Digital Forensics: Artifact Profile – Recycle Bin

Windows Recycle Bin in Digital Forensics The Windows Recycle Bin, a seemingly simple feature, has undergone significant changes across different versions of the Windows operating system. This artifact is not just a virtual trash can but a critical element in digital forensic investigations. Understanding its evolution and functionality can provide valuable insights into user activity … Continued

Digital Forensics: Artifact Profile – USB Devices

Importance to Investigators USB device history is an invaluable source of evidence in digital forensics, playing a crucial role in various investigative scenarios. When an examiner needs to determine if an external device was connected to a system, USB artifacts provide definitive traces of such activities. This evidence can reveal not only the connection but … Continued

April Artifact Update: Native Android Apps

Our latest artifact update for IEF includes support for native Android applications. As the mobile market continues to narrow-in on two primary operating systems – Android and iOS – it’s becoming increasingly important for investigators to recover data from these built-in system apps. In February, we added support for a similar set of native iOS … Continued

Forensic Analysis of Windows Shellbags

This is the fifth and final blog post in a series about recovering Business Applications & OS Artifacts for your digital forensics investigations.  What are Shellbags? While shellbags have been available since Windows XP, they have only recently become a popular artifact as examiners are beginning to realize their potential value to an investigation.  Shellbags … Continued