Forensic Focushttps://www.forensicfocus.com/Forensic Focus - Computer Forensics News, Information and Communityen-usMon, 22 Jan 2018 11:48:37 GMT1440CPG-Nuke DragonflyForensic FocusForumshttp://backend.userland.com/rsshttps://www.forensicfocus.com/images/logo.gifForensic Focushttps://www.forensicfocus.com/Digital Forensics Job Vacancies: Digital Forensic Specialist (Video) - Met Policehttps://www.forensicfocus.com/Forums/viewtopic/p=6592212/#6592212Salary: £38,245 to £42,841 plus £3,216 location allowance. You will receive £38,245 the band minimum. Progress to the band maximum of £42,841 will be via incremental progression
You’ll make our evidence clearer.
And our cases stronger.
London is a city like no other. With nearly 9 million residents covering 620 square miles, policing our capital is a complex challenge. In the Digital, Cyber and Communications (DCC) team, we play a crucial part in the Met’s success. Our talented specialists look at all aspects of digital evidence – from its attainment and analysis, right through to presentation.
Based in our Central Digital Forensic Laboratory, you’ll maximise the potential of all evidence. To do this, you’ll collaborate with police officers, and work across a huge range of devices –everything from CCTV recorders, phones and cameras, to cutting edge and legacy video formats. It’s about recovering data from damaged systems, reverse engineering file formats and enhancing imagery.
Not only that, you’ll also create efficient compilations of material, and insightful forensic reports to be used in court. You might even be called on to give expert testimony – directly impacting the outcome of high-profile cases. A credible individual, we may also ask you to oversee and lead a small team of forensic staff. And with an eye on the future, you’ll conduct research into novel techniques – anticipating demands and looking at how to evolve our services.
To join, you must have a degree in a relevant technical discipline and/or significant relevant experience. You’ll have knowledge of video engineering principles and forensic techniques. Calm, determined and forward thinking, you’ll thrive under pressure and enjoy working at a fast pace. And, as a natural problem solver, you’ll think creatively – always spotting opportunities to improve. Importantly, you’ll have excellent communication skills, along with ability to translate technical terms to a non-technical audience. Plus, you’ll be a confident figure in court, giving authoritative statements.
To apply, please visit our website to download a role specific information pack and click on the link to complete and submit the online application form. You will also be required to submit a detailed CV.
Please submit your completed application form and detailed CV by 23.55pm on Friday 9th February 2018.
Failure to supply all the relevant documents will result in your application being terminated.
We view diversity as fundamental to our success. To tackle today’s complex policing challenges, we need a workforce made up from all of London’s communities. Applications from across the community are therefore essential.
www.metpolicecareers.co.ukMon, 22 Jan 2018 11:48:37 GMTMobile Phone Forensics: Driver Distraction Enforcementhttps://www.forensicfocus.com/Forums/viewtopic/p=6592211/#6592211Rolf, Greenroad may has the system you are looking for
Best tech from IsraelMon, 22 Jan 2018 10:35:42 GMTForensic Software: Forensic Software for SSDhttps://www.forensicfocus.com/Forums/viewtopic/p=6592210/#6592210hightronicdesign wrote:
No I am about to collect as much tools/software as possible which is focusing on SSD forensics.
I already found and used for another scientific work some tools, but now I need to go much more in detail and I hope that some of you guys can give me some hints which tools are designed for this scope.
I am not sure to understand what you are looking for/expect.
At software level a SSD is not particularly different from *any other* block device, most - if not all - the "magic" (deletes, trim, grabage collection and wear leveling) happens in the controller.
Previous works on the matter, some of which are mentioned here:
And particularly the actual article by Wei and others:
More or less revolve around the need of using specialized hardware to directly access flash chips (by-passing the controller).
This does not exclude that software tools may exist (whether they are actually available is another thing) that can connect to the controller on the SSD at a lower level than ordinary tools, but surely they will be very "narrow" and specific to a given make/model of controller.
Additionally, the wear-leveling feature may be managed by a FTL (Flash Translarion Layer) that is embedded in the flash chip itself, so anyway mileage may vary depending on specific makes/models.
jaclazMon, 22 Jan 2018 10:27:19 GMTMobile Phone Forensics: iphone password backuphttps://www.forensicfocus.com/Forums/viewtopic/p=6592209/#6592209If the device is running iOS11, and you have the device, it is possible to reset the backup password using the following process:
If you can’t remember the password for your encrypted backup
You can’t restore an encrypted backup without its password. With iOS 11 or later, you can make a new encrypted backup of your device by resetting the password. Here’s what to do:
1. On your iOS device, go to Settings > General > Reset.
2. Tap Reset All Settings and enter your iOS passcode.
3. Follow the steps to reset your settings. This won't affect your user data or passwords, but it will reset settings like display brightness, Home screen layout, and wallpaper. It also removes your encrypted backup password.
4. Connect your device to iTunes again and create a new encrypted backup.
You won't be able to use previous encrypted backups, but you can back up your current data using iTunes and setting a new backup password.
Click Here for more details.
JCMon, 22 Jan 2018 10:19:45 GMTGeneral Discussion: Match external eSATA drive to drive letter and/or file pathshttps://www.forensicfocus.com/Forums/viewtopic/p=6592206/#6592206Check the MountedDevices key:
for the Disk Signature of the disk.
If there is still trace of it in the key and the disk has not been actually re-initialized but only re-formatted you can reasonably state that it was the same disk.
jaclazMon, 22 Jan 2018 07:56:35 GMTEducation and Training: Need help with my Assignment!https://www.forensicfocus.com/Forums/viewtopic/p=6592205/#6592205Nephalem wrote:
Okay for now, i have checked the Monolithic (8.14gb) file and i sums up the ad1 to ad41 to check, its the same.
Sorry but i'm still kinda confused on the second part you said, so now do i need to do the same thing for what i did previously on ad1 to the same to ad2? like create another monolithic file, and try to combine them together? and if its so, how to merge/combine the 2 monolithic files together?
You have tested that you can create a "monolithic" file out of a set of .ad files,
what you did till now is making a single .ad1 file with the same exact contents of the 42 files you generated earlier, the test has ended successfully.
You can do the same with the set of .ad files (.ad1 and .ad2) that came with the assignment.
You asked for that:
I was given an disk image and asked to decrypt it to see what's inside, once i open the folder there's 2 files ad1 and ad2. and was given afew softwares to work with it, like OSforensics, Prodiscover, Winhex. i was told that need to decrypt and combined the 2 files in order to get the original disk image file.
jaclazMon, 22 Jan 2018 07:47:53 GMTMobile Phone Forensics: MAGNET AXIOM v1.2.3 - Hibernation and Sleephttps://www.forensicfocus.com/Forums/viewtopic/p=6592204/#6592204Hi,
Can someone please explain what does it mean, "Hibernation and Sleep are now disabled when a search is running. " under AXIOM PROCESS FEATURES
JohnMon, 22 Jan 2018 07:44:03 GMTClassifieds: Encase v6 Dongle, Fastbloc 1 &2, EnCase v6 DVD for Salehttps://www.forensicfocus.com/Forums/viewtopic/p=6592203/#6592203PM sentMon, 22 Jan 2018 05:02:51 GMTForensic Software: QuickView Plus 2017 time format issue UTC vs GMThttps://www.forensicfocus.com/Forums/viewtopic/p=6592194/#6592194Thanks MDCR for your suggestion. I think the time scale we are working to in this instance would be an issue doing that right now.
More generally, I have done some research and I have discovered that there is no difference between UTC and GMT. The program Quick View Plus 2017 is representing the time incorrectly. I have used other metadata viewers and the actual time recorded again the MSG files is as displayed when you view the email in Microsoft Outlook.
So to summarise Quick View Plus 2017 is misinterpreting the time stamp. The program is not altering the data of course but it is displaying the time incorrectly.
Thanks to you all for contributing to the conversation. I very much appreciate your input.
RichardSun, 21 Jan 2018 13:36:53 GMTGeneral Discussion: SSD Or Windows Forensicshttps://www.forensicfocus.com/Forums/viewtopic/p=6592183/#6592183athulin wrote:
But just repainting countries in new colours is not clearly useful.... with at least a single known exception <img src="images/smiles/icon_wink.gif" alt="Wink" title="Wink" /> :
actually a milestone in the history of both computing and mathematics, the first theorem ever to have been proved by computer calculations.
jaclazSat, 20 Jan 2018 13:00:53 GMT