Quinn Shamblin

In my previous post about recovering mp3 data from a corrupted chip, I describe a data recovery challenge that I could not solve using FTK, Foremost or Lazarus. It turned out that Regular Expressions were my answer. But how best to run regex-based data extraction against a forensic image when there...

I was recently asked to recover audio MP3 from a corrupted memory chip. The audio was recorded using a special-purpose audio recording machine configured to record in MP3 format in stereo 44.1KHz at 128kbps. There are several tools and approaches that are sometimes helpful in automated data...

 HC3 Controls  Parts that come in the package VOOM has released a new version of their forensic hard drive imaging tool: Hardcopy III As I reviewed their first two versions in a previous post, I figured I would test this one as well.First, I like the size and portability of this version....

I'm sure it comes as no great shock that I am a member of a number of listserves on digital forensics. One question that seems to come up every few weeks is NTFS Alternate Data Streams. There have been many excellent articles on ADS, so I don't propose to go heavily into the details here. I will...

Capturing an image of a hard drive for purpose of further review and investigation is a common digital forensics activity. Here is a quick review of three of my favorites tools. Hardcopy II The VOOM Hardcopy II is a great general purpose hard drive imaging tool and is my go-to solution. It is fast,...