archives

how to

This tag is associated with 9 posts

How To Acquire Mobile Data With MD-NEXT From HancomGMD

by Michelle Oh, HancomGMD  With an ever-increasing range of features and dramatically increased storage capacity, digital devices have become essential to our daily life. Their ability to store vast amounts of data means that these devices have proliferated and are now found in every household. They therefore prove to be a source of crucial information that … Continue reading

How To Use Cross-Case Search With Belkasoft Evidence Center

by Yuri Gubanov Diving deeper may be the key to the eventual success of a digital forensic investigation. This is true not only when it comes to a single given case, but also when it comes to intersections between different cases.  Sometimes, a person being investigated may have associates who are problematic, or who have … Continue reading

How To Image To A Network Repository With Logicube’s Forensic Falcon-NEO

Welcome to Logicube’s tutorial on the Falcon-NEO forensic imager. The Falcon-NEO allows you to image directly to or from a network repository using SMB or CIFS protocol, or using iSCSI. Two 10GbE ports provide extremely fast network imaging performance. In this episode we’ll show you how to image from a physical drive connected to the … Continue reading

Walkthrough: Carving With Belkasoft Evidence Center

by Yuri Gubanov, Danil Nikolaev & Igor Mikhailov © Belkasoft Research Carving is an irreplaceable technique widely used in data recovery and digital forensics. By using carving, we essentially perform a low-level scan of media for various artifacts, looking for signatures—specific sequences of bytes, characteristic of different types of data. This also means that carving … Continue reading

How To Install And Use The Optional Thunderbolt I/O Card On Logicube’s Falcon-NEO

Welcome to Logicube’s tutorial on the optional Thunderbolt I/O card on the Forensic Falcon-NEO. In this session, we’ll show you how to install and use this card. The optional Thunderbolt I/O card connects directly to Falcon-NEO’s source or destination I/O card ports. This card allows you to image directly to or from Thunderbolt USB C, … Continue reading

How To: Use The File Browser Feature In Logicube’s Forensic Falcon NEO

Welcome to Logicube’s tutorial on the Forensic Falcon NEO. In this session, we’ll show you how to use the file browser feature. The file browser feature of the Falcon NEO provides logical access to source and destination drives connected to the Falcon NEO. To open the file browser, click on the left-hand menu and click … Continue reading

How To: Create A Logical Image On Falcon NEO

Welcome to Logicube’s tutorial on the Forensic Falcon NEO. In this episode, we’ll show you how to perform a logical image. The logical imaging feature of Falcon NEO shortens the evidence collection process by allowing investigators to select and acquire only the specific files they need, rather than the entire physical drive. Users can create … Continue reading

Walkthrough: Analyze DI Face Detection Recognition

Let’s check out the new features of the Face Detection within Griffeye Analyze DI. Make sure in the Analyze Forensic Market you have the Face and Video utility pack both activated before you create your case. Once you do so, we can go ahead and create a new case, and bring in our data. I’m … Continue reading

Evidence Acquisition Using Accessdata FTK Imager

by Chirath De Alwis Forensic Toolkit or FTK is a computer forensics software product made by AccessData. This is a Windows based commercial product. For forensic investigations, the same development team has created a free version of the commercial product with fewer functionalities. This FTK Imager tool is capable of both acquiring and analyzing computer forensic … Continue reading

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 1,234 other followers