Another Forensics Blog

As a follow up to my post on how to mount AFPS images on Windows, I wanted to post about how to mount an APFS image on a Linux system. If y...

APFS is the new file system for Mac OS, and so far, many forensic suites are playing catch up as far as support goes. As such, workarounds m...

PowerShell. It's everywhere. I've started coming across more and more malicious PowerShell scripts. Why do attackers love us...

Logs, Logs, Logs. I see, IPs. When reviewing log files for suspect activity it can be helpful to look up information related to IP addresses...

Wait, What? Windows lies? I believe so... I worked a case where I checked the Windows Install date and it was a couple days before we rece...

Earlier this year at the request of a reader I wrote a tool to parse the Quicklook thumbnails index.sqlite file. This sqlite database sto...