Digital Forensic Scientist

less than 1 minute read

Gearing up for the official Alpha 2 release of REAPER Preview here is the change log and feature list:

Back-end:
  • REAPER Preview no longer loop-mounts suspect drives. All data is parsed directly from the raw disk. This not only faster, but we also do not need to worry about the issues talked about here.
  • Suspect disks are still set to read-only at the block level
  • Back-end is structured in a much more modular way. Programmers could easily insert a certain tool into the work-flow, if necessary
  • Preset automatic keyword searching
  • Preset automatic hashdb searching
Front-End:
  • Whole code re-write. Front-end is now completely modular. Add or remove items with a simple include
  • Triage profiles supported! Will explain the concept of triage profiles in the next single
  • Greatly-improved Image/video gallery from Dynamic Drive implemented. The automatic image gallery I wrote was not powerful enough, and theirs is very nice. (Video previews are currently not working since the back-end switch).
  • Manual file-name and full disk keyword searching now available
  • Improved session logging (non-persistent)

You may also enjoy

iLEAPP and RLEAPP updates and dev thoughts

Alex (@kviddy) has been pushing some extremely useful updates to the open-source Android forensic tool - [ALEAPP](https://github.com/abrignoni/ALEAPP]. Speci...

What data can you find in RAM?

To determine if you need to collect Random Access Memory on-scene, it is useful to know what kinda of investigation-relevant data is often available in RAM.

Modular artifact scripts coming to iLEAPP

kviddy has been pushing some great core updates to ALEAPP. Specifically, artifact scripts are now self-contained. This means that script authors no longer ne...