Wylie, Texas

Year: 2017

Deleted vs “Deleted”

This morning, in my Enfuse talk (MAC Times, Mac Times, and more) I made a blanket statement. I usually avoid these but, in this case, I made a deliberate blanket statement. I provided the example from the SANS Windows Forensic Poster and showed, from the poster, that MAC times are not updated when a file…
Read more

My New Company

Hi everyone. I just wanted to make a minute to let you know that in addition to my working at SANS I’ve also set up a company so that I can keep doing the forensics work that I love. I will, of course, continue to post here when I have something to say. I’ll also…
Read more

Awards Nomination Closing Date and News

A number of people have asked me about the closing date for the nominations for the Forensic 4:cast Awards. Well here it is: March 31, 2017 I will be accepting nominations as long as it is still March 31 somewhere in the world. I will then spend a couple of days tallying the nominations before…
Read more