Law Enforcement

Shellbags are a set of registry keys that provide retention functionality with regards to Windows Explorer and a system user's activity. Shellbags essentially record when a...

Categorizer For All, or C4All, is a staple tool used worldwide in the investigation of child exploitation media. For those unfamiliar with this incredible resource,...

We recently created a video demonstrating how to image a FileVault 2-encrypted Fusion Drive with MacQuisition, BlackBag's versatile acquisition tool. What appears below is the...

We have some exciting news to share with our friends, customers, and partners.  Effective February 1, we have officially welcomed Vico Marziale and...

One aspect of digital forensics that merits specific attention for today's investigators is Apple's FileVault 2 encryption. FileVault 2 has become increasingly prevalent on OS...

There are many legitimate reasons why someone might wipe an iOS device.  A corporate IT administrator might do so prior to assigning a device to...

What time is it? The time is 3442503385. This number makes sense to our startup chiming Mac machinery (it is a Mac OS timestamp), but we’ve...

One of our top tech support questions is “Are iOS device passcodes different than iOS backup passwords?” The answer is ‘yes’, and this blog seeks...

The BlackLight forensic analysis software includes two very powerful metadata file filters that allow forensic analysts to quickly isolate data on iPhone and iPad devices...

In part one of this blog series, we covered ways a Mac forensic examiner may view .plist files using both Apple and third-party tools. Part...