Tuesday, March 10, 2009

Linux Sleuthing is Born!

I'm moving my content from slo.sleuth.googlepages.com to this blog to make updating and searching for old content easier. Hopefully, I'll even post more often and get some good feedback from the community!
at

Time Perspective

Telling time in forensic computing can be complicated. User interfaces hide the complexity, usually displaying time stamps in a human reada...

  • Cashing in on the Google Chrome Cache
    The Google Chrome cache represents a challenge to forensic investigators. If the extent of your examination has been to open t...
  • Parsing the iPhone SMS Database
    I was asked recently to help recover deleted messages from an iPhone SMS database.  Conveniently, this is called "sms.db" on the i...
  • Android SDK on 64-bit Linux
    I commonly use adb and fastboot to access Android devices.  Ubuntu has packages for those tools making installation easy: $ sudo apt-get i...