摘要：
Few people know that when you take photos there is also a thumbnail embeded inside the file, even some forensic guys may have no idea about this impor... 阅读全文
posted @ 2015-08-09 10:07 Pieces0310 阅读(427) 评论(0) 推荐(0) 编辑
2015年8月9日
2015年8月5日
摘要：
When it comes to lnk file analysis, we should put more emphasis on the volume serial number. It could help forensic guys to identify whether files exi... 阅读全文
posted @ 2015-08-05 16:24 Pieces0310 阅读(355) 评论(0) 推荐(0) 编辑
2015年7月26日
摘要：
Some said Live View could only boot up images acquired from 32bit OS evidence. I have to say that it's not true. Ok, the best way to prove it is let t... 阅读全文
posted @ 2015-07-26 16:12 Pieces0310 阅读(445) 评论(0) 推荐(0) 编辑
2015年7月9日
摘要：
I access a files which name is "abc.doc", no doubt a lnk file "abc.doc.lnk" shows up. Few minutes or hours later I access "abc.doc" again, what will h... 阅读全文
posted @ 2015-07-09 22:27 Pieces0310 阅读(255) 评论(0) 推荐(0) 编辑
2015年7月7日
摘要：
I used to conduct raw search in EnCase v6, and I'd like to see if EnCase v7 raw search could hit keywords inside compound files or not. You won't beli... 阅读全文
posted @ 2015-07-07 21:36 Pieces0310 阅读(594) 评论(0) 推荐(0) 编辑
2015年7月4日
摘要：
Last week my friend told me that she made a terrible mistake. She conducted raw serch and found no search hits within M$ docx files. She did not know ... 阅读全文
posted @ 2015-07-04 11:35 Pieces0310 阅读(665) 评论(0) 推荐(0) 编辑
2015年6月26日
摘要：
Hi,I've been waiting for a very very long time..Now iOS 8.3 is ready.http://www.taig.com/You guys could download the latest Taig JB v2.1.2. It really ... 阅读全文
posted @ 2015-06-26 15:54 Pieces0310 阅读(217) 评论(0) 推荐(0) 编辑
2015年6月21日
摘要：
It's hot this summer. It also reminds me of one case about sunglasses. She was new to this company and she had a good body figure. She was very popula... 阅读全文
posted @ 2015-06-21 22:53 Pieces0310 阅读(292) 评论(2) 推荐(0) 编辑
2015年6月15日
摘要：
各位可曾听说过智能手机取证软件Oxygen Forensic Suite,它的logo是名侦探福尔摩斯一手抽着他的招牌雪茄,一手拿着放大镜,全神贯注地正进行调查工作.使用过它的取证人员必定会对它的提取能力感到佩服,它也支持各种方式的数据提取.可进行物理提取,有机会自所谓的Unallocated Ar... 阅读全文
posted @ 2015-06-15 22:41 Pieces0310 阅读(861) 评论(4) 推荐(0) 编辑
2015年6月11日
摘要：
Hi,One of my friends Sandy asked me about the possibility of completely change MACE timestamps. As everybody knows that some tools could change MAC ti... 阅读全文
posted @ 2015-06-11 22:43 Pieces0310 阅读(478) 评论(0) 推荐(0) 编辑