DFIR Community Hardware Fund
A few days ago, Alexis Brignoni posted a tweet about the increased usage of the Meta Quest 2 hardware. It’s one of many devices that digital investigators wi...
Recent posts
Starting a New Digital Forensic Investigation Case in Autopsy
This is a mini-course on Autopsy. You might want to see the description on YouTube for chapter links.
A more efficient NSRL for digital forensics
A few days ago, Hexacorn released a blog post taking a look at the NSRL RDS hash set. I’m a total fan of hash sets. I think they are one of the easiest ways ...
DFIR filesystem POSIX gotcha - process from archives directly
I worked on the converter UFDR2DIR and ran into some weird bugs. I coded on Linux and had no trouble reconstructing Android and iOS device dumps paths. But W...
Convert UFDR to DIR
In a prior post we tested parsing a Cellebrite Reader UFDR file directly with ALEAPP. Although ALEAPP could process the file if we renamed it with a .zip ext...
