Slack space / UC2FSA101

Slack space / UC2FSA101

Suspects trying to hide evidence is something you would expect to come across. Some are more sophisticated than others in doing so. One of the more advanced methods is trying to hide information in the “slack space”. First, what is the slack space? Well,...
Hex change / UC2FSA101

Hex change / UC2FSA101

When investigating an image of a suspects drive, sometimes you need to restore deleted files that has been overwritten or destroyed in some manner. In these cases the files might be to damaged to recover, and can in some cases be a real pain to try and restore. And...
Investigation / UC2FSA101

Investigation / UC2FSA101

The first thing you would normally do in an investigation, is to enter a crime scene. That is if you are lucky enough to get an exciting job at a busy law enforcement office. In this entry I will be talking briefly on the overall important steps on how to move forward...
Introduction / UC2FSA101

Introduction / UC2FSA101

Our newest course is the File System Analysis course, which allows us to dig deeper into the world of file systems and how to recover evidence from suspects harddrive. For me this is a particular exciting field, since I have my primary interest in doing...