Column: File Cabinet Forensics

Column: File Cabinet Forensics

Reverse Engineering is the traditional bread-and-butter of digital forensics research. Companies like Microsoft and Apple deliver computational artifacts (operating systems, applications and phones) to the commercial market. These artifacts are bought and used by billions. Some have evil intent, and (if society is lucky), the computers end up in the hands of law enforcement. Unfortunately the o...

File System Journal Forensics

Journaling is a relatively new feature of modern file systems that is not yet exploited by most digital forensic tools. A file system journal caches data to be written to the file system to ensure that it is not lost in the event of a power loss or system malfunction. Analysis of journal data can identify which files were overwritten recently. Indeed, under the right circumstances, analyzing a ...

Column: Putting the Science in Digital Forensics

The Digital Locked File Cabinet: A Problem of Metaphor

Column: The Consortium of Digital Forensics Specialists (CDFS)