July 2018
-
Drive acquisition with dc3dd
Step-by-step acquisition of a drive with dc3dd: identify the device, create a raw image with on-the-fly hashing and check the log.
-
Dump an Android partition for forensic analysis
How to create a bit-for-bit image of an Android partition over USB with adb, dd and netcat on a rooted device.
-
Install foremost on macOS
Two ways to install the foremost file-carving tool on macOS — with Homebrew or from source — plus a quick test to carve files from a disk image.