https://youtu.be/_ZR-c3e7jZ8

He's a demonstration of a little plug-in I made yesterday for volatility3, I made a reddit post about this 2 weeks ago and finally got round to starting it, if anybody wants me to keep working on it lmk!

Hi all,
So I have been working in a Tier-less SOC/MDR center for a few months.
Recently I was a part of an IR procedure and it's definitely something I want to pursue and develop in my career further on.
Prior to starting my position, I completed the Practical Windows Forensic offered by TCM and I figured that this is why I was able to add value to an IR procedure as a pretty new analyst.
Currently I'm am studying the Incident Response learning path by LetsDefend.

I was thinking about going after a more popular and comprehensive certification like GCFA or GCIH.
As I understand GCIH is more of a high level on IR and GCFA is more focused on Forensics but has Incident response and threat hunting subjects in it.
Based on the knowledge I have know, can I skip the GCIH and jump straight to GCFA or is advised to do GCFA first? doing 13cubed windows forensics and then the GCFA is also something I am considering.

I'm looking for some advice. I have a background in cyber but mainly infrastructure/application.

I tend to start learning with free resources and have developed a recent interest in forensics, particularly mobile forensics. Can you recommend any learning resources that are up to date and use practical examples as much as possible?

Here is the situation: I have a windows HP laptop for an exam. It was PIN code protected (which I have), but bitlocker was disabled. I used Paladin to image the device, so I disabled secure boot in the BIOS and proceeded to obtain an image of the drive. When I turned off the laptop and rebooted, I received a message advising that I needed the Bitlocker encryption key to continue.

I then proceed the image in Autopsy and it alerted me that the image was bitlocker encrypted. I then loaded the image into Arsenal Image Mounter and it also alerted me that the image was Bitlocker encrypted. So I ended up with an encrypted image from a computer that did not have Bitlocker enabled

From what I have gathered so far, the changes to the BIOS setting initiated Bitlocker. Does anybody know if this is accurate?

Secondly, the device is now encrypted and we have no idea what the Bitlocker key is given that it was never configured in the first place. I am hoping that they key may be recoverable via the owner's Microsoft account, but the account appears to be locked right now.

Has anybody had a similar experience? Does anybody have advise for recovering the Bitlocker key? In retrospect, I guess I could have manually enabled Bitlocker prior to the imaging, but I did not want to change any data prior to the exam. Is this now best practice for Windows PCs with TPM chips?

Any guidance would be appreciated!

If you had to do it all again and take just four courses, what would they be?

How are you guys finding time to do trainings/research/courses when your job doesn’t prioritize this? I am finding it difficult to be overloaded from 8am-6pm and then do more “work” after work. Just looking for anything that could make it easier to work it in because I feel like I’m losing my forensics knowledge working in cybersecurity. If the answer is “just do it” that’s okay too, but I figured it was worth asking. TIA

The Forensic Focus Investigator Well-Being Survey 2024 (https://www.surveymonkey.com/r/KW6SYZ7) is closing soon - please take this opportunity to make your voice heard.

By taking part, you will be able to share your experience of the availability of mental health support for digital forensic professionals, voice your strategies for managing work-related stress, and help shape a confidential online space specifically designed to improve the well-being of the digital forensics community. Responses will be treated in the strictest confidence and can be submitted anonymously.

We have already lost too many investigators to the harmful effects of dealing with traumatic material - as an industry, we can and must do better to protect those who see and hear the very worst things imaginable. Please take five minutes to contribute to this important survey, thank you.

Hey guys. I was wondering if anyone knew where some test images or mock cases existed to load into Autopsy directly? I have been messing around with it, and don't have much experience with it. Most of my experience is AXIOM from college. I tried adding the python file for the .ad1 extension, but I was unsuccessful. If someone knows how exactly to add the extension to read .ad1 files in Autopsy, I would be GRATEFUL to be able to get it working.

I have .e01 files from cases we did in school, however, something seems to always go wrong and it doesn't seem to parse the information correctly. The case I worked on that has the most information is the .ad1 file. I have read people talking about mounting the drive in FTK Imager and then loading it into Autopsy, but I am not at all sure how to do that, as we didn't delve into FTK too much.

Anyways, if anyone can be of ANY help, I would appreciate it! Thanks so much!

Edit: When I DO try to mount with FTK and process it into Autopsy, this is the error I get: https://imgur.com/a/nTPAd73

Hello,

I am a non-native English-speaker and I am trying to find a tool to remove the metal shield which is covering some of the ICs on this mobile phone's SoC.

Now I don't actually know what the English word or professional term for the metal shield is;
Shim?
Heatshield?

What I've found is basically extremely thin and sharp knives which are called something like "IC NAND Prying knife pry shovel".

Picture from: inmobile.ir

Thanks!

Hi all, I have a passing interest in computer forensics and from time to time try building one what I know when i come across drives. I have a 4tb hdd i picked up and on plugging it in, there's no readable partitions or structure. however using a few tools it looks like there is something there but i can't figure out what exactly. i'm assuming this is a compressed or encrypted disk? neither cryptsetup or dislocker suggest anything encryption wise.

fdisk output is:

Disk /dev/sda: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors
Disk model: ST4000NC001-1FS1
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x8bb20307
Device     Boot Start        End    Sectors Id Type Start-C/H/S   End-C/H/S Attrs
/dev/sda1           1 4294967295 4294967295 ee GPT        0/0/2 1023/255/63 

mmls:

GUID Partition Table (EFI)
Offset Sector: 0
Units are in 4096-byte sectors
         Slot     Start                End                Length            Description
000:     Meta      0000000000   0000000000   0000000001    Safety Table
001:     -------   0000000000   0000002047   0000002048    Unallocated
002:     Meta      0000000001   0000000001   0000000001    GPT Header
003:     Meta      0000000002   0000000005   0000000004    Partition Table
004:     000       0000002048   0976752639   0976750592   
005:     -------   0976752640   0976754645   0000002006    Unallocated

blkid:

/dev/sda: PTTYPE="PMBR"

however, looking at the first few sectors in hexdump shows EFT partition headers at the start and end of the disk but then large blocks of seemingly random data without much immediately obvious readable text.

at 400 bytes in there's a protective MBR pointing to LBA1 for the GPT partition. at offset 4096 i have the GPT header which seems to check out and points to LBA2 for the partition entry. the partition type looks like from what I can find just a generic Linux data partition(AF3DC60F-8384-7247-8E79-3D69D8477DE4)? then there's the partition GUID, and start/end LBA however there's nothing after that:

hexdump -C --skip 8192 --length 128 /dev/sda
00002000  af 3d c6 0f 83 84 72 47  8e 79 3d 69 d8 47 7d e4  |.=....rG.y=i.G}.|
00002010  19 f3 3e cd fa 9f 77 4b  ba e3 7d 3d 89 34 08 bc  |..>...wK..}=.4..|
00002020  00 08 00 00 00 00 00 00  ff 0f 38 3a 00 00 00 00  |..........8:....|
00002030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

if i go to the start sector and come in 1kb, there's some data. another 128b there's a path name, "/run/media/person/8a96ab36-c74f-4490-b96f-a3582774f641". after that it's mostly empty data but after a bit there's like 10 to 12mb of obvious repeating patterns about 2mb in size, incrementing byte sequences where the first couple bytes of the data match some of the digits of the address, etc. after that it's large blocks of seemingly random data separated by blocks of zeros until the backup GPT header at the end of the disk.

edit: i forgot to mention, when running it through Autopsy, it breaks out into 3 volumes all unallocated space, vol1, 4 and 5. vol1 and 5 are empty. vol4 has a lost+found directory and a file named "test" of size ~1gb, all with timestamps a few days before i got the drive. it does carve out some "files" but i suspect they're false positives and matching on the signatures that happen randomly. they're almost all swf, mp3 one diskimage and some other random extensions.

Hello everyone,

I'm currently facing a phenomenon that I’m hoping to get some insight into. I have a smartphone backup (done with Cellebrite Premium) that I’m analyzing, and this issue seems to occur on both iOS and Android systems. I’m using version 10.3.0.3169 of Cellebrite Physical Analyzer as the viewer.

Here's the phenomenon I'm encountering:

In the Timeline view, I see chat messages appearing from various messaging apps. However, these messages don’t show up under “Analyzed Data / Messages.” I’m looking for possible explanations for this discrepancy. Why are some chat messages visible in the Timeline but missing from the Analyzed Data section?

The reason this is significant is that if I were to perform a selective extraction on an app (e.g., WhatsApp), I could potentially miss important information if certain messages only show up in the Timeline and not in the main message analysis area. Perhaps I've been at my desk too long and am overthinking this, but I'm not seeing a clear explanation.

Has anyone else encountered this? Any insights would be greatly appreciated!

Is there is a way to check if files from usb has been copied to other devices? I don’t mind paying experts to do it if it’s possible to find out.

Hi guys!

Has anyone here passed the CHFI v11 exam? And if so, what exam question website did you use to prep yourself?

Thank you!

Hi ,

Has anyone encountered a similar issue? One of our colleagues plugged an external hard drive into his work laptop, which requires BitLocker encryption. The encryption process was taking longer than expected, so he unplugged the drive before it was complete. Now, every time he reconnects the drive, it prompts for a BitLocker recovery key/password.

We've confirmed with IT that the encryption process was not successful. Is there a way to remove or bypass this? Would tools like Hiren’s BootCD be useful in this case?

Thanks in advance for any insights!

Hello all!
I really need help with the platform Autopsy, it's a super in-depth platform and I am struggling to find content that covers the assignment I have been given and problems I am facing.

Without being too long, I have to perform a DFIR on a "USB" (a download - not a physical USB) where there may not be any issues. The report has to be written regardless of issues.

I am currently running an "Ingest module" on the disk (only targeting areas outlined in the assignment) but it has gotten stuck on 97% and will not progress. I have given it an hour just incase it was a larger file and taking a while to process, but after looking at the log it says: "WARNING: Error with file [id=XXXX] _ORUBA.NSH, see Tika log for details...".

The file it has been stuck on is "Unalloc_" followed by a bunch of numbers, I think it being unallocated means it would be alright to skip, but I'm not sure how to do this.

I'm super confused, this is my first unit on digital forensics, and this assignment is a complete curveball from the content we've been studying and experience we've had..

I'd really appreciate any help!

Thank you in advance :D

I am conducting an examination of a Windows 11 hard drive and found several suspect images only in the thumbcache_1024.db folder. When I filter by hash values I found multiple copies of the same photos with different thumbnail filenames. My initial thought is that the same image was downloaded and deleted multiple times before the final copy was deleted. Has anyone seen anything similar or can anyone suggest a method to determine what caused this?

Hi I'm a aspiring DFIR analyst. I'm wondering if some of you have read all the recommended books found in the FAQ ? I keep hearing how the field is continuously evolving yet these are more than 10years old.

How relevant these are for the field as of today and if there's any updates?

Hal Pomeranz provided a link to all the vmdk files for his forensic VM lab :

: https://archive.org/download/HalLinuxForensics/media-v3.0.2/LinuxForensicsLabVM/

Here are the steps I followed to open this in VMware, but I keep encountering an error message. Any advice would be much appreciated

https://preview.redd.it/pbh6krn4hsyd1.png?width=668&format=png&auto=webp&s=958466434d958fd2258f2ba0b3b91f5e9e1ed2d0

https://preview.redd.it/mf5440o4hsyd1.png?width=898&format=png&auto=webp&s=55ce0693fc355595b2835b66addbfdfb22ba6f4a

https://preview.redd.it/boc1mgn4hsyd1.png?width=688&format=png&auto=webp&s=28ef4a8052dfb26846e832fd104abe785f711bd7

https://preview.redd.it/527wbap4hsyd1.png?width=541&format=png&auto=webp&s=cd160eb682e29941d8b8a9d7b48d884592a8192f

https://preview.redd.it/pqdcbhn4hsyd1.png?width=637&format=png&auto=webp&s=980929907bf40aa6f8188cd49067de3189205b2c

https://preview.redd.it/jsyienn4hsyd1.png?width=1259&format=png&auto=webp&s=1671d166401a5900160a49611b5a9b14414593b8

https://preview.redd.it/o5xz8ho4hsyd1.png?width=465&format=png&auto=webp&s=b33cbf081b64006ed686f6d13ffbf96dcaeb2f4d

I'm stuck on an investigation. I've got tons of evidence about WHAT happened after she opened a remote support session with a malicious actor, but I can't find WHY she opened it. Nothing in email or teams. No other web sites with a chat function were opened. I'm spinning my wheels here and could use a pointer or two to get my going down a different direction. Unless it was completely out of band, like a phone call or something.

I've decided this field is for me after taking a computer forensics course. I would like to apply for an internship doing something related. Are there any (low cost) certifications, or projects I could do? Hopefully using Autopsy. Any forensics-focused CTFs would be good to know as well.

If you have experience with parsing logs, i beed your help as i am building a tool that parse windows logs to csv or txt files

I can't wrap my head around it, has volatility3 been left for dead to be replaced by memproc fs or something else? Is there a plugin that fixes all the output issues among all the features it lacks from volatility2.

I am by NO means super intelligent (im pretty dumb), but I could make a new version of volatility in a month with no output issues, a way easier setup, all the plugins from vol2 and more (I might do this to learn memory forensics better)

Essentially I am asking if I am missing something or should I make a plugin that fixes all the problems with volatility3?

I ordered my new machine for processing cellphones today, built to the optimum specs for Cellebrite Inseyets , hopefully it handles it well cause it was 3x the cost I had initially planned to replace my cell phone machine with. The old machine didn't like running PA 8 so I have been stuck on the 7 Track till the new machine arrive.

Hi All- someone sent me a pdf file with the creation/modification properties listed as today, while claiming it was sent weeks ago. I need to know if this file was actually created weeks ago or if it was created today. Is there a free tool I can use to determine the date of the file's actual creation? Thanks

I'm learning how to use arsenal and attempting to mount a newly created image.

Here's my setup:

Ubuntu Bare metal machine hosting a W10 VM (Vbox) and creating an image with FTK

W10 OOBE with C:\ <-- image created of this disk (Vdisk)

D:\imgs\ <-- img will be placed here (Secondary Vdisk)

the image is mounted read only and is "online" but shows uninitalized in disk management.

Here's some hopefully helpful info:

https://preview.redd.it/7fx92z2xfwxd1.png?width=752&format=png&auto=webp&s=86c8e5ecb0d632ee8abca5d7b88dcb287b9f010e

https://preview.redd.it/c5mgcs3xfwxd1.png?width=988&format=png&auto=webp&s=f76f6e1472323ff6f937e273850048849747192e

https://preview.redd.it/g5y9513xfwxd1.png?width=673&format=png&auto=webp&s=273373dc288e63d7af2a1a0d283c9860fd6d30be

I read on the FAQ (for mounting read/write disks) that read/write mode is required for vm launching virtual machines, im not sure if that applies here, the core forensic feature is the read only mode (for the learning module im doing) and if i recall i was unable to get the disk to mount in either mode

Arsenal is being run w/ elevated permissions.

Any help appreciated

edit: image mounts fine in FTK

I need to extract the SMS text messages from a Samsung Galaxie Note 10+. I have a Magnet Axiom extraction from a year ago but I now need to access and print relevant SMS messages for the last year and do not have access to Axiom at this time. I have a backup of the phone in Google Drive and Samsung Cloud as well, as the text messages are currently still on the phone. I am looking for advice on any free software to extract the messages from the phone or backups or a way that isn't too expensive. I cannot justify the price of Axiom for such limited use. Any help or recommendations would be greatly appreciated.

Is it easy to transfer between Police Digital Forensics (specialise in phones but have some computer background) and private company incident response? What skills are needed to transfer? What should I train up on?