Wylie, Texas
lee@forensic4cast.com

Blog

2019 Forensic 4:cast Awards – Coming Soon

January is that special time of year when a jolly old Englishman opens the nominations for the Forensic 4:cast awards. Nothing is changing in that regard, but changes to the awards themselves are definitely coming. Here’s what’s going to be different this year… Nominations – The nomination process will largely stay the same. The only…
Read more

Gamble? Not with your future.

Honestly, I’ve never been big into gambling. The closest I’ve come is buying a lottery ticket when I was 18. While I understand the excitement, the science, and compulsion, it has just never been a huge draw for me personally. There are many things that fall into the category of gambling. You can choose to…
Read more

Changes to the Forensic 4:cast Awards

In June we held the tenth annual Forensic 4:cast Awards. This also signaled the ninth year of us holding the awards at the SANS DFIR Summit. After the awards in June I felt somewhat discouraged that many of the awards went unclaimed. I asked for suggestions on how to best improve the awards (see here:¬†https://forensic4cast.com/2018/06/future-of-the-forensic-4cast-awards/).…
Read more

Future of the Forensic 4:cast Awards

Fear cripples us. It stops us from making decisions, leaving us in limbo. I have fears about the Forensic 4:cast Awards and, after 10 years of the awards, I’m ready to tackle those fears and improve them. I’m sure that SANS will release the video of the awards in due time and, when it does,…
Read more

Forensic 4:cast Awards 2018 – Voting is Open

The nominations have been tallied (sorry for the lateness, life is very busy) and the nominees have been decided. They are as follows: Computer Forensics Software of the Year Magnet Axiom/IEF Belkasoft Evidence Center X-Ways Forensic Digital Forensic Blog of the Year Forensic Focus Blog Murphy’s Laws of Digital Forensics This Week in 4n6 Phone…
Read more

Forensic 4:cast Awards 2018 – Nominations are Now Open

If you don’t know anything about the Forensic 4:cast Awards, where have you been for the past nine years? Every year we celebrate the achievements of digital forensic investigators around the world by giving awards to those that have been deemed as worthy by their peers. There is no advisory panel, no interference in the…
Read more

Deleted vs “Deleted”

This morning, in my Enfuse talk (MAC Times, Mac Times, and more) I made a blanket statement. I usually avoid these but, in this case, I made a deliberate blanket statement. I provided the example from the SANS Windows Forensic Poster and showed, from the poster, that MAC times are not updated when a file…
Read more

My New Company

Hi everyone. I just wanted to make a minute to let you know that in addition to my working at SANS I’ve also set up a company so that I can keep doing the forensics work that I love. I will, of course, continue to post here when I have something to say. I’ll also…
Read more

Awards Nomination Closing Date and News

A number of people have asked me about the closing date for the nominations for the Forensic 4:cast Awards. Well here it is: March 31, 2017 I will be accepting nominations as long as it is still March 31 somewhere in the world. I will then spend a couple of days tallying the nominations before…
Read more

MacOS Timestamps from Extended Attributes and Spotlight

I started this whole thing just with a general idea that I want to track times across USB devices on MacOS. As I went further down the rabbit-hole, however, I seem to have gotten lost and can’t seem to find my way back without finding more unexplored tunnels. It seems as if there are more…
Read more