Yearly Archives: 2017

  • Deleted vs “Deleted”

    Posted on May 25, 2017 by Lee Whitfield in Technical Articles.

    This morning, in my Enfuse talk (MAC Times, Mac Times, and more) I made a blanket statement. I usually avoid these but, in this case, I made a deliberate blanket statement. I provided the example from the SANS Windows Forensic Poster and showed, from the poster, that MAC times are not updated when a file […]

    8 Comments.
    Continue Reading...
  • My New Company

    Posted on May 1, 2017 by Lee Whitfield in News.

    Hi everyone. I just wanted to make a minute to let you know that in addition to my working at SANS I’ve also set up a company so that I can keep doing the forensics work that I love. I will, of course, continue to post here when I have something to say. I’ll also […]

    No Comments.
    Continue Reading...
  • Awards Nomination Closing Date and News

    Posted on March 12, 2017 by Lee Whitfield in News.

    A number of people have asked me about the closing date for the nominations for the Forensic 4:cast Awards. Well here it is: March 31, 2017 I will be accepting nominations as long as it is still March 31 somewhere in the world. I will then spend a couple of days tallying the nominations before […]

    No Comments.
    Continue Reading...