Newsletter for Digital Evidence Professionals

May 2024

Why did the digital forensics examiner go broke?

Because he/she couldn't find any cache!

USB Device Forensics

Computer Forensics on a FAT32 USB

Computer forensics involves applying investigative techniques to gather and analyze data from digital devices. A typical digital forensics scenario is the examination of a USB thumb drive. Let's assume it is formatted with the FAT32 file system for this example. FAT32 is a widely used file system due to its compatibility with various operating systems. However, it has a range of limitations, including file and disk size restrictions. This article provides a step-by-step guide on how to perform computer forensics on a FAT32-formatted USB thumb drive.

Authorization

Before starting the forensic examination, ensure you have the authority to examine the media. Having proper authorization before conducting a forensic exam is crucial for ensuring the integrity and legality of the investigation process. Without consent, the examination could be deemed unlawful, leading to potential violations of state and federal laws such as computer trespass, privacy violations, and other legal issues. This authorization typically comes as a warrant or explicit consent from the data owner, which provides a legal basis for the forensic activities. Such compliance is essential to prevent the evidence from being challenged or dismissed in court.

Read more.

Around the Industry

• The new REPORT Act require online service providers reports of suspected crimes against children.
• More than 30 serious criminals have been jailed after police cracked their encrypted text messages and uncovered a violent feud over stolen drugs.
  
• Oxygen Forensics introduces the keydiver software to guess passwords from encrypted or hashes values.