We had a case recently in which modifications made to a Windows XP Registry, and the impact of those changes on the environment of a particular domain account, were quite important. Digital forensics practitioners on the other side of our case developed their findings on this issue by virtualizing a forensic image obtained from the computer and logging into it with a local account, rather than the domain account in question. Why?
Collecting Quick Look Data From a Live macOS System0 Comments After reading about how to manually analyze Quick Look data, we're sharing with you a method to collect Quick Look data on a live macOS machine so you can test and validate cached data yourself! Check out...
In our intellectual property theft investigations, our clients will often ask us about specific file names they care about, especially when data theft or destruction is suspected. Often these files are keys to the kingdom: proprietary engineering plans, customer...
We are very happy to launch a new version (v2.6.35) of Arsenal Image Mounter (AIM) today! You can get the latest version of AIM (and our other tools) here. We know how popular AIM has become in the digital forensics community (and beyond), so we are continuing to add...
I was asked to take a recent flurry of Tweets and turn them into an Insights post with more detail. So, here goes! We have spent some time at Arsenal looking at particularly important Windows Registry keys which are sometimes only found, in their most recent state,...
Arsenal Image Mounter was born when we found existing disk image mounting technology lacking during the development of our premier digital forensics tool Registry Recon. Since we now have quite a bit of experience being in a position where a powerful disk image...
Join our mailing list to arm yourself with updates about Arsenal tools, training, and research. Our mailing list is double opt-in so you will need to check your email and confirm your subscription before receiving our mailings.
22 Willow Street Chelsea, MA 02150
or (617) 277-3625
Terms & Conditions