During a forensic examination, establishing a timeline of events is usually an important aspect of the analytical process; this may include establishing the manufactured date of a hard disk drive. In a data recovery scenario, this information may be relevant when attempting to identify donor drives for a head swap. Many hard disks have this […]
There are two different methods for describing the order in which a sequence of bytes are stored in digital systems: Big Endian: places the most significant byte first (also known as network byte order) Little Endian: places the least significant byte first Etymology The term endian comes from the novel Gulliver’s Travels by Jonathan Swift. […]
Understanding Number Systems Number systems use different number bases. A number base indicates how many different digits are available when using a particular numbering system. For example, decimal is number base 10, which means it uses ten digits: 0, 1, 2, 3, 4, 5, 6, 7, 8 and 9. Binary is number base 2, which […]
Introduction to Character Encoding Understanding how Character Encoding works is an essential part of understanding digital evidence. It is part of the common core of skills and knowledge. A character set is a collection of letters and symbols used in a writing system. For example, the ASCII character set covers letters and symbols for English […]
Introduction When using third party image mounting tools to perform the forensic examination of NTFS file systems, it is extremely important to understand NTFS Junction Points so that you don’t find yourself making a critical mistake during your analysis. An issue has been identified with third party image mounting software where NTFS junction points are […]
Introduction to Blade® v1.9 We are pleased to announce the release of Blade v1.9. This release of Blade® brings a number of fixes and some great new features. This is the first release of Blade® to have evaluation capabilities which allow the user to test and evaluate our software for 30 days. When Blade™ is installed […]
Introduction A frequent question when dealing with browser forensics is ‘Does the Hit Count value mean that the user visited site ‘x’, on ‘y’ occasions?’ Most browsers record a ‘Hit Count’ value in one or more of the files they use to track browser activity, and it is important that an analyst understands any potential […]
Internet Explorer Data As forensic examiners will be aware, Microsoft Internet Explorer stores cached data within randomly assigned folders. This behaviour was designed to prevent Internet data being stored in predictable locations on the local system in order to foil a number of attack types. Prior to the release of Internet Explorer v9.0.2, cookies were […]
Introduction to Userdata Internet Explorer 8+ user data persistence is a function which allows online forms to save a small file to the system with information about values entered in a particular form. This allows the user to retrieve a half filled web based form when they revisit. Persistence creates new opportunities for website authors. Information […]
Introduction to Blade® v1.8 This release of Blade has a number of new features and improvements. We have added 8 new Data Recovery Profiles to the Global Recovery Database, as well as releasing some new Professional Modules. We have released a new 3GP/MPEG-4/ISO Base Media Format Intelli-Carve® Recovery Profile for the recovery of MP4/3GP video files. […]
About Us
Recent Tweets
Binary-Coded Decimal is a system for encoding decimal numbers as a series of bits; we examine how they are used in BCD and GSM timestamps. #DFIR #MobileForensics #DigitalForensics digital-detective.ne…
About 6 months ago from Digital Detective's Twitter via Twitter Web App
Get the manufactured date of older Seagate hard disks by using DCode™ to decipher the Date Code. #DFIR #DigitalForensics #DataRecovery digital-detective.ne…
About 7 months ago from Digital Detective's Twitter via Twitter Web App
The NetAnalysis® Find Panel provides an easy way of searching against visible columns and fields. In this article, we examine the powerful syntax for the Find Panel and see how it works. #DFR #BrowserForensics #ForensicAnalysis digital-detective.ne…
About 7 months ago from Digital Detective's Twitter via Twitter Web App
Support for AVG Secure and Min Browser in NetAnalysis® v2.12 and HstEx® v4.12 along with updated search indexing, improved reports and much more. #WebBrowserForensics #DFIR digital-detective.ne…
About 8 months ago from Digital Detective's Twitter via Twitter Web App
We are pleased to announce the release of DCode™ v5, our free timestamp conversion utility. Now with 60 different timestamp conversions and date/time encoding. #DigitalForensicAnalysis #DFR digital-detective.ne…
About 9 months ago from Digital Detective's Twitter via Twitter Web App
Select Language
Translate our site by selecting your language from the option below.
Contact Us
Digital Detective Group
Motis Business Centre
Cheriton High Street
Folkestone
KENT, CT19 4QJ
United Kingdom
///courts.endearing.bulbs
+44 (0) 20 3384 3587