Blog

Windows 10 Jump List Forensics: When Microsoft released Windows 7, a new artifact was released to the forensic world, Jump Lists.  Since that time most examiners...

With the proliferation of cheap external USB devices, it is becoming incumbent on examiners to determine if any USB attached storage has connected to the...

Next up in our Windows Forensic Essentials Blog Series is a look at Volume Shadow Copies. Looking for other blog posts in this series? We have...

Welcome to the third post in our Windows Forensic Essentials Blog Series. View our previous posts on Jump Lists and the Recycle Bin. Windows Event Logs...

This is the second post in our Windows Forensic Essentials Blog Series. Read our first post on Jump Lists. One of the most overlooked artifacts on...

Knowing specifically what a user has viewed on their computer is part of what an examiner does.  Determining whether or not a user has opened...

When Microsoft released Windows 7, a new artifact was released to the forensic world, Jump Lists.  Since that time most examiners have become used to...

How and where the BlackLight case is stored has a direct effect on performance.  Even the fastest workstation will benefit from this simple concept of...

Update: We have added instructions on how to create an encrypted backup password for an iOS 10 device with MDM profile using iTunes. iPhones and iPads being...

Last week one of our forensic analysts, Bruce Hunter, described the impact of iOS 10 on mobile forensics. In case you miss it, here is quick recap,...