I received an iPhone yesterday that was suspected to be stolen.  Proving the suspicion was another matter.  The was found to have data (phot...

I've spent a bit more time study the NSRL problem.  It is a fantastic but unwieldy database of hash values that is under utilized (at le...

Background I've been trying to extend Sleuthkit in a variety of ways, such as by adding a table to the Sleuthit databese to capture fi...

I have been examining numerous computers and media cards to support fraud investigations in the past year.  One group of thieves has been in...

In the past few weeks, I've had the opportunity to make forensic disk images of what one might call "non-standard" devices.  T...

I previously posted about parsing iPhone SMS database .  The particular focus was the recovery of deleted messages.  I explained there are r...

I recently examined a Macintosh computer where I needed to look at Internet History.  The only installed browser was Safari, and the history...