Forensics: Implications of Windows Vista

The document attached is entitled Forensic Implications of Windows Vista, by Barrie Stewart.

This is a detailed document about computer forensics and Vista, it appears to have disappeared from easy access on the web, so it’s posted here.  No rights are claimed over this, so if anybody wants this taking off this site, please contact the site.

Windows XP was launched in 2001 and has since been involved in many digital investigations. Over the last few years, forensic practitioners have developed a thorough understanding of this operating system and are fully aware of any challenges it may create during an investigation. Its successor, Windows Vista, was launched in January 2007 and is
fast on its way to becoming the platform of choice for new PCs. Vista introduces many new technologies and refines a number of features carried over from XP. This report focuses on some of these technologies and, in particular, what effect they have on digital investigations.

Read more……


Foreniscs Quizzes are on the move

The following quizzes have now been moved to the new site:

A selection of computer forensics tests and quizzes are available the parent site Where Is Your Data?, these include:

Computer Forensics – NTFS (1) (theory)

Computer Forensics – NTFS (2) (theory)

Computer Forensics  – Law (theory)

Who’s Who (in computer forensics and electronic discovery)

The following quizzes have not all been moved across to the new site yet, but are being moved across (all in good time)

Forensics: FTK 3 Video

The latest FTK 3 video, fromAccessData is now available

Data Recvovery: External Hard drive Options

The Plain Truth: The External Hard Drive Recovery Options You Have

Before there where computers we had scrap books and photo boxes full of past memories.

Now personal data is put into different drives and folders for information. Like many people your internal hard drive got to big so you started to move information over to your external hard drive. Storing more information on to drive more drive has become a bigger responsibility in the modern day. With all the moving parts and internal mechanisms they are someday going to fail over time.

Even though hard drives have changed over from being spinning drives in your computer to solid state drives this doesn’t mean there 100% reliable. Remember nothing lasts forever. External hard drive recovery is a daunting task to say the least. A word of caution if you’re not comfortable with taking apart a computer then taking apart an external hard drive to fix should not be done. Here are a few tips that should help you actually help you with hard drive recovery…

To read the full article check out External Hard Drive Recovery.Net

Forensics: Importing Hashsets into EnCase (Part 2)

Part 2, of the series. Part 1, of how to import hashes into EnCase is available here.

Forensics: Importing Hashsets into EnCase (Part 1)

Forensics: Importing Hashsets into EnCase (Part 1)

Forensics: FTK Tips

Access Data latest tips for FTK, on YouTube.