SANS Digital Forensics and Incident Response Blog: Category - Computer Forensics

Computer Forensic Artifacts: Windows 7 Shellbags

As Windows Registry artifacts go, the "Shellbag" keys tend to be some of the more complicated artifacts we have to decipher. But they are worth the effort, giving an excellent means to prove the existence of files and folders along with user knowledge. Shellbags can be used to answer the difficult questions of data enumeration … Continue reading Computer Forensic Artifacts: Windows 7 Shellbags


Digital Forensics Case Leads: Massive eDisco Penalty, Dodd-Frank Law and Digital Forensics, It's Not Business, It's Personal

Legal, regulatory matters, and threats to Law Enforcement and members of the US armed forces top this edition of Digital Case Leads. An appeals court uphold a massive penalty against a company for not properly retaining electronically stored information (ESI). If the offending party doesn't cough up over $1,000,000 in penalties, a senior exec from … Continue reading Digital Forensics Case Leads: Massive eDisco Penalty, Dodd-Frank Law and Digital Forensics, It's Not Business, It's Personal


Digital Forensics Case Leads: There Is No Theme

This week in Case Leads, we feature a wide array of new tools and articles that defy classification under any particular theme. You'll find tools forensic image processing and analysis, PDF analysis, and password cracking. News and articles include issues of law, process automation, forensic value, and incident response. Continue reading Digital Forensics Case Leads: There Is No Theme


Book Review: Digital Forensics with Open Source Tools

I was excited awhile back to learn Digital Forensics with Open Source Tools was being written and even more pleased when I heard who its authors were. I worked almost exclusively with open source tools while beginning my foray into the digital forensics world and happily continue using them today, so I knew this book … Continue reading Book Review: Digital Forensics with Open Source Tools


Digital Forensics: Dropbox

Update: Thanks to everyone for the feedback. I'm glad the info is useful and interesting - mission complete here. For everyone who asked about the full article, it's now available on Forensic Focus: http://www.forensicfocus.com/dropbox-forensics Dropbox is a web-based file synchronization and sharing service. While it can be a backup of sorts, it's really geared toward … Continue reading Digital Forensics: Dropbox