Understanding Orphaned Files

I was sitting in an Intro to Forensics lecture recently (in my free time, I’m crazy I know) and was explaining orphaned files to a student so thought I’d just write some stuff down about it. The main point of the post was showing how to manually modify the MFT to create orphaned entries and what they look like in FTK Imager (V3.4.2.2). Nothing groundbreaking šŸ™‚ (more…)

New blog

I started a new blog!

Why, you ask?

That’s a good question; I’ve done a bit of research and needed a good medium to share it through, so here it is. It also forces me to write stuff down. Often I’ll work through a problem and put the information in my notes, but not necessarily centralise them in an easy-to-search place.

I’m hoping to post once a month or when inspiration strikes*

DISCLAIMER: inspiration may strike less often than once a month

If anyone has anything they would likeĀ researched/compiled or wants to guest post/collaborate let me know!