Forensics Xplorer

Musings on Digital Forensics and Incident Response

Tag

Forensic Analysis

Volume Shadow Copy Service – Well, What Do We Know

Sticky post

This is a second post in a series on Volume Shadow Copy.  A quick recap on the previous post shouldn’t hurt much, we discussed that VSCs are a valuable artifact and how significant are they for forensic investigators as they may contain evidence data that… Continue Reading →

2016/03/21 0

The Return of Recycle Bin

This is a long overdue post about Windows 8.1 & Windows 10 Recycle Bin. This post along with few others that I've researched on has been in the drafts for quite a period of time as I was busy with EnCE prep… Continue Reading →

2016/02/27 1

Categories

CheatSheets (2) Forensics (9) Mobile Forensics (2) Python (1) Scripting (1) Tools (4) Uncategorized (3)

Top Downloads

NTFS CheatSheet
158.76 KB - 7 Download(s)
Recovering deleted data from the Windows registry
355.37 KB - 5 Download(s)

Downloads

MBR GPT CheatSheet (c) Michael Wilkinson, Download File
FAT CheatSheet (c) Michael Wilkinson, Download File
NTFS CheatSheet (c) Michael Wilkinson, Download File
HFS+ CheatSheetSANS Download File
General Forensic Analysis ChecklistSANS
Recovering deleted data from the Windows registryElsevier
Using the HFS+ journal for deleted file recoveryElsevier
RegRipper Plugins PackCollection of Regripper Plugins
Browsing History ViewParses Browsing History on the custodian's machine
HexDate Conversion DCodeTool to convert HexDate to Other Formats
sqlparse.pyThis program parses an SQLite3 database for deleted entires and places the output into either and TSV file, or text file
UsnJrnl ParserPython script to parse NTFS transaction log entries from the UsnJrnl alternate data stream.

Visitor Base

© 2019 Forensics Xplorer — Powered by WordPress

Theme by Anders Noren — Up ↑