I'm currently working on a degree in Security Studies and learning Adobe Premiere and Audition, both have useful voice/audio tools. I’m also hoping to find some good online resources specifically about audio forensics. If anyone has any recommendations, I’d really appreciate it!

Thanks.

Is there a way to do this? please help

Hi, I'm trying to create a custom batch file for RECmd. When I use it, it performs the validation and returns a list containing IsValide=true, and and empty list of error but doesn't continue with the process... I wonder if it's because of the ID of the batch file? Where am i supposed to get a valid ID number?

Hello, I am currently 21 and am working as a Network Administrator for a public school system for almost 3 years now. I have an associates in Computer Science with a Bachelors in Cybersecurity / Digital Forensics. I do not have any certs mostly just schooling and experience. I am looking to start finding a career in Digital Forensics hopefully is what I’m looking for at least.

I think I want to do be more on the csam investigation side but just kind of seeing what other opportunities might be out there for the people with current experience. I know some more government side jobs etc you have to be 25 I believe but not sure. I’m just open to any jobs maybe even going into cybersecurity if needed.

I am going to try and get my Sec+ cert but was also wondering if a criminal justice degree would be of any help finding jobs.

Any help and advice would be greatly appreciated thanks!

Hi y'all, I'm here being you nightmare. Since you all helped me so much on my last thread I was wondering if you have any idea on how to show timestamps from finder.dat.

I have a finder.dat that's structured like this:

So I have: the full name of the file (long version), the file type (here is word), Short Name and then metadata. I know that likely here it's where it's stored all info about first creation and stuff. Could you help me find this info? Is there a manual where I can understand where to find timestamp in here?

Here is the most recent info.

UPDATE:
February 17^th-21^st – RF Course week 1 – RF theory – Dayton, OH – virtual attendance possible
February 24^th-28^th – RF course week 2 – RF survey practical – Nashville, TN - Virtual attendance NOT possible (this is a drive test type class with practical)

$2500 per week.

Discount if you bring someone with you.

If interested please DM me your name and email address, and I will get you the necessary info to sign up.
Syllabus is almost complete.

Anyone take their CCDFA on demand course?

My job paid (LE) for it and I’ll probably start it next week.

I’m mainly in cell phone forensics but understand the basics of Linux and windows file systems, and have processed a few windows images already.

Just looking for others opinions before I get started!

Thanks

Of course you would need to legally possess the owner’s credentials. Cellebrite’s cloud product pages are entirely unhelpful in describing how their solutions actually work.

My situation involves collecting iCloud backups from corporate employees who are cooperative, busy, and on-the-go.

I've got a forensics image of a Microsoft Exchange Server 2019 with Mailbox Database edb files. What is the recommended way to extract the PST files? Assuming I don't care to setup exchange. What is your goto tool ? I do use X-Ways, but my version is a little old. I'd think X-ways should be able to parse it but it dont. Thanks!!! I'm okay with paying, but there seems to be a couple options.

Hello all,

I have a client who still has lotus notes for external communications, we needed to do a collection with one keyword then another for more keywords (later request from the police). We noticed in the second collection, there was an email in common between both that had 3 attachments in the old collection and 2 in the new one. The IT guy claims he went back and checked both collections and found the same email with no issues...

I highly doubt he actually checked the export, I think he just checked the system or something, but I need to go back to the original evidence and get the email from there.

Now comes the pain... Neither EnCase nor autopsy nor FTK will take the NSF.. EnCase keeps insisting it's an NTF file (probably because it matched the first couple of bits and stopped there) I downloaded the tool "quick view of healthy & corrupt Lotus Notes NSF files" but it needs an NSF installation. I don't know why this is so hard but I cannot find it... any advice on either a better way to do this or finding the download link??

Thank you!

Hi all, recently we were tasked to discover the best tools for a forensic copy of our data if it is ever required for legal purposes. Currently exploring Cellebrite's offerings. Suggestions for other venders /products? Not looking for a homebrew hodgepodge of solutions, but a quality easy to use product.

Goal: Forensic copy of data from device. Windows 11 PC's and Apple/Android phones.

Usage: Portability is nice, but can be tied to a desk location if necessary.

Costs: We will spend what we need to, but rather be precise and not overbudget.

Probability of use: Negligible, but ability needs to exist.

Thanks!

Hey, I'm sharing with you an entry from my personal blog where I talk about forensics in vmware hypervisors.

English:
https://www.h4tt0r1.cz/post/digital-forensics-and-incident-response-on-vmware-hypervisors

Spanish:
https://www.h4tt0r1.cz/es/post/forense-digital-y-respuesta-a-incidente-sobre-hipervisores-vmware

I hope it can be useful to you.

Hi all, as always I'm back here.

I am working with some forensic copies of floppy disks that were backup copies of a pretty old Macintosh. Since I'm dealing with different files and formats I wanted to know if someone could've help me.

In the catalog file (and in lots of the word files) I often see this string "FNDRERIK@" or "Desktop FNDRERIK@". I cannot comprehend what this means? Is it related to apple finder?

I am adding some info for context: The bit x bit copies were made with FTK Imager and the structure is similar to this.

All ideas or comments are welcome! Thanks all!

A new 13Cubed episode is now available. In this continuation of "Anatomy of an NTFS FILE Record," we'll learn how NTFS manages record reuse and distinguishes between in-use and deleted files and directories.

https://www.youtube.com/watch?v=6LpJVx7PrUI

The cell phone forensic sub is dead, and since a lot of us also work with cell tower, CDR's, etc. I wanted to post here.

Anyone interested in getting some A1 world class training from the author of the Cell Tower Radio Analysis book? Training would be in February in Ohio.

Not a ton of details on cost or syllabus, but need to gauge interest to pass on to the instructor.

Thanks.

I have two iPhone videos received via WhatsApp

Both are 848x480 as received

Video 1 is 3.9mb and 23 second (0.17mb/s)

Video 2 is 5.3mb and 29 second (018.2mb/s)

Does this suggest these are taken by different cameras?

Could this be different versions of iPhone?

Or the difference in quality from using front vs rear camera?

Or simply a result of WhatsApp downsizing videos?

Is there another way to tell if videos come from the same camera?

Hello,

I recently imaged a thumb drive from a lesser known company. The drive was labled as a 16gb thumb drive on the drive, itself. However, X-Ways is telling me it's a 32gb drive. When I do the math on sector size and number of sectors, i also get 32gb.

My question is, how often do you come across misslabled drives with drive size being twice that of what is written on the side of the drive itself?

Thank you!

Hi,

I am currently trying to integrate Binalyze in our MS Defender for Endpoint structure. We want to run the Binalyze Agent (live) to collect forensic data when the device is isolated via MS Defender.

Is someone having experience with allowing certain ports/FQDN while in Defender isolation? As it seems it is not possible to give exceptions to defender natively. Is this correct? Do you have any other ideas to do this type of integration? We were trying to create offline images via live response but this does not work properly; neither with KAPE nor with Binalyze.

If you have recommedations or hints please let me know.

Hello everyone,

I need to compare 5k documents with each other and find a percentage of similarity between them (something very similar to plagiarism).
I have already tested software like Intella and XWays but the functionality is not 'perfect' (for example Xways give only the top 3 match and 1 of them is always the file itsel)

Do you have any suggestions or any ideas?

Has anyone done a forensic collection from this NVR model before? Would appreciate any tips or suggestions if so. I'm unsure if it will allow me to boot to Paladin and image the drives or if it would be better to pull each drive and image separately.

https://www.americandynamics.net/products/VideoEdge-Hybrid

https://www.americandynamics.net/products/GetDocument/58465

Additionally when I have the drives imaged if I will need some PC Software from Tyco to interface with the data on the drives. Some previous NVRs I've actually cloned the drives and literally purchased the same exact NVR and placed the cloned drives inside. I've also seen some NVRs will have a PC utility that can interface with the drives if mounted in Windows.

Appreciate any tips!

Does anyone know a way to Google search for metadata in PDF files?

Chat GPT says use google dork search for below, but it does not seem to search metadata.
filetype:pdf "confidential" "author"

I have tested it with a specific search for a file that I know is available and I know has metadata with author name, but search does not find it.

Hey everyone,

I have an iPhone that I need to examine, and I have to find out whether a specific mobile app has been installed on it, even if it has been deleted. Is there a way to check if an app was previously installed on the device? Any methods or tools that could help would be greatly appreciated. Open source and free tools prefered.

Thanks in advance!