Comments on: About Me

By: Danny

Danny — Tue, 21 Jul 2009 08:52:17 +0000

Hi Mike,

I got some question for you related to my project. Can I ask you by email? I didn’t found the link says “contact me” or other information about your email.

Thanks,
Danny

By: Suzanne

Suzanne — Fri, 25 May 2007 23:08:52 +0000

Hi Mike,

I’ve added a link to your blog to the Digital Forensics Association website (ww.digitalforensicsassociation.org) in the Resources section. We’re a brand new professional association, and I’m building out the website now. I’ve enjoyed your blog for some time, and I’m glad to include it.

Thanks,

Suzanne

By: Paul

Paul — Wed, 18 Apr 2007 19:17:35 +0000

I work as a computer tech at a University, and have been approached by a faculty that wishes to locate evidence that contains time/date stamp and log of accessing a networked drive with a generic log on provided by the faculty to all students in the class. Could you give me a hint towards what log files I might examine? I’ve been pouring through the logs I can find, and do not see anything that would offer that specific information.

Thanks,
Paul

By: Dimitris

Dimitris — Tue, 27 Feb 2007 08:50:45 +0000

Hello Mike, i’ve been reading your blog and i found it very interesting.

I am new to the forensic analysis, and i wanted to ask a technical question.

How you can ensure that if someone changes the BIOS clock to the past(e.g 2005) and plants a document is visible ?

I use Encase Forensic,i have read several documents, and the only solution i found to ensuse the above is from the windows event viewer.

Do you have any other suggestions ?

Thanx in advance,

Dimitris

By: Mike Murr

Mike Murr — Sat, 27 Jan 2007 21:43:48 +0000

Cool, thanks!

By: Ted Smith

Ted Smith — Sat, 27 Jan 2007 11:28:46 +0000

I have added your site as a link on the F3 website (www.f3.org.uk).

Ted