A Picture can be Worth a Thousand Words Sometimes there is no substitute for booting a computer to gather data.  But the forensic conseque...

There are two ways to skin this cat... but one is much better! A colleague was looking for help parsing a Android mms/sms database (mmssms...

A brief history... In the summer of 2009, I created a forensic boot disc primarily intended for preview examinations of digital media call...

The MS Windows recycle bin differs in Vista from XP. In XP, an deleted file is moved to the "\Recycler\$SID\ folder where "$SID...

Computers, iPods, Thumbdrives, oh My! I've been busy with a major case during which many smaller cases have walked through my door. I b...

iTunes is your friend I have gone from years of computer forensics without ever encountering Apple Products in any meaningful way to seemi...

Identifying Deleted User Accounts in Windows I was recently presented with three laptop computers suspected as stolen. My task was to iden...