Digital Forensics
-
Quick tip: GIMP Recent Files Artifact
I wanted to quickly write a post to share some information that I found while performing an examination on a Windows 10 system. The system has GIMP 2.10.0 installed on it and I needed to find out what images had been opened by the program recently. To find this artifact you need to browse to:…
-
Master Boot Record – Decoding BPB
In my class we are discussing the FAT partition table and the BIOS Perimeter Block (BPB). For our introduction to it we had to manually process the BPB/MBR and determine a few things, such as the number of bytes per sector, how many sectors per cluster, and determining if the FAT is FAT12, FAT16, or…
-
Determining When Windows10 Detected Internet Was Available
The other day I came across an interesting question, and that was “how can I tell when the computer had internet access or not?” I thought for a while, and I initially thought that you could look at when windows connected to various wireless networks. The thought here was that it’s almost unheard of that…
