Tuesday, March 10, 2009

Linux Sleuthing is Born!

I'm moving my content from slo.sleuth.googlepages.com to this blog to make updating and searching for old content easier. Hopefully, I'll even post more often and get some good feedback from the community!
at

Time Perspective

Telling time in forensic computing can be complicated. User interfaces hide the complexity, usually displaying time stamps in a human reada...

  • Cashing in on the Google Chrome Cache
    The Google Chrome cache represents a challenge to forensic investigators. If the extent of your examination has been to open t...
  • Parsing the iPhone SMS Database
    I was asked recently to help recover deleted messages from an iPhone SMS database.  Conveniently, this is called "sms.db" on the i...
  • iPhone: Recovering from Recovery
    I was attempting to brute force an iPhone 4 passcode for data recovery. The phone was in poor condition and had undergone modifications:...