In a blog post Jacky Wu describes how to search for Page Directories if Windows XP SP2 is operating in PAE mode.
Continue reading Searching for Page Directories (3).
December 2007 Archives
In the December issue (vol. 50, no. 12) of the Communications of the ACM Hal Berghel takes a closer look at unsuspicious cards with a magnetic stripe on it, like membership cards, gift certificates or hotel room keys. He found the duplicated data of credit cards.
Continue reading Credit Card Forensics.
I expect to examine an increasing number of memory images of Microsoft Windows in PAE mode. Today I release a template for the 010 Editor that parses structures from thePage Directory Pointer Table down to the single Page Table Entry.
Continue reading A Page Directory Pointer Table Template for the 010 Editor.
In his paper Taking advantage of Ext3 journaling file system in a forensic investigation Gregorio Narváez describes the journal of the ext3 filesystem.
Continue reading The Journal of the ext3 Filesystem.
In the last post I demonstrated how a the origin of an image could be concealed by small changed to the quantization tables. In this article I'm attempting to make a drawing look like a photograph - at least in regards to its quantization tables.
Continue reading Manipulations of JPEG Quantization Tables (2).
Blog reader Mark Cox pointed out that it is easy to forge a quantization table. That's true! In this article I provide a first example on how the tables can be manipulated in order to conceal the origin of an image.
Continue reading Manipulations of JPEG Quantization Tables (1).
In an article for Digital Investigation Jason Solomon, Ewa Huebner, Derek Bem and Magdalena Szeżynska examine the persistence of userland data on SuSE Linux 10.0 and Microsoft Windows XP SP2. For both operating systems the authors observed that almost no data could be recovered from the userland portion of the address space 5 minutes past the termination of the owning process.
With this blog post I release a small script that helps in comparing quantization tables of JPEG images.
Continue reading Comparing JPEG Quantization Tables.
