I’ve spent my career in digital forensics wrestling with two deceptively simple questions: Where do I start and where do I stop, in an investigation? Both decisions feel like drawing lines on quicksand. You’re flooded with artifacts—timestamps, logs, messages—tempting you to search every byte. But legal deadlines and investigative demands force focus. The real skill isn’t just finding evidence but knowing when to stop.
This is the fourth blog post in a series of five about recovering Business Applications & OS Artifacts for your digital forensics investigations. What are prefetch files? Prefetch files are great artifacts for forensic investigators trying to analyze applications that have been run on a system. Windows creates a prefetch file when an application is … Continued
This is the third blog post in a series of five about recovering Business Applications & OS Artifacts for your digital forensics investigations. What are LNK files? LNK files are a relatively simple but valuable artifact for the forensics investigator. Shortcut files link to an application or file commonly found on a user’s desktop or … Continued
Beginning with iOS 18, Apple has added an inactivity reboot timer into the operating system that is tied only to the device’s lock state. This means that when the device has been locked for a period of three days (72 hours), the device reboots. Sounds simple, right? Well, it’s not quite so simple for the … Continued
Windows Recycle Bin in Digital Forensics The Windows Recycle Bin, a seemingly simple feature, has undergone significant changes across different versions of the Windows operating system. This artifact is not just a virtual trash can but a critical element in digital forensic investigations. Understanding its evolution and functionality can provide valuable insights into user activity … Continued
While digital evidence is commonly linked to crimes like child exploitation, violent offenses, and cybercrimes, its significance extends to almost every crime, including understanding the complexities of vehicle accidents. A traditional vehicle accident investigation focuses on reconstructing the physical scene and Magnet Axiom adds a crucial new dimension: the digital traffic crash scene. Consider the … Continued
Magnet Axiom 8.4 is now available, delivering feature and functionality improvements that will help you work as efficiently as possible, including: You can upgrade within Axiom or over at the Customer Portal. If you’re looking to try Axiom, you can request a free trial here. Artifact reference in Portable Case There have been a number … Continued
The importance of acquiring cloud and social media data in criminal investigations cannot be overstated. Sometimes there can be crucial information found that can be a determining factor in whether an arrest is made. That can subsequently mean that a dangerous person remains on the streets. We’ll walk through a real case where, because of data retrieved through cloud forensics, a previously convicted child predator was arrested and imprisoned.
Digital forensics tools have improved a lot in the past several years. With these advances, the digital forensics community now has many tool options for each phase of an investigation.
Geolocation data has become an indispensable tool in criminal investigations, offering unparalleled insights into the movements and whereabouts of mobile devices. This technological advancement provides law enforcement with the ability to reconstruct crime scenes, establish timelines, and verify alibis with a level of precision that was previously unattainable. The forensic examination of mobile digital devices … Continued
