Latest posts
-
dd vs dc3dd vs dcfldd: speed and reliability test
A real test of dd, dc3dd and dcfldd: speed with and without hashing, with a fast source and with a 100 MB/s drive, and what happens to the image when the drive has bad sectors.
-
dcfldd command examples: hash, hashlog, split and verify
dcfldd commands for forensic acquisition: calculate the hash while you copy, save it with hashlog, show the percentage, split the image and verify it against the source. All examples tested with dcfldd 1.9.1.
-
Brand monitoring with urlDNA: how to set up a rule
How to use the free brand monitoring feature of urlDNA.io to find pages that impersonate your brand, using logos, favicons and keywords.
-
Searching urlDNA.io: direct search and query language
A reference for urlDNA.io search: keyword search, the custom query language with all its attributes and operators, and practical examples for hunting phishing pages.
-
Forensic imaging with dd, dc3dd and dcfldd
Three ways to create a raw forensic image of a drive from the Linux command line — dd, dc3dd and dcfldd — with the options that matter and when to use each one.
-
Forensic timeline with plaso (log2timeline) on Windows
How to build a super timeline with plaso on a Windows workstation: extract events with log2timeline, filter them with psort and review them in a spreadsheet. Updated with the Docker workflow.
-
How to find the Windows installation date
Five ways to find when Windows was installed — registry, systeminfo, WMI, the CSC folder and the Source OS keys — and why feature updates on Windows 10 and 11 can fool you.
-
Extract GPS data from JPEG images with imago
How to bulk-extract GPS coordinates from JPEG files with imago, an open-source image forensics tool, and turn them into places on a map.
-
Drive acquisition with dc3dd
Step-by-step acquisition of a drive with dc3dd: identify the device, create a raw image with on-the-fly hashing and check the log.
-
Dump an Android partition for forensic analysis
How to create a bit-for-bit image of an Android partition over USB with adb, dd and netcat on a rooted device.