Deleted vs “Deleted”
This morning, in my Enfuse talk (MAC Times, Mac Times, and more) I made a blanket statement. I usually avoid these but, in this case, I made a deliberate blanket statement. I provided the example from the SANS Windows Forensic Poster and showed, from the poster, that MAC times are not updated when a file…
My New Company
Hi everyone. I just wanted to make a minute to let you know that in addition to my working at SANS I’ve also set up a company so that I can keep doing the forensics work that I love. I will, of course, continue to post here when I have something to say. I’ll also…
Awards Nomination Closing Date and News
A number of people have asked me about the closing date for the nominations for the Forensic 4:cast Awards. Well here it is: March 31, 2017 I will be accepting nominations as long as it is still March 31 somewhere in the world. I will then spend a couple of days tallying the nominations before…