Author: Phill Moore

I am a digital forensics analyst. I have a couple of blogs - This Week In 4n6 and Think DFIR I go by randomaccess (or variations of) on a number of DFIR social channels.
Written by Phill Moore

Week 8 – 2016

Week 8! Software Updates: Paul Sanderson made an update to Forensic Browser for SQLite with a few bug fixes. It’s now at version 2.7.5 (although the forum post says not yet released) FTK Imager has been updated to version 3.4.2. This update was mainly bug fixes but the major takeaway is that AD1’s are created […]

Written by Phill Moore

Week 7 – 2016

Week 7! Software Updates: DME Forensics updated DVR Examiner a couple weeks ago to 19.0 and I forgot to mention it. Then they released a minor update to 1.19.1 last week (that I also didn’t mentioned, apologies). The latest version adds a few more file systems (bn_MBR, SA_X and SA_x_264, ef_JPG and SSF0_P) and fixed […]

Written by Phill Moore

Week 6 – 2016

week 6 Software Updates: Eric Zimmerman added a few new switches to bstrings (now at version 1.0) to allow a user to specify an ASCII/unicode character range and code page. You are also now able to supply a file mask i.e. *.exe. bstrings 1.0 released! CRU has updated their write blocker testing utility to version […]

Written by Phill Moore

Week 5 – 2016

  Tool updates Harlan has updated the samparse plugin for regripper. I e-mailed him during the week with a SAM file and a request and he had the plugin updated overnight. The new plugin extracts the values that are created when a user has created or link an account with a Microsoft Live account. As Harlan has […]

Written by Phill Moore

Week 4 – 2016

There were a few software updates this week Paladin updated to version 6.08 with a few bug fixes. The release notes explain that they fixed a sporadic memory leak when imaging/verifying EWF and also removed an option for segmenting forensic images. I’m not entirely sure what the current forensic practices they’re referring too but will have […]

Written by Phill Moore

Week 3 – 2016

Super busy week this week! Here we go Berla updated their car infotainment analysis software with a host of new features. A majority of the updates appear to relate to usability, data presentation and formatting. There’s also updates to data parsing for Ford Sync Gen1V5 and Toyota. Beta versions of the iVe Mobile and Connect software […]

Written by Phill Moore

Week 2 – 2016

1. Cru-Inc announced their USB3 usb write blockers. Imaging USB drives and hard drives at usb3 speed is a must; having tried to image 2TB external drives with USB2, I can honestly say this added speed bump will definitely help. Introducing the WiebeTech USB 3.0 WriteBlocker 2. A colleague of mine has started a blog. Hes […]