Western Digital HDD
The latest and greatest update in Nintendo Forensics is out, EnCase version 7. Watch the free training videos.
Read More
EnCase - WinRAR Archives
Use a hex editor to modify the file signature of a WinRAR archive to that of an executable file to beat the EnCase forensic software's file signature analysis.
Read MoreWestern Digital HDD
I've dug around a bit and found some older examples of software that will detect whether or not the current system is being run in a virtual environment. The main purpose here is to trip up the examiners. Make them waste their time, their clients time and everyone elses. Make the costs of a computer forensics examination even more expensive.
Read More
Timestomp Being UPX'd
There have been a million articles written on using timestomp.exe. However, the goal of this article is to give some ideas on how to use timestomp and avoid leaving evidence behind that would point to its use.
Read More