MetaDiver 2.0 is finally here. I hope to drop the release the alpha of 2.0 tomorrow in Downloads! This is a huge list of features and changes for MetaDiver. It’s been a LOT of work but a lot of fun and much of the research that has gone into the code has been hugely beneficial
Got a Raspbery Pi 2 today. Microcenter has it on sale. You can also sign up for the Windows 10 at the Windows Developer Program for IoT page to get on the list for when it becomes available for the Raspberry Pi 2. The latest Raspbian works great and blazing fast in X-Windows compared to the
Kevin Stokes has a nice write-up on a newer Windows 8.1 event log that stores ntfs usage information called the “Microsoft-Windows-Ntfs/NTFS Operational” log. It was enabled in an April 2014 windows update. It logs useful information about the volume each time you plug a device in to your computer or boot creating a nice new
If you are at all familiar with the Python programming language you will know that one of the nice things is the simplicity of writing scripts. The other great thing about Python is the considerable collection of modules that do the heavy lifting for you. In this example I want to share a script I
A new build of MetaDiver has been released. You can download it here. With this release v1.2.1 MetaDiver will no longer expire! This is a permanent change I decided to make. My original intent was to force people to upgrade but I decided this is just too much of a pain and causes confusion. I
Earlier this week I gave a presentation on SQLite Forensics at the CEIC conference in Vegas. Later that day I gave an interview about my presentation on the Learn Forensics podcast live from CEIC. Watch here
Following my talk on SQLite Forensics at the CEIC conference I want to share the scripts I wrote but did not get the opportunity to demo during the talk! I talked about using Python to export data from the Favicon database in the Chrome web browser, any SQLite database using python. In this post I’m going
This is an updated post (cross-posted from my RRTX Blog!) about building Access Data’s FTK Toolkit filters outside of FTK. Access Data probably won’t like this since a bad filter can cause the client to crash if you build the filter wrong. So lets build it with care. If you are someone familiar with FTK
Welcome to part two of Unleashing log file analysis. In the last post I talked about the power of using LogParser to transform your Windows Event Logs. In this post I want to talk about using LogParser to transform your IIS Logs! So a quick recap from Part 1 of why I think LogParser is
The latest build of MetaDiver is available for Download. MetaDiver – a solution for discovering file Meta-data. MetaDiver extracts file information fast and easy. Simply put it is great at pulling file data and making it easy to review ! In this build major interface enhancements. The ability to choose multiple file extension filters before