Windows Forensics

By: Vico Marziale (@vicomarziale), Senior Digital Forensics Researcher Introduction In the previous posts, Part 1 and Part 2, we have seen that the Windows Activity Timeline (just "Timeline"...

By: Vico Marziale (@vicomarziale), Senior Digital Forensics Researcher Introduction Hello, and welcome back for the second installment of Exploring the Windows Activity Timeline (just “Timeline” from here on...

As Windows has evolved over time several artifacts have appeared that can highlight when programs or applications were executed, and which user executed them.  The...

Introduction Hello everyone! I’m Dr. Vico Marziale (@vicomarziale), Senior Digital Forensics Researcher here at BlackBag. In this installment, I’d like to start a series of posts...

By: Bruce Hunter, Senior Forensic Engineer With the release of macOS 10.12 Sierra, Apple introduced a new form of logging referred to as Unified Logs.  These...

By: Stephanie Thompson, Solutions Engineer While the amounts of data in typical digital forensic cases today is a lot different than it was several years ago, the...

BlackBag is excited for customers to experience the powerful new features added to BlackLight 2019 R1. Are you ready to dive into the improvements in the...

What's the best forensic examination platform? Mac or Windows? We asked our Director of Training, Bob Petrachek, for his expert advice. This blog was updated on 6/1/18. In...

BlackLight 2017 R1 brings improved exporting of evidence to the LACE, Project VIC and C4All data models. By providing integrated support for exporting to these...

The known, safe and trusted hash sets from over 100 Mac OS X, macOS, and Microsoft Windows operating system versions have been updated in the...