ZENA FORENSICS

Windows 10 prefetch files (*.pf) show a different file format compared to previous ones.  At first glance you'll spot no   textual   strings inside, and this was the initial reason that make me try to understand how they changed. quick&dirty journey I guess that neither you nor I will run into Windows 10 DFIR cases for a while. That's what I thought when Claudia Meda ( @KlodiaMaida ) contacted me, showing me a couple of Windows 10 prefetch files. She then provided me some interesting clues that tickled the curious george monkey  in me. Officially I do not have spare time, since it's already allocated, so I illegally used the non-existent spare time of spare time: please don't betray me... so I hope you'll tolerate any shortcuts in my quick&dirty  journey into the entrails of windows (disgusting, isn't it?). first lead First, what a nude prefetch file has to say? Check the first bytes in the next figure, which shows a prefetch file

The latest iOS update (iOS 8.3) is a real nightmare for digital forensics specialists. This article will try to clarify what can you really obtain from an iOS device with iOS 8.3. As we already know from Jonathan Zdziarski blog , with the introduction of iOS 8 is no longer possible to obtain a so called "Advanced Logical" acquisition based on lockdown service. However, when we find a device without passocode it is still possible to obtain a backup, although it may be password protected if the user has previously set a password for the local backup. In the same way we can perform a backup if we find a turned on and locked device, but only if we are able to find a pairing lockdown certificate and the device has been unlocked at least once by the user before the seizure. The same problem about an eventual backup password previously set by the device owner applies to this case too. The real nightmare is when, and this is the most common case, we have to acquire