoft TeamViewer. The customer was using his own notebook to connect remotely, and during this session, he deleted some files and chats.

The company noticed this activity and immediately shut down the PC. Now, I have the PC, but the owner doesn’t know exactly what was deleted. He’s only aware that something has been removed from the system.

The PC has a BitLocker-encrypted partition, but I managed to get access to it. I created an image of the PC and began analyzing it with Magnet Forensics, but so far, I haven’t found any useful data—no app data, nothing in the trash, no significant logs.

I’ve been working on this for three days now and I’m at a bit of a standstill. I don’t want to give up on this case. Do you have any suggestions on how I can proceed further?

Thanks for your help, and I apologize for any mistakes in my English.

I can send you the instructions, i just need help, I've tried to use the tool, but didn't have too much luck solving it.

I recently executed legal process to a text messaging service/app and recovered several excel spreadsheets of text messages.

I am looking to see if anyone has a way to visualize the results? Obviously, the produced excel spreadsheets are the actual evidence, but I am looking to see if there is a way I can create a visual aid to increase readability.

I appreciate any help you guys have to offer.

I have three (3) individual E01’s files of HDDs that based on volume information, are part of one Windows Logical Volume spanning the three drives. Due to this, I am having a hard time navigating the file structure and forensic tools don’t seem to recognize any file system, thus only carve data from the drives. There is plenty of data there, but I’m trying to restore the file system to recover the file paths and locations of files on the drives.

The system these images came from is unavailable.

Can anyone recommend any options I may have?

In the event it matters, compression was used creating the E01’s and the tools I’ve tried include FEX and Magnet AXIOM.

Good afternoon guys,

I am trying to recover images from CCTV system. First of all, I tried to use photorec in the HDD , however was not possible .

The HDD filesystem is xfs.

Do you have any idea how I can proceed to recovery the image files ??

Thank you guys .

Hello, Does anyone know that is there any command line utility to acquire a C drive image.

I have a computer I want to examine, but I want to preserve its state as much as I could. This means we can't install screen recording software on the device under examination. I also wish to leave a digital record trail for each time we examine the computer.

Is there an open source or free software that can record what is done on the computer screen during each examination?

Best case scenario is the software automatically records when I plug in my USB (doesn't write onto the computer, but stores on my USB) then stops recording when I eject the USB. Lastly, it can label each footage by date and time. Thanks.

I come from a civilian LE background. I did crime scenes, got my masters in IT, and then worked in digital forensics a bit using cellebrite with cellphones.

I moved towards IT the last couple years with software and applications. I have an opportunity to go back to digital forensics and I’m not sure what to do. Are there enough digital forensic opportunities out there to make a full career out of it? I feel more stable in IT

Can anybody suggest to me free-to-use tools for memory acquisition on this device? Some people say OSXPMem can be used but when I read the documentation it says only up to Mac 10.12.

Notes: Please helppp🙏

Does anybody know more about the history of Oxygen? I did some digging and discovered that they are Russian based and also found an article about them stealing code. I was originally told that their servers were based at headquarters in VA, but later discovered that is not true... The more I researched the more sketchy it seemed. Opinions?

Article linked below:

https://medium.com/@techheadings/ios-16-secret-hack-revealed-by-russian-phone-forensics-lawsuit-d46fe42bdf02