Forensicswiki.org has moved to this site, forensicswiki.xyz. For information, please join the Google Group forensicswiki-reborn

Search results

Jump to navigation Jump to search
  • * Simple volume * Spanned volume
    1 KB (170 words) - 02:44, 14 September 2012
  • ...implementation of the various storage media types, volume systems and file systems. === Volume systems ===
    2 KB (322 words) - 22:28, 17 September 2016
  • ...for other [http://en.wikipedia.org/wiki/Logical_Volume_Management Logical Volume Management] variants as well. Not all forensic tools have support for Linux Logical Volume Manager (LVM) volumes, but most modern Linux distributions do.
    4 KB (554 words) - 11:42, 8 January 2016
  • ...c tool that can be used by investigators to analyze file systems. The file systems supported by DiskExplorer are: <br> DiskExplorer for FAT file systems can accomplish the following tasks[http://www.runtime.org/diskexpl.htm]:
    2 KB (354 words) - 17:29, 20 April 2007
  • ...ecovery software to recover data and decrypt data from Bitlocker encrypted volume created on Windows Vista/7/8/8.1/10 and Windows Server 2012/2008 as long as # Recover deleted files from Bitlocker encrypted volume.
    2 KB (204 words) - 23:11, 19 April 2015
  • ...S]], Veritas [[VxFS]] and Veritas [[VxVM]], [[AVS]] as well as the Solaris Volume Manager ([[Solstice]]). [[Category:Operating systems]]
    1 KB (154 words) - 07:07, 28 August 2008
  • [[Category:Volume Systems]]
    332 bytes (42 words) - 05:36, 3 February 2014
  • [[Category:Volume Systems]]
    188 bytes (23 words) - 23:50, 1 January 2014
  • ...tlocker Loader for Mac''' is a forensic tool to unlock Bitlocker encrypted volume on Mac computer. ...cker recovery key or encryption password and then read Bitlocker encrypted volume on Mac computer.
    1 KB (156 words) - 01:02, 17 April 2015
  • ZFS is a combined file system and logical volume manager designed by [[Sun Microsystems]]. [[Category:File Systems]]
    374 bytes (47 words) - 22:16, 30 August 2013
  • [[Category:Volume Systems]]
    439 bytes (65 words) - 19:14, 14 April 2015
  • ...nd [[Twofish]]. As of version 6.0 TrueCrypt now supports hidden Operating Systems under Windows only. ...the outer volume is mounted, it is hard to prove whether there is a hidden volume or not.
    4 KB (553 words) - 18:35, 2 April 2016
  • ...ng from single-purpose stand-alone tools to integrated forensic processing systems. ...ats for digital evidence, disk partitioning schemes, volume managers, file systems, and structured files. The formats supported are summarized below.
    2 KB (361 words) - 11:30, 20 September 2012
  • ...done using a certificate. The certificate itself is saved on the encrypted volume, but it is encrypted with a password. Volumes can be configured so that the Several tools are available that can recover an EFS key or volume if the original encryption key (or passphrase) are lost. These include:
    2 KB (310 words) - 23:33, 18 September 2020
  • ==Supported operating systems== ==File systems==
    4 KB (503 words) - 07:49, 2 January 2018
  • ...in the computer forensics community for some time. It is intended for *nix systems, but has been ported to the [[Windows]] platform. It should be noted that t To use this tool in binary mode on Linux systems you would use the command:
    1 KB (191 words) - 12:04, 6 March 2008
  • ...lume the '''$MFT''' metadata file keeps records of all file entries in the volume. ...ere is at least one entry in the MFT for every file on an NTFS file system volume, including the MFT itself. All information about a file, including its size
    4 KB (597 words) - 13:04, 20 October 2021
  • ==Volume Shadow Copy Service== ...ofessional and Ultimate editions include tools to work with and manage the Volume Shadow Copy Service, including the ability to mount shadow volumes on disk
    11 KB (1,504 words) - 23:44, 8 August 2021
  • '''BitLocker Disk Encryption''' (BDE) is [[Full Volume Encryption]] solution by [[Microsoft]] first included with the Enterprise a ...me. The FVEK and/or TWEAK keys are encrypted using another key, namely the Volume Master Key (VMK). Several copies of the VMK are also stored in the metadata
    6 KB (799 words) - 07:35, 20 June 2016
  • ...-rddc.gc.ca/PDFS/unc236/p804237_A1b.pdf Forensic analysis of SGI IRIX disk volume], July 2016, by R. Carbone [[Category:File Systems]]
    2 KB (182 words) - 21:11, 28 October 2020
  • volume = {19}, journal="Multidisciplinary Research and Practice for Information Systems",
    7 KB (873 words) - 07:10, 4 October 2013
  • * [[Windows Shadow Volumes|Shadow Volumes]]; the volume-based storage of the Volume Shadow Copy data [[Category:Operating systems]]
    3 KB (339 words) - 03:28, 28 June 2014
  • volumes, and a larger number of files per volume.</p> <P>Future systems may use metadata for a richer
    9 KB (1,249 words) - 01:58, 21 August 2021
  • ...the file and volume systems and TSK supports multiple [[file system | file systems]] (see below). ==Supported File Systems==
    4 KB (520 words) - 09:45, 17 August 2021
  • In Mac OS X 10.7 (Lion) a full volume encryption variant was introduced. * [http://www.simson.net/thesis Design Principles and Patterns for Computer Systems That Are Simultaneously Secure and Usable], by [[Simson Garfinkel]], May 20
    2 KB (267 words) - 20:40, 7 August 2012
  • Microsoft [[Windows]] operating systems records artifacts when [[USB]] removable storage devices (thumb drives, iPo Similarly, the Volume GUID key contains subkeys for each volume that was mounted on the system, and those subkey names appear as follows:
    8 KB (1,299 words) - 19:44, 20 July 2021
  • Modern operating systems typically contain many sqlite databases (often in excess of 100), SQLite Re ...f SQLite databases, tables and records. SQLite Recovery can search a disk, volume, image or file for deleted SQLite databases.
    2 KB (249 words) - 05:06, 9 October 2015
  • ...3.pdf Disk Imaging: A Vital Step in Data Recovery], DeepSpar Data Recovery Systems, November 2006. An in depth look at the many issues that cause data loss / ...al_Papers_Files/84_Camera_Ready_Paper.pdf Automatic Detection of Fake File Systems], Neil C. Rowe, International Conference on Intelligence Analysis Methods a
    5 KB (628 words) - 13:05, 27 July 2015
  • ...me IP-based network log data. Log data from firewalls, intrusion detection systems, routers and other network devices is streamed to Net/FSE in near real time
    2 KB (256 words) - 01:50, 18 January 2014
  • ...RosaSoft Inc.]] for exploring and recovering deleted files from a drive or volume. It is designed to restore files that have: ...ex.php?main_page=product_info&cPath=200&products_id=7 CopyCatX] image file systems without purchasing expensive computer forensics software.
    2 KB (359 words) - 14:37, 11 April 2007
  • ...HI '03: Proceedings of the SIGCHI conference on Human factors in computing systems}, title = {Usability evaluation of multi-modal biometric verification systems},
    14 KB (1,919 words) - 11:48, 26 November 2007
  • ...rks employed by the Hierarchal File System ([[HFS]]) employed by Macintosh systems. ...nd modified, NTFS enters records into the USN change journal, one for each volume on the computer. Each record indicates the type of change and the object ch
    8 KB (1,127 words) - 00:01, 9 August 2021
  • ...parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This ti === Volume System Formats ===
    6 KB (783 words) - 03:21, 4 October 2020
  • ...HITACHI, TOSHIBA), for various capacities (from 500 MB to 6 TB), for file systems FAT, exFAT, NTFS, EXT2/3/4, HFS+, UFS1/2, XFS, ReiserFS, VMFS and virtual i ...I, TOSHIBA), for various capacities (from 500 MB to 6 TB) and various file systems FAT, exFAT, NTFS, EXT2/3/4, HFS+, UFS1/2, XFS, ReiserFS, VMFS and virtual i
    8 KB (1,237 words) - 06:40, 27 January 2017
  • ILooKIX can support a wide variety of file systems, including [[FAT]] 12/16/32, [[NTFS]], [[NTFS Compressed]], [[HFS]], [[HFS+ ...rgone a huge amount of development, particularly in relation to Apple file systems, and Version 10 is now available for use outside of the law enforcement, i
    4 KB (497 words) - 01:08, 12 October 2017
  • |[http://www.amazon.com/gp/product/0130910589/ Forensic Science Handbook, Volume I (2nd Edition)] |[http://www.amazon.com/gp/product/013112434X/ Forensic Science Handbook, Volume II (2nd Edition)]
    8 KB (987 words) - 08:46, 3 November 2016
  • | Volume attribute (archive volume) | New volume naming scheme ('volname.partN.rar')
    11 KB (1,634 words) - 03:22, 17 December 2014
  • * Volume related information, like volume path and volume serial number. * The volume creation time (part of the volume information) of the volume the Prefetch file was created on.
    13 KB (1,679 words) - 20:08, 2 January 2022
  • ...stem), but it is known that damaged (i.e not properly unmounted) Ext3 file systems cannot be write protected using only "-o ro" mount flags (write access will ...g a different number of data writes may occur. Here is a list of such file systems:
    9 KB (1,429 words) - 14:02, 30 March 2015
  • ...However, there are tools available for mounting acquired images on Windows systems. ...u can use to convert a raw/dd image to a VHD file and mount as a read-only volume via Disk Manager
    3 KB (451 words) - 11:00, 13 October 2017
  • ...face, etc.); and enterprise scalability (including live analysis of remote systems via a memory access agent). (Availability/License: commercial) ...008 using Volatility, Crash, and PyFlag], by AAron Walters on the Volatile Systems Blog.
    7 KB (908 words) - 18:32, 27 March 2017
  • Most legal systems apply a form of a legal burden of proof. A legal burden of proof is the imp ...orensic Analysis Methodology], from Computer Forensics issue: January 2008 Volume 56 Number 1
    4 KB (645 words) - 09:29, 13 February 2017
  • ...-bit computing and claim incorrectly an integer is always 32-bit on 64-bit systems or claim the size of the integer is operating system dependent.</b> ...s/253665.pdf Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 1: Basic Architecture], by Intel, May 2011
    10 KB (1,404 words) - 20:46, 12 October 2017
  • ...7 by [[Microsoft]] Corporation, FAT was originally intended to be a [[File Systems|file system]] for the Microsoft Disk BASIC interpreter. FAT was quickly inc ...tion is simply sectors. Cluster size is determined by the size of the disk volume and every file must be allocated an integral number of clusters. Cluster si
    20 KB (3,166 words) - 02:21, 28 August 2021
  • ...0&products_id=7 CopyCatX] is extremely fast. It works on drives that other systems cannot recover by using our proprietary resumable/fault tolerant algorithms ...than the traditional method of backing up file-by-file. When duplicating a volume, [http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&c
    9 KB (1,363 words) - 19:16, 25 May 2009
  • There are both open source and proprietary network forensics systems available. ...trators (all versions) Database monitoring is available for the following systems: MySQL (all versions) PostgreSQL (all versions) Oracle, MSSQL (to be availa
    10 KB (1,471 words) - 00:26, 20 February 2015
  • Establish the boot volume, verify that it is a FAT file system, and locate the hidden text file \MSDO ...system can be displayed using the command `ver` (and `systeminfo` on some systems).
    4 KB (656 words) - 13:24, 27 March 2012
  • memory dumper for UNIX-like systems ...viously known as TASK) is a collection of UNIX-based command line file and volume system forensic analysis tools.
    4 KB (626 words) - 01:42, 18 January 2014
  • ...isition and analysis on drives from MS Windows, Linux, and other operating systems. 
 ...orensicsLab.com MacForensicsLab™'s] Salvage function will search a device, volume, or folder and list all the recoverable files. The displayed files can then
    19 KB (2,887 words) - 08:10, 2 January 2007
  • * Volume Shadow Copies (see [[Windows Shadow Volumes]]) * [[Windows Shadow Volumes|Shadow Volumes]]; the volume-based storage of the Volume Shadow Copy data
    18 KB (2,263 words) - 23:51, 19 November 2021

View (previous 50 | next 50) (20 | 50 | 100 | 250 | 500)