Hello computerforensics community hope this message finds you all well. So I’m trying to figure out how to retrieve Lorex home security footage from 2023 and I have no idea where to start hope this community can help me solve this problem of mine. Thank you computerforensic community.

If an iPhone is powered off and then powered back on BFU, if it is connected to a known WiFi network will it back itself up to the cloud or will it wait to be unlocked before the nightly backup?

This is a public service announcement. If you are involved in drafting digital forensics reports, or scrutinizing opposing expert reports, please invest in a copy of The Demon-Haunted World: Science as a Candle in the Dark (https://en.wikipedia.org/wiki/The\_Demon-Haunted\_World)... then read, and re-read as necessary.

I just started with digital forensics, and all the messages I can recover (whatsapp, facebook messenger, wechat and etc) from db and db-WAL files are only very recent, especially on iphones. The oldest messages I was ever able to recover was from around a week ago. Is it just me? Am I just not skilled yet? Or is this common nowadays? Even with FFS, I can't recover older messages which my clients are most interested in.

Are there any tips and tricks?

Hello all!

We have a project were we need to transcribe around 1000 phone calls and we're currently using RelativityOne.

I thought ROne now has a transcription solution but I don't think I'm remembering things correctly. Has anyone any knowledge about this? If not, can you recommend an offline (maybe even open source) transcription solution?

Thank you!

Has anyone extracted data from the above camera? Aside from the SD card, is there information on the device itself that can be extracted? If so how?

So I decided to put myself on the priority list for the upcoming BCFE course, however my department is very likely NOT going to pay for anything for this class. I've seen some people say that this course is only worth it if your department is paying for it. Others say it is the most affordable course as a first step into the digital forensics career, which is what I really want to get into. My question is should I continue down this path and pay for this class all on my own in order to get into this career? Also, will this course, and the CFCE certification, be a good way to an entry position in the digital forensics field? I am currently law enforcement and don't have any other forensics certifications. If I get through this course and get my CFCE certification, then I will definitely want to move to a different department that will see value in this certification and my skills.

I have a Sanyo I’m working on. I was able to finally get an ok extraction using an old school Cellebrite B16.

Fast forward, I’m analyzing the QcpDump for texts. I realize this is a Brew based phone an am not as familiar with Brew, the structure, and how it holds data. I’ve found a few key areas of interest: QcpDump/mod/polaris_imc_1/messaging/00/sms:

msgindex.idx - this appears to hold some message content. I am kind of seeing some patterns in terms of structure but nothing I can concretely decipher.

Another folder in the same directory with a segment_table.db and sgmt_bulkfile_0000.

The .db is not an actual SQLite file and doesn’t follow the SQLite structure. I have not found the header to match anything so I am assuming it’s some sort of proprietary format?

The sgmt_bulkfile_0000 appears to be encoded. Each encoded string is no more than 160 bytes in length, which I believe is on par for sms messages on the brew system? In doing some research I’m thinking it may be 7-bit GSM encoding.

I have a sneaking suspicion these files piece together somehow. I could be totally off base with anything above, these are just some of my observations. Any advice, corrections or insight as to the best way to proceed would be helpful.

I forgot to export my keywords before the update and now they are no longer there after the update. Are they stored somewhere?

Question for users of these two products, or key fob licensed software in general. I purchased licenses for these products, both of which require a key fob for use. I got them for a specific job two years ago and haven't used them since.

I've never purchased a product which required a fob before. The USB must be plugged into your computer to use the software. I get that when buying a license it's for just one person, but if it'a fob product that is always guaranteed to be the case, so if I give someone the fob, am I effectively giving them my license? It means that the desired end result - only one user - is still going the be the outcome. I don't want to screw over anyone, developers deserve to be paid for their efforts, but if they say it's only for 1 person to use, and the fob guarantees that, what's the difference if it's me or someone I give or sell it to? Can you generally sell a product that is licensed via fob?

I know I can ask the vendors, but thought I might get a quick answer here on whether it's kosher or not, without getting them possibly worked up that I'm going to do something that I shouldn't, if not allowed. These things cost thousands so hate that they just sit here in my little bag of tools.

Good morning,

Quick scenario: iMac computer with known admin login. I imaged the full system using CAINE boot and Guymager. Hash verified. My attempt to examine with Axiom shows the main user volume as locked via “hardware encryption”. I know this is a function of the MacOS.

Is there any method to unencrypt to examine? This client does not have access to any key. They suspect their IT people and that doesn’t seem to be an option at this point. I’m thinking without a key, I can go no further.

With the system up and running, are there any processes I can use to easily obtain all the users files?

Michael

I've heard that due to file based encryption (FBE) being prevalent in most smartphones, even with an FFS with a professional tool like Cellebrite Premium, it can't decrypt the data in the unallocated space even if you have the passcode for the phone (Especially if it is an iphone).

Hence, your only chance of recovering data even with a full blown FFS is to look for remnant data of the deleted messages in the db file or the db-WAL file.

Am I correct?

But from my experience, the db and db-WAL file rarely contained much data that pertained to deleted chat messages...

Is this why recovering deleted messages in an instant messaging app from long ago is difficult nowadays?

In a nutshell,

1. Get a FFS
2. Analyze the db file and the db-journal or db-WAL file of the instant messaging app of interest
3. See if the db file and/or the db-journal db-WAL file may contain the deleted messages
4. Also look for potential data in the unallocated region of the phone to see if some data are not overwritten

edit: if messages are deleted, it remains in the db and db-WAL file until it is vacuumed. Once vacuumed, only way to recover is to use step 4 to see if there are data remaining in the unallocated region ? Is this correct?

I've seen demonstrations of steps 1, 2, and 3, but I have not seen a demo of step 4 though...

Am I correct?

I bought the eCDFP voucher, and I don't have access to the content, so I started studying from multiple sources, and I'm planning to take the exam in the end of February, so any one who bought the voucher and wants to study with me where we plan the coming 30 days on breaking topics down and hitting them daily, is welcomed.

I’ve recently been employed by a small law enforcement department for a digital forensics role. I have a bachelor’s degree in cybersecurity, so I’m not unfamiliar with the field. However, my degree didn’t focus heavily on digital forensics.

I’ve managed to get into a digital forensics class with NCFI (DEI) in the hopes of progressing to MDE, which aligns with what my department wants. At the same time, I’m eager to learn as much as I can to excel in this role.

Does anyone have any tips on where I should focus my learning or other classes I should consider? I’ve already discovered BCERT, but I understand it may be a while before I can get into either BCERT or MDE. Appreciate any advice at all!

Hi everyone,

I'm a forensic examiner, sworn police officer for a municipality, and a TFO for a government agency. I aspire to launch a side business doing forensics for civil attorneys as a way to begin transitioning into civilian work.

As a police officer, I only work on criminal cases, but I'm concerned about potential conflicts of interest or possible ethics violations.

This is just an idea at this stage, and I know I need to do a lot of research. However, I believe some members here have been in law enforcement and may have navigated this path before. I understand that much of this likely depends on the state, agency, and other factors, but if anyone has any insights, I'd love to hear them.

Thanks in advance!

Edit: fixed grammar and spelling issues so @Fresh_Inside_6982 can sleep tonight.

Hey All,

I have worked in eDiscovery for 10+ years but recently got laid off. I have lots of experience in forensics tools (EnCase, FTKi, Cellebrite, Aid4Mail and others). I'm currently on a severance package for several months from my previous job so I'm thinking what to do next.

There are not much open eDiscovery related jobs currently. I'm thinking about transitioning my career to Digital Forensics or Cyber Security. It seems theres a lot more jobs in these fields when searching LinkedIn and indeed when comparing to eDiscovery jobs.

I currently have a BAS in Computer Forensics and have around 3 years experience in IT Help Desk.

Does anyone have any recommendations in finding a job in Digital Forensics or Cyber Security? I'm currently taking the Google Cyber Security certificate in Coursera. I also would like to take the CompTIA Security +, Exterro ACE and maybe the CCE certificates.

If I do towards more of the Cyber Security route, would it best to get a whole new degree in Cyber Security. I know both Cyber Security and Forensics go hand in hand kind of (DFIR). Thanks and any advice is appreciated!

Crowdsourcing since I don’t know where to begin…Cliff notes are that a close relative (who is a minor) is the subject and object of daily homophobic and race-based hate speech via FaceTime calls and iMessages to their iPad from unknown callers / senders. In other words, cyber bullying and harassment from unknown (and I suspect, fake / burner) numbers and accounts. In all likelihood, the harassment and abuse is an extension and product of specific kids from their former school.

I would like to know, specifically, what technology firms / experts law firms retain to investigate and uncover the source and identity of such calls / messages when preparing a civil or criminal complaint. All information, recommendations and referrals are welcomed and appreciated.

Thanks, all, in advance.

In this program, what does IOS maps reflect? Searches that were made?

What does Apple Maps Trips show?

Just trying to understand what data I’m looking at. Thanks!

Hey - I’ve been trying to look at some metadata on images that were sent to an iPhone via iMessage. Two of the images are forwarded screenshots, and one is just a regular photo taken with the camera.

I used the ExifTool.

However, there isn’t much useful data. It would have been great to get some geolocation data.

Can anyone confirm whether significant metadata is stripped when images are sent over iMessage? And do you have any suggestions for good next steps?

FYI - I was only able to extract the photos from the iPhone they were sent to - Not from the original iPhone that took the photos.

Thanks in advance!

Hi all, heavy DFIR shop here with a fast growing ediscovery side with onprem relativity and other tools. What are your preferred methods for std ediscovery extractions from the myriad forensic images formats to get data into review in a clean, deNist, best metadata sort of way? Axiom, Inspector, Autopsy, home grown scripting etc? Just looking to make things more efficient and automated than encase but some of the load files coming out of the commercial forensic tools are garbage. Thanks for any thoughts!

I am seriously struggling with finding a software, preferably with GUI, capable of memory forensics. Autopsy used to have an option for that, which doesn't seem to be true in version 4.21.0 anymore. Volatility doesn't have GUI and doesn't seem to have extensive capabilities. Bulk extractor is not compatible with Java 8 apparently. Can anybody help me?

In my line of work, we rely on tools like FTK, Magnet Axiom, Cellebrite UFED, and GetData Forensic Explorer to handle a wide range of forensic tasks based on client needs. For recovering deleted data, we use FTK for data carving and extraction, as we have found it to be highly effective in file carving. For tasks like log, event, and timeline analysis, as well as email indexing, we use Magnet Axiom. While Axiom is a versatile tool and performs well overall, I’ve noticed it falls short when it comes to deleted data recovery and file carving compared to other tools.

We use Forensic Explorer as a backup when FTK struggles to process images properly, though it’s more of a last-resort tool for us. My company is currently evaluating our toolkit, aiming to phase out less-used tools and introduce more efficient options. We're exploring alternatives like Belkasoft and X-Ways. For mobile forensics, we traditionally rely on Cellebrite UFED, but we're also considering Oxygen Forensics.

Can anyone tell based on their personal experiance in using these tools as well as other proprietary tools which would you recommend for specific tasks like file carving, indexing, or as a reliable all-rounder?

Thanks

More applications are using levelDBs to store their data and I was wondering what you all use to parse these files? GitHub has a few python scripts for levelDB but it seems like they are more application specific like Chromium.

https://github.com/cclgroupltd/ccl_chromium_reader/blob/master/tools_and_utilities/dump_leveldb.py

If there is not a general tool for parsing how do you go about pulling the data from the files?

Hi has anyone here taken this certification. I have to do it for work although EC-COUNCIL has a bad rep.

I would appreciate some feedback as what was your experience. I heard that lots of questions are not related to the provided source material. Is it true ? What study guide do you suggest.

Thanks

Does anyone know of public message OR phone data I could use to create RSMF, like the Enron set is for email?

I suppose I'd be ok messages or RSMF.

It appears that Cellebrite extracts the data and Axiom analyzes it?

If someone would please elaborate on when you use one vs the other, I would appreciate it.