Eleventh Circuit Rules Defendant Cannot Be Compelled to Divulge Encryption Passphrase Barely three weeks after I penned “Another Judge Rules Encryption Passphrase not Testimonial Under Fifth Amendment Analysis“, the Eleventh Circuit has held that a defendant’s “decryption and production of the hard drives’ contents would trigger Fifth Amendment protection because it would be testimonial, and that such
(Read More…)
No Comments »
Steganography and Smart Phones Over the course of the past year, a new crop of data hiding and steganography programs have emerged. These new Apps run on Android, iOS, and Windows mobile platforms. As one would expect, the ability to conceal, hide, and protect private information on smart mobile platforms is essential. In addition
(Read More…)
Forensics vendor warns Mac OS X FileVault vulnerable to decryption Passware, a vendor of forensics tools for recovering data for law enforcement, has issued a warning that its forensics tools can bypass the security of FileVault disk encryption in Mac OS X if the computer is left powered on, recovering decryption keys from memory.
(Read More…)
Forensic Imaging of Hard Disk Drives- What we thought we knew Imaging of hard drives has been the main stay of the Science part of digital forensics for many years. It has been articulated by many, including us, that we forensically image a hard drive to get that bit for bit image of the ENTIRE
(Read More…)
Digital Detectives Podcast Series Gallivan, Gallivan and O’Melia (GGO, LLC), e-discovery solutions providers, have partnered with Legal Talk Network to produce the “Digital Detectives” series of podcasts for 2012. The Digital Detectives series aims to inform legal and technology professionals on a wide range of emerging topics in e-discovery, computer forensics, information security, litigation,
(Read More…)
Federal Prosecutors Seek Order to Force Colorado Woman to Decrypt Computer Federal prosecutors in Denver, Colorado are seeking a court order that would force Ramona Fricosu to enter the password to decrypt her laptop computer. They believe that the machine contains evidence that would help convict Fricosu and her former husband in a bank
(Read More…)
Google History Forensics by Craig Ball In my last Forensic Focus column, I touched on migration to handhelds and the cloud, mushrooming drive capacities and encryption-by-default as just some of the factors auguring the eventual extinction of conventional digital forensics. But an end to old school digital forensics is no threat to examiners who evolve.
(Read More…)
How to Make a Difference in the Digital Forensics and Incident Response Community by robtlee Over the years of teaching, I have found that there is no shortage of talent in our DFIR community. There are so many individuals that are incredibly sharp, truly skilled, and solving critical cases for their organizations. Sometimes we find
(Read More…)
‘Twas the night before Christmas, when all through the lab Not a hard drive was spinning, not even a Fred. The faraday bags were hung by the chimney with care, In hopes that St Nicholas soon would be there. The examiners were nestled all snug in their beds, While visions of evidence danced in
(Read More…)
Validating Proprietary Digital Forensic Tools: A Case for Open Source By Cory Altheide, Christa M. Miller Digital forensic examiners rely on their expertise to interpret the data their tools retrieve. Although this requires utmost trust in the tools themselves, it also assumes that the tools are doing the job correctly. Not knowing how the
(Read More…)
iPhone Tracking – from a forensic point of view - iPhoneTracking is sexy!!! Every mobile forensic suite, at least the ones dealing with iPhones, are providing it proudly. iPhoneTracking also has been a hot topic in the media all around the globe. People stated, that there is a way to display every step of an
(Read More…)
Why isn’t RAM analysis part of every computer forensic investigation? To the analyst, RAM is just a large blob of data with minimal structure, at least not the structure that we are expecting to see when it comes to operating systems. RAM is volatile, meaning it can easily be flushed and is not used
(Read More…)
