FrostWire Forensics

http://articles.forensicfocus.com/2012/07/19/forensic-examination-of-frostwire-version-5/

Windows Registry Forensics Resource

This might be useful.

http://travisaltman.com/location-of-forensic-evidence-in-the-registry/

Mapping Network Drives from the Windows Command Prompt

http://www.howtogeek.com/118452/how-to-map-network-drives-from-the-command-prompt-in-windows/

Do I Mind that Android Knows Where I Am?

Our smart phones know where we are.  Is that okay?  I'm trying to decide.  I must admit that I like the location apps and services that are available, but it's almost shocking when I look at my location history and realize this phone keeps track of me AT ALL TIMES.

This article tells the entire story for Android and iOS.

http://lifehacker.com/psa-your-phone-logs-everywhere-you-go-heres-how-to-t-1486085759

For a quick look at your location history on your Android device, follow this link. You will need to log in with your Google credentials.

https://maps.google.com/locationhistory

To see your location history on your iOS device, look here.  You will need your Apple ID and password to log in.

http://www.iclarified.com/36198/how-to-view-the-location-history-of-your-iphone

Social Media Search Engine

This site searches social media and does a passable job:

http://whitepagesus.net/

Erasing an iPad and Dealing with an Unknown Restrictions Passcode

When attempting to erase and reset an iPad (3rd Generation), I was asked for a 4-digit restrictions passcode.  I don't recall ever seeing this term, but Apple wanted it before it would let me erase the device.  I suppose it makes it difficult for thieves to wipe and distribute stolen iPads.  Here is the solution:

1. Sign into icloud.com
2. Click on the "find my iPad" tab
3. Click "all devices" on top of the page
4. Click on the device for which you lost your passcode
5. These options will display: "play sound" "lost mode" and "erase iPad"
6. Choose "erase iPad" and it will begin to wipe the device
7. Choose Remove iPad to allow it to be activated and used again

This will also work for iPhones.

Finding Personal Information about Someone

These sites lead to pay sources, but without paying anything, they provide a wealth of information such as:

Full Name
Age
Names of Family Members
Places Lived
Addresses
Phone Numbers
Associated Businesses

(click Search Full Info for even more information)

http://www.advancedbackgroundchecks.com/

Another site:

http://www.publicrecordsnow.com/

Reset Windows 7 or Windows 8 Password

After I upgraded Windows 8 to 8.1, my password failed to work.  I used this to get back in:

http://www.youtube.com/watch?v=Wb7GP-zwh_E

Another source:

http://pcsupport.about.com/od/windows-8/a/reset-password-windows-8.htm

Solid State Drives - Part 1 of 6

http://www.dfinews.com/articles/2013/04/solid-state-drives-part-1

Windows XP Support Ends April 8, 2014

After 12 years, Microsoft is ending support for Windows XP. What does this mean to you?

If you have a Windows XP computer, you should consider upgrading your operating system or upgrading the computer altogether. There are steps you can take to make XP computers safer, but I don't recommend them in most circumstances.

For more information:  http://windows.microsoft.com/en-us/windows/end-support-help

How to Quickly Create a Copy of a Table using Transact-SQL

http://technet.microsoft.com/en-us/magazine/dd401720.aspx

Three ways to take a screenshot on a Mac

This is old information, but I can never seem to remember it:

http://www.cnet.com/how-to/three-ways-to-take-a-screenshot-on-a-mac/

Dictation.IO

You have to use Chrome for this, but this site will dictate your speech and does a pretty good job.

https://dictation.io/

Phonetic Alphabet

When vocalizing serial numbers, hex characters or other alpha-numeric strings, it's sometimes difficult to articulate Bs and Vs without them sounding the same.  Using the phonetic alphabet helps to eliminate miscommunication.

Alpha	Hotel	Oscar	Victor
Bravo	India	Papa	Whiskey
Charlie	Juliet	Quebec	X-ray
Delta	Kilo	Romeo	Yankee
Echo	Lima	Sierra	Zulu
Foxtrot	Mike	Tango
Golf	November	Uniform

File Signatures Table

I have used this site a number of times when looking for file headers:

http://www.garykessler.net/library/file_sigs.html

Recovering Unallocated Space, Free Space, and Slack Space

This information came from the following website:

http://my.safaribooksonline.com/book/networking/forensic-analysis/9780072226966/data-analysis-techniques/ch11lev1sec7

After you perform a forensic duplication of media, and you have recovered as many files as you can, there is still data left on the evidence media that you will want to review. The remaining data is stored in slack space, unallocated space, and free space.

In order to understand slack space and unallocated space, we must first review what an allocation unit or cluster is. Operating systems arrange all data stored on a hard drive into segments called allocation units (also called clusters). For example, an operating system that uses 32K clusters reads and writes data from a hard drive 32K at a time. It cannot read less than 32K of data from a hard drive, and it cannot write less than 32K at a time to the hard drive. However, very few files have the exact amount of data to occupy an entire cluster or set of clusters. Therefore, when an operating system that writes 32K clusters to a hard drive is being asked to save a 20K Microsoft Word document, there is 12K of unused space called file slack. In our example, there may be remnants of previous files in this 12K of file slack.

Unallocated space is the area of the hard drive not currently allocated to a file. Fragments of deleted files are often strewn across unallocated space on a hard drive.

Free space is the portion of the hard drive media that is not within any currently active partitions.

Adding the Today Smart Folder to a Newer Mac OS Sidebar

After updating to Maverick from Snow Leopard, I noticed there was no Today smart folder.  This proved to be a big problem because I relied on it when attaching, copying and moving files.  Here is a link with instructions on adding the folder back:

http://macs.about.com/od/LionTipsNtricks/qt/Restore-Smart-Searches-To-Os-X-Lions-Finder-Sidebar.htm

Windows Default RIDs

Scroll down for the list. . . http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/groupmapping.html

Computer Forensics Cheat Sheet

https://blogs.sans.org/computer-forensics/files/2012/06/SANS-Digital-Forensics-and-Incident-Response-Poster-2012.pdf

NTFS $I30 Index Attributes: Evidence of Deleted and Overwritten Files

http://forensicmethods.com/ntfs-index-attribute

Recycle Bin Forensics

http://dereknewton.com/2010/06/recycle-bin-forensics-in-windows-7-and-vista/

MacGyver IT: 21 tools for IT Heroes

http://www.infoworld.com/slideshow/137851/macgyver-it-21-tools-it-heroes-235192?source=IFWNLE_nlt_daily_am_2014-01-30

Windows 7 Forensic Time Information

UTC = Local Time + ActiveTimeBias
Local Time = UTC – ActiveTimeBias
Standard Time = Bias + StandardBias
Daylight Time = Bias + DaylightBias

http://www.forensicfocus.com/downloads/windows-registry-quick-reference.pdf

Forensic Analysis of the Windows 7 Registry

http://ro.ecu.edu.au/cgi/viewcontent.cgi?article=1071&context=adf

Yahoo Messenger Forensics

https://www.cerias.purdue.edu/assets/pdf/bibtex_archive/2011-11.pdf http://www.cerias.purdue.edu/news_and_events/events/security_seminar/details/index/nj3red9gie9h6bvmu8dklllpgo

Windows 7 Registry Forensics: Part 4

http://www.forensicmag.com/articles/2012/04/windows-7-registry-forensics-part-4#.Us7cCU6BrIU

Windows 7 Last Logon Date/Time

Last logon value is stored in "SAM\Domains\Account\Users\F". Bytes 9-16 of this key stores it.

An Examination of the NTFS Volume Boot Record

http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm

Forensic - Password Hint Location

http://news.softpedia.com/newsImage/Windows-7-and-Windows-8-Registries-Reveal-Password-Hints-Researchers-Find-2.jpg/

Windows 7 Registry Forensics

http://www.dfinews.com/articles/2012/07/windows-7-registry-forensics-part-7#.Usfmck6BrIU