Archives For September 2011

“Companies should not be behaving like supercookie monsters, gobbling up personal, sensitive information without users’ knowledge.”

– Ed Markey, Co-Chairman of the US House Bi-Partisan Privacy Caucus, calling for a FTC investigation into the increasing use of “supercookies”.

FTC Asked to Investigate Supercookies

Note: This post originally appeared on the SANS Forensics blog

Daunting as it may seem, one of the most wonderful aspects of Windows forensics is its complexity.   One of the fascinating aspects of digital forensics is how we often leverage conventional operating system features to provide information peripheral to their original design.   One such feature is the Windows NTFS Index Attribute, also known as the $I30 file.  Knowing how to parse $I30 attributes provides a fantastic means to identify deleted files, including those that have been wiped or overwritten.

Continue Reading…

How big is a Zettabyte? Continue Reading…

“The computer that allowed us to stare in wonder at the world has allowed the world to stare pitilessly back at us.”

Paul Theroux from How Apple Revolutionized Our World

How Apple Revolutionized Our World

Since I do a lot of teaching, I make a point of keeping tabs on the latest job trends in digital forensics.   I like to be versed in what qualifications, experience, and certifications are most important to employers.  Hence when recruiters call, I pick their brains and often try to help them find a good candidate.  I was recently contacted regarding an intriguing job.  The job title is Director of Content Authenticity and it is a digital forensics role that I hadn’t previously considered.

Continue Reading…

$I30 (NTFS INDEX Attribute) parser from @ <- Awesome!
Chad Tilbury

“The Windows Mobile operating system is clearly sending information that can lead to accurate location information of the mobile device regardless of whether the user allowed it” 

— Samy Kamkar

Windows Mobile Geolocation Collection

Consortium for Digital Forensic SpecialistsAugust was a busy month for CDFS, with the official launch, introduction of the website, and open membership enrollment.  Membership is growing fast and, if the mailing list is any indication, the organization is already working to support the digital forensics field.   Why should you care?  Here is what a student of mine from Texas had to go through just to have the privilege of continuing to practice forensics.

As most of you are aware, multiple states have enacted legislation to require private investigator licenses for those conducting digital forensics.  My colleague had a successful, long standing forensics practice in Texas performing data recovery and forensic investigations.  Continue Reading…