Week 17 – 2018

There were a few more requests for votes for Forensic 4Cast Awards.


  • Hideaki Ihara at the Port 139 blog posted a couple of times this week
  • James Habben at 4n6IR demonstrates how to view a files owner permissions in EnCase, and then how to filter all files for a specific or list of owners.
    Show and Search for NTFS Owner in EnCase

  • There were a couple of items on the Cyber Forensicator blog this week
  • Oleg Skulkin and Igor Mikhaylov at Digital Forensics Corp show how to manually acquire a Facebook account. The comment about the process not being forensically sound is interesting; yes, you are making changes to the account to obtain access to it – however, you are also obtaining the data directly from Facebook. Once you download the data you can hash the download to ensure its integrity throughout your examination. If questioned, you’re able to say that “this is the data downloaded directly from Facebook’s servers”. I think it’s as valid as using a forensic tool to acquire the data, however, the forensic tools allow for better searching and reporting. Ultimately you will have to provide a statement to the court to explain what you’ve done, and when you’re dealing with cloud data, I think that take-out features should be considered a viable alternative to downloading data via the API.
    Cloud Forensics: How to acquire a Facebook account

  • Alexis Birgnoni at ‘Initialization vectors’ looks at the Flud Android Torrent application.
    Torrent Applications in Android – Flud Torrent Downloader

  • Magnet Forensics have released a new whitepaper on the skills that you should develop to master mobile app forensics.
    White Paper: 10 Skills You Need Toward Mastering Mobile App Forensics







And that’s all for Week 17! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!

Due to a couple of requests, I’ve also created a donations page for those that didn’t want to support through Patreon.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s