This week I talk File Use & Knowledge investigations involving virtual machines. This is mainly from a dead-box exam point-of-view.

This week I talk about SRUM, a windows artifact with some significant forensic value for both File Use & Knowledge investigations as well as Incident Response.

This week I talk about considerations for digital evidence integrity when collection evidence on-scene from a live system.

This week I talk about surviving mobile App timestamps.

This week I share my thoughts on setting DFIR goals for the coming year. I go over seven points worth focusing on for professional development.

This week I talk DMA (direct memory access) exploits as a technique to bypass passwords of a live system to conduct imaging - with legal authority of course.

This week I talk about a useful automated file intelligence resource for dead box exam as well as IR investigations.

This week I go over survival tips for imaging a Mac.

This week I about the format change for Windows 10 Prefetch files as well as a freely available tool to decompress and present .pf file data.

This week I'm talking .Trash. I cover the forensic basics of this Mac artifact that examiners need to know.