Monthly Archives: May 2017

  • Deleted vs “Deleted”

    Posted on May 25, 2017 by Lee Whitfield in Technical Articles.

    This morning, in my Enfuse talk (MAC Times, Mac Times, and more) I made a blanket statement. I usually avoid these but, in this case, I made a deliberate blanket statement. I provided the example from the SANS Windows Forensic Poster and showed, from the poster, that MAC times are not updated when a file […]

    2 Comments.
    Continue Reading...
  • My New Company

    Posted on May 1, 2017 by Lee Whitfield in News.

    Hi everyone. I just wanted to make a minute to let you know that in addition to my working at SANS I’ve also set up a company so that I can keep doing the forensics work that I love. I will, of course, continue to post here when I have something to say. I’ll also […]

    No Comments.
    Continue Reading...