by Mark Spencer | Oct 30, 2019 | Digital Forensics
BitLocker for DFIR – Part II 0 Comments Mark Spencer October 30, 2019 In “BitLocker for DFIR – Part I” we provided a quick summary of BitLocker, details regarding the various “states” of BitLocker volumes that we see most often in...
by Mark Spencer | Oct 25, 2019 | Digital Forensics
BitLocker for DFIR – Part I 0 Comments Mark Spencer October 25, 2019 BitLocker is a Full Volume Encryption (FVE) technology introduced by Microsoft in the Ultimate and Enterprise versions of Windows Vista. BitLocker has come a very long...
by Mark Spencer | Oct 25, 2019 | Digital Forensics
The Office Document Cache and Introducing ODC Recon – Part I 0 Comments Mark Spencer October 25, 2019 Microsoft’s “Office Document Cache” (hereafter, ODC) is complex, infuriating, and misunderstood. For years there have been digital forensics...
by Arnau Gàmez | Jul 29, 2019 | Digital Forensics
Digging Deeper into Gmail URLs & Introducing Gmail URL Decoder 0 Comments Arnau Gàmez July 29, 2019 Just a month after we published the Insights post “Digging into Gmail URLs”, Google made the use of their new Gmail interface mandatory. The old...
by Mark Spencer | Oct 10, 2018 | Digital Forensics, Registry Files
New Versions of HiveRecon and HbinRecon Launched 0 Comments Written by Mark Spencer October 10, 2018 What does HiveRecon do? HiveRecon extracts Registry hives from Windows hibernation and crash dump files, often extracting hives when other solutions...
by Mark Spencer | Sep 24, 2018 | Digital Forensics
Free Arsenal Subscriptions for Colleges and Universities 0 Comments Mark Spencer September 24, 2018 Years ago when I was an adjunct professor teaching digital forensics at Bunker Hill Community College in Boston I very much appreciated both the free...
