Digital forensics is the work of finding, preserving and examining evidence on computers, storage media and networks. These notes cover the practical side: where artefacts live, how data can be recovered, and how the tools used to collect and analyse it work. The posts in this category are listed below.
Something I came across recently in an incident response engagement was the potential use of "Cipher.exe". Let's take a look at how it works. The testing site is on an exFAT USB but in-depth analysis regarding the exFAT process of deleting files etc will not be discussed today but more so focussed on what Cipher.exe does to the file instead.
File carving refers to a process used in Digital Forensics to recover data from a file system which has typically been deleted. File carving can be automated using software or done so manually. The sign of a good Digital Forensics practitioner is the ability to do this manually or at the minimum understand how this process is carried out when using forensic programs that can do it for you.
The idea of this article is to provide an overview of FTK Imager and some of the features it has and how to use them. You can download FTK Imager for free from https://accessdata.com/products-services/forensic-toolkit-ftk/ftkimager and view the documentation at https://support.accessdata.com/hc/en-us/articles/204056525-FTK-User-Guide.
I'm guessing you already know what it is if you are here but I like to keep these articles as informational as possible for everyone interested to read them.
The idea of this article is to provide an overview of Wireshark and some of the features it has and how to use them. You can download Wireshark for free from https://www.wireshark.org/ and view the documentation at https://www.wireshark.org/docs/.