Binary-Coded Decimal

Introduction Following on from the release of Digital Detective’s free DCode™ tool, we are compiling a series of blog posts explaining the various timestamp formats available in the new version. In this post, we are looking at Binary-Coded Decimal or BCD. Binary-Coded Decimal (BCD) Binary-Coded Decimal is a system for encoding decimal numbers as a […]

Seagate Hard Disk

During a forensic examination, establishing a timeline of events is usually an important aspect of the analytical process; this may include establishing the manufactured date of a hard disk drive. In a data recovery scenario, this information may be relevant when attempting to identify donor drives for a head swap. Many hard disks have this […]

NetAnalysis Find Panel

The NetAnalysis® Find Panel provides an easy way of searching against visible columns and fields. It is displayed above the grid and contains a search box where the user can enter a search string. To open the Find Panel, use the keyboard shortcut CTRL+F, or select Search » Quick Search from the main menu. Syntax […]

Feature image for Digital Detective's DCode showing hex analysis and timestamp decoding

We are pleased to announce the release of Digital Detective’s DCode™ v5. This useful FREE application has been featured in numerous forensic books and papers over the years, and we have now had the opportunity to add some new features and bring it up to date. The software was designed to assist forensic examiners in […]

DataDump Featured Image

DataDump™ is a free tool which allows you to dump segments of data from an original source image or physical/logical device. It can be used for the following: Extract a stream of binary data from a source image or logical device Convert an entire image or a segment of an image to a single flat […]

Hex viewer showing some highlighted bytes

There are two different methods for describing the order in which a sequence of bytes are stored in digital systems: Big Endian: places the most significant byte first (also known as network byte order) Little Endian: places the least significant byte first Etymology The term endian comes from the novel Gulliver’s Travels by Jonathan Swift. […]

Introduction to Number Systems

Understanding Number Systems Number systems use different number bases. A number base indicates how many different digits are available when using a particular numbering system. For example, decimal is number base 10, which means it uses ten digits: 0, 1, 2, 3, 4, 5, 6, 7, 8 and 9. Binary is number base 2, which […]

Image showing keyboard with the text Understanding Encoding

Introduction to Character Encoding Understanding how Character Encoding works is an essential part of understanding digital evidence. It is part of the common core of skills and knowledge. A character set is a collection of letters and symbols used in a writing system. For example, the ASCII character set covers letters and symbols for English […]

Yellow warning side with black text showing danger

Introduction When using third party image mounting tools to perform the forensic examination of NTFS file systems, it is extremely important to understand NTFS Junction Points so that you don’t find yourself making a critical mistake during your analysis. An issue has been identified with third party image mounting software where NTFS junction points are […]

Front page of the ACPO Manager Guide: Good Practice and Advice for Managers of e-Crime Investigation

Good Practice for e-Crime Investigations Criminal behaviour has shifted to take advantage of electronic mediums and serious and organised criminal networks have become increasingly sophisticated. Corporations, Government departments and businesses now need to invest considerable sums in order to protect their assets and data. Lloyds of London have stated that they are defending up to […]