http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/ Digital forensics from the view of a computer scientist Mon, 21 Dec 2009 12:33:33 -0800 http://wordpress.org/?v=2.9.1 hourly 1 http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/comment-page-1/#comment-2335 Neabovappeamp Fri, 11 Dec 2009 22:36:35 +0000 http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/#comment-2335 Lots of guys blog about this issue but you wrote down really true words. Lots of guys blog about this issue but you wrote down really true words.

]]> http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/comment-page-1/#comment-2037 Week’s Links | lonerunners.net Sun, 09 Nov 2008 22:09:27 +0000 http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/#comment-2037 [...] How forensic tools recover digital evidence (data structures) [...] [...] How forensic tools recover digital evidence (data structures) [...]

]]> http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/comment-page-1/#comment-2036 Kris Fri, 24 Oct 2008 03:51:19 +0000 http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/#comment-2036 Good words. Good words.

]]> http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/comment-page-1/#comment-173 Forensic Computing » Recovering a FAT filesystem directory entry in five phases Thu, 24 May 2007 23:01:34 +0000 http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/#comment-173 [...] tools go through to recover data structures (digital evidence) from a stream of bytes. The first post covered fundamental concepts of data structures, as well as a high level overview of the phases. [...] [...] tools go through to recover data structures (digital evidence) from a stream of bytes. The first post covered fundamental concepts of data structures, as well as a high level overview of the phases. [...]

]]> http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/comment-page-1/#comment-156 www.andrewhay.ca » Suggested Blog Reading - Monday May 7th, 2007 Mon, 07 May 2007 12:04:24 +0000 http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/#comment-156 [...] How forensic tools recover digital evidence (data structures) - Excellent way to explain digital forensics to anyone with programming or development backgrounds. In a previous post I covered “The basics of how digital forensics tools work.” In that post, I mentioned that one of the steps an analysis tool has to do is to translate a stream of bytes into usable structures. This is the first in a series of three posts that examines this step (translating from a stream of bytes to usable structures) in more detail. In this post I’ll introduce the different phases that a tool (or human if they’re that unlucky) goes through when recovering digital evidence. The second post will go into more detail about each phase. Finally, the third post will show an example of translating a series of bytes into a usable data structure for a FAT file system directory entry. [...] [...] How forensic tools recover digital evidence (data structures) – Excellent way to explain digital forensics to anyone with programming or development backgrounds. In a previous post I covered “The basics of how digital forensics tools work.” In that post, I mentioned that one of the steps an analysis tool has to do is to translate a stream of bytes into usable structures. This is the first in a series of three posts that examines this step (translating from a stream of bytes to usable structures) in more detail. In this post I’ll introduce the different phases that a tool (or human if they’re that unlucky) goes through when recovering digital evidence. The second post will go into more detail about each phase. Finally, the third post will show an example of translating a series of bytes into a usable data structure for a FAT file system directory entry. [...]

]]> http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/comment-page-1/#comment-152 Sandeep Sun, 06 May 2007 03:17:31 +0000 http://www.forensicblog.org/2007/05/05/how-forensic-tools-recover-digital-evidence-data-structures/#comment-152 another brilliant post! waiting for the next :) another brilliant post! waiting for the next

]]>