This tag is associated with 4 posts

What Changes Do We Need To See In eDiscovery? Part II

by Harold Burt-Gerrans Let’s continue from where we left off last time, discussing standardization. If you missed it, Part 1 was all about establishing standards. Now a bit about following standards. This will sound funny to those who know what a rebel I tend to be! Watch out, I’m about to rant… Following Standards When there … Continue reading

E-mail and appointment falsification analysis

First published September 2009 Analysis of e-mail and appointment falsification on Microsoft Outlook/Exchange By Joachim Metz Hoffmann Investigations Version: 1.0 Joachim Metz August 17, 2009 Initial version. Summary In digital forensic analysis it is sometimes required to be able to determine if an e-mail has or has not been falsified. In this paper a … Continue reading

Email Evidence – Now You See it, Now You Don’t!

First published October 2008 By Sandy Boucher and Barry Kuang, Intelysis Corp. Background With the ever increasing role of computers and electronic communications in both our business and personal lives, emails have taken on a key evidentiary role in many high profile court cases. From Oliver North in the Iran-Contra probe to Bill Gates in … Continue reading

Analyzing Exchange and mbox e-mail files using Free and Open Source Software

First published December 2005 Mike Harrington, CFCE EnCE Innovative Digital Forensic Solutions, L.L.C. Mark Lachniet, CISA CISSP Analysts International Table of Contents 1.Document Overview 2.LIBPST/LIBDBX 3.Locating Exchange .dbx/.pst Files 3.2 Locating files in the filesystem 3.2.1 Deleted Files 3.2.2 Allocated Files 3.3 Exporting from Exchange 4.Converting .dbx/.pst files 5.Viewing decoded .dbx/.pst files with … Continue reading

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 1,301 other followers