Digital Forensics - dfir.blog (Page 2)

Digital Forensics

A collection of 33 posts

Visualizing USN Journal Activity

Visualizing USN Journal Activity

Since learning about the USN journal, my investigative process has never been the same. It is a powerful artifact that can tell us much about what has transpired on a system. However, the wealth of data that the USN journal brings to an investigation can be a double-edged sword: the

The Chrome history was cleared! Now what? (part 1)

The Chrome history was cleared! Now what? (part 1)

Settings and Bookmarks Ok, so for the sake of this post, let's assume that the answer to the question posed in the previous part ("Was the history cleared?") was yes, it was. That totally wipes out all traces of any browsing activity. Right? Well, not so

The Chrome history was cleared! Now what? (part 0)

The Chrome history was cleared! Now what? (part 0)

First, let's take a step back. Why do you think that the Chrome history had been cleared? Is it because there are no browsing records at all? Gaps in the entries? Records that stop abruptly after a few months? Each of these variations has a potential explanation besides

Chrome Transition Values

Chrome Transition Values

The Chrome transition values are nothing new and haven't changed much through all the different releases of Chrome. They have been discussed in a number of places. However, most of the articles I've seen focus on the meaning of the decoded value and only briefly reference

Detecting Clock Changes Using Cookies

Detecting Clock Changes Using Cookies

The forensics community has found many ways to identify system clock changes; Lee Whitfield's article and SANS presentation are excellent resources on the topic. In his presentation and in another post, Lee mentions that when someone clicks on a G+ link, the user is first sent to a

Deleted File Recovery using foremost

Digital Forensics

Deleted File Recovery using foremost

In this post, we'll use the Linux program foremost to recover files, both existing and deleted, from a .dd image. foremost is what is as known as a data-carving utility. It operates by examining data, bit by bit, and extracting sets of data that meet a defined pattern.

Digital Forensics

Slack Space

Slack space can exist when a file's size is not a multiple of the file system's cluster size. As a little refresher, a sector is the smallest amount of data that a hard drive can read or write at one; in many cases, this is 512

Digital Forensics

Imaging Using dcfldd

In this post, a 128MB USB thumb drive will be imaged on a Linux system using dcfldd onto a 1GB USB thumb drive. dcfldd is an improved version of dd; most of the syntax is identical, just a few functions have been added. As a quick aside, this post is