dfir
-
dd vs dc3dd vs dcfldd: speed and reliability test
A real test of dd, dc3dd and dcfldd: speed with and without hashing, with a fast source and with a 100 MB/s drive, and what happens to the image when the drive has bad sectors.
-
dcfldd command examples: hash, hashlog, split and verify
dcfldd commands for forensic acquisition: calculate the hash while you copy, save it with hashlog, show the percentage, split the image and verify it against the source. All examples tested with dcfldd 1.9.1.
-
How to find the Windows installation date
Five ways to find when Windows was installed — registry, systeminfo, WMI, the CSC folder and the Source OS keys — and why feature updates on Windows 10 and 11 can fool you.
-
Extract GPS data from JPEG images with imago
How to bulk-extract GPS coordinates from JPEG files with imago, an open-source image forensics tool, and turn them into places on a map.
-
Drive acquisition with dc3dd
Step-by-step acquisition of a drive with dc3dd: identify the device, create a raw image with on-the-fly hashing and check the log.