J. Michael Butler

OK, everyone knows that heat kills electronic components, right? Never subject any electronic component to heat. Unless that makes the component work, that is? Confession is good for the soul, they say, but bad for the reputation. So I'll tell the story this way. You see, there was this "friend of...

Doing it the HARD way! Perhaps you remember my previous blog on EnCase and PointSec, which included my plea for Guidance Software and CheckPoint to work together to create a seamless way to decrypt drives without having to go through 20 or 30 steps to get there. I even wrote, out of desperation, A...

The usual practice for obtaining potential evidence would be to acquire a bit for bit forensic image of the drive and to lock the image up in an evidence safe. Depending upon the legal team's request, one may also replace the original hard drive and keep it in the safe instead of just an image....

So I have a timeline analysis. What file activity should I see when someone inserts a U3 type USB thumb drive in a computer? And why should I care? I care because files accessed on the hard drive, or the "Recent Documents" history, may tie directly to the actual time the thumb drive was plugged in....

You have an incident. You have collected hard drives, USB drives, thumb drives, and PDAs. You made bit for bit images of all of them. Now, what do you do with the originals to ensure chain of custody? First, make sure they are all stored inside static free bags, such as those in which hard drives...

In my first post... I discussed the value of importing discovered flat files into a database in order to analyze them for the legal team. I showed two files of mock data based on an actual case where we were able to tie together relative fields of NPI/PII data to determine what the malicious user...