Microsoft’s Xbox game console can be modified to run additional operating systems, enabling it to store gigabytes of non-game related files and run various computer services. Little has been published, however, on procedures for determining whether or not an Xbox console has been modified, for creating a forensic duplicate, and for conducting a forensic investigation. Given the growing populari...

Computer hard drives often contain evidence that is vital to digital forensic investigations. However, an authenticated working copy or “forensic image” of a suspect hard drive must be created before any data can be analyzed. As the capacities of modern hard drives increase, the time taken to create a forensic image, let alone analyze the data, increases significantly. This paper investigates t...

§13.1 The Forensic Sciences §13.2 The Admissibility of Forensics-Only Science §13.2.1 “General Acceptance” in Forensic Science Should Not Be a Sufficient Condition for Admissibility §13.2.2 “General Acceptance” in Forensic Science Should Not Be a Necessary Condition for Admissibility §13.3 Trace Evidence and Identification §13.3.1 Matches, Non-Matches, and Hypotheses §13.3.2 Exclusions §13.3.3 ...

Digital forensic tools are being developed at a brisk pace in response to the ever increasing variety of forensic targets. Most tools are created for specific tasks–file system analysis, memory analysis, network analysis, etc.–and make little effort to interoperate with one another. This makes it difficult and extremely time-consuming for an investigator to build a wider view of the state of th...