top of page
-
Mar 24, 20243 min read
Understanding Registry:
Windows Registry Overview: The Windows registry is a crucial database storing system, software, hardware, and user configuration data....
64 views0 comments
-
Mar 23, 20244 min read
Extracting/Examine Volume Shadow Copies for Forensic Analysis
Introduction: In the realm of digital forensics, gaining insights into the changes made to files and volumes over time can be critical...
113 views0 comments
-
Mar 22, 20243 min read
Overview the Core Components of NTFS File System
The $MFT, $J, $LogFile, $T, and $I30 are all important components of the NTFS (New Technology File System) file system used in Windows...
42 views0 comments
-
Mar 21, 20241 min read
Understanding, Collecting, Parsing the $I30
Introduction: In the intricate world of digital forensics, every byte of data tells a story. Within the NTFS file system, "$I30" files...
286 views0 comments
-
Mar 20, 20243 min read
Understanding, Collecting, Parsing, Analyzing the $MFT
Introductions The NTFS (New Technology File System) is equipped with a feature known as filesystem journaling, which plays a vital role...
87 views0 comments
-
Mar 18, 20242 min read
NTFS Common Activity Patterns in the Journals $LogFile, $UsnJrnl
Introduction: NTFS journals play a crucial role in forensic analysis, providing valuable insights into file system activity....
44 views0 comments
-
Mar 17, 20241 min read
NTFS Journaling in Digital Forensics $LogFile, $UsnJrnl:- Analyzing of $J || $LogFile using Timeline explorer
Analyses of $J Output: Understanding Column Headers: As we dive into the USN journal, the column headers are mostly self-explanatory....
55 views0 comments
-
Mar 16, 20242 min read
NTFS Journaling in Digital Forensics $LogFile, $UsnJrnl:- Parsing of $J || $Logfile using MFTECmd.exe
In last we have talked about collection of $J and $Logfile using kape: This blog we are going to deep delve into Tool MFTECmd.exe which...
96 views0 comments
-
Mar 15, 20242 min read
Power of NTFS Journaling in Digital Forensics $LogFile, $UsnJrnl
Introductions NTFS, the file system used by Windows operating systems, offers powerful journaling features that provide critical...
137 views0 comments
-
Mar 14, 20242 min read
Anti-Forensics: Timestomping
What is Time stomping? Time stomping is a prevalent anti-forensic technique encountered in incident response matters. The manipulation of...
123 views0 comments
-
Mar 13, 20243 min read
NTFS: Metadata with The Sleuth Kit(istat)
In the realm of digital forensics, dissecting the intricacies of file systems is essential for uncovering valuable evidence and insights....
40 views0 comments
-
Mar 12, 20242 min read
NTFS: Understanding Metadata Entries
In the realm of digital forensics and cybersecurity, mastering the intricacies of file systems like NTFS is paramount. One crucial aspect...
35 views0 comments
-
Mar 11, 20243 min read
NTFS: Understanding Metadata Structures($MFT) and Types of System Files
Introduction: In the realm of file systems, metadata structures play a pivotal role in organizing and managing data. These structures,...
195 views0 comments
-
Mar 10, 20242 min read
NTFS: Versatility of NTFS: A Comprehensive Overview
Introduction: NTFS, short for New Technology File System, stands as a cornerstone of modern file management on Windows operating systems....
36 views0 comments
-
Mar 7, 20242 min read
Analysis of Super-Timeline: Created using Plaso(Log2timeline)
Lets start with an example: The two drive letters present that could indicate USB/external device activity are "E:" and "F:". The...
47 views0 comments
-
Mar 6, 20245 min read
A Deep Dive into Plaso/Log2Timeline Forensic Tools
Plaso is the Python-based backend engine powering log2timeline, while log2timeline is the tool we use to extract timestamps and forensic...
208 views0 comments
-
Mar 5, 20242 min read
Importance of Timestamp in Timeline Analysis while Forensic Investigations
Introduction: Timestamp analysis plays a crucial role in forensic investigations, offering valuable insights into the timeline of events...
43 views0 comments
-
Mar 4, 20241 min read
Understanding NTFS Timestamps(Timeline Analysis) : With Example
Lets understand with example: We have created table to understand NTFS Operations 1. Create Operation: When a file is created, according...
38 views0 comments
-
Mar 3, 20242 min read
Understanding NTFS Timestamps (Timeline Analysis)
Introduction: In digital forensics, understanding NTFS timestamps is crucial for reconstructing events and analyzing user activities on a...
133 views0 comments
-
Mar 2, 20242 min read
Understanding Timeline Analysis in Digital Forensics
What is Timeline Analysis? Timeline analysis in digital forensics is the process of examining chronological data to reconstruct events...
76 views0 comments
bottom of page