int for(ensic){blog;}

In a blog post Jacky Wu describes how to search for Page Directories if Windows XP SP2 is operating in PAE mode.

By Andreas Schuster at 12/27/2007, 04:00 PM | Permalink

In the December issue (vol. 50, no. 12) of the Communications of the ACM Hal Berghel takes a closer look at unsuspicious cards with a magnetic stripe on it, like membership cards, gift certificates or hotel room keys. He found the duplicated data of credit cards.

By Andreas Schuster at 12/21/2007, 04:00 PM | Permalink

I expect to examine an increasing number of memory images of Microsoft Windows in PAE mode. Today I release a template for the 010 Editor that parses structures from thePage Directory Pointer Table down to the single Page Table Entry.

By Andreas Schuster at 12/17/2007, 04:00 PM | Permalink

In his paper Taking advantage of Ext3 journaling file system in a forensic investigation Gregorio Narváez describes the journal of the ext3 file system.

By Andreas Schuster at 12/12/2007, 04:00 PM | Permalink

In the last post I demonstrated how a the origin of an image could be concealed by small changed to the quantization tables. In this article I'm attempting to make a drawing look like a photograph - at least in regards to its quantization tables.

By Andreas Schuster at 12/11/2007, 04:00 PM | Permalink

Blog reader Mark Cox pointed out that it is easy to forge a quantization table. That's true! In this article I provide a first example on how the tables can be manipulated in order to conceal the origin of an image.

By Andreas Schuster at 12/10/2007, 04:00 PM | Permalink

In an article for Digital Investigation Jason Solomon, Ewa Huebner, Derek Bem and Magdalena Szeżynska examine the persistence of userland data on SuSE Linux 10.0 and Microsoft Windows XP SP2. For both operating systems the authors observed that almost no data could be recovered from the userland portion of the address space 5 minutes past the termination of the owning process.

By Andreas Schuster at 12/05/2007, 04:00 PM | Permalink

With this blog post I release a small script that helps in comparing quantization tables of JPEG images.

By Andreas Schuster at 12/03/2007, 04:00 PM | Permalink