Another Forensics Blog

One thing I've learned when it's comes to imaging Macs is it's good to have options. When encountering Macs, its seems like th...

I've always mentioned in my presentations and blog posts that if anyone needs any help parsing an artifact, to hit me up - I love workin...

There is a registry key that keeps track of which documents a user has enabled editing and macros for from untrusted locations. This ha...

The Master File Table (MFT) contains the information related to folders and files on an NTFS system. Brian Carrier (2005) stated “The Mast...

One of the things I love about open source is that people have the ability to update and share code.  Adrian Long, aka @Cheeky4n6Monkey, di...

Through all my high school and college math classes, my teachers always taught me to step back after a problem was completed and ask if the...

Wherever I get vmdk files, I take a deep breath and wonder what issues might pop up with them. I recently received some vmkd files and when...