Unique Windows Registry data in Fast Boot hibernation and hive transaction logs

I was asked to take a recent flurry of Tweets and turn them into an Insights post with more detail. So, here goes! We have spent some time at Arsenal looking at particularly important Windows Registry keys which are sometimes only found, in their most recent state, within Fast Boot hibernation and/or Registry hive transaction logs. …

Continue reading "Unique Windows Registry data in Fast Boot hibernation and hive transaction logs" »

Integrating Arsenal Image Mounter Source Code and APIs

Arsenal Image Mounter was born when we found existing disk image mounting technology lacking during the development of our premier digital forensics tool Registry Recon. Since we now have quite a bit of experience being in a position where a powerful disk image mounter would take our project to the next level, we offer the …

Continue reading "Integrating Arsenal Image Mounter Source Code and APIs" »

Arsenal Consulting’s President Selected to Open the OverDrive Hacking Conference

Attendees Will Learn About Electronic Evidence Tampering that Evaded Detection by Digital Forensics Experts Mark Spencer, President of Arsenal Consulting (ArsenalExperts.com) has been selected to open the OverDrive hacking conference in Spain with the most recent version of his award-winning presentation “High Stakes Evidence Tampering and the Failure of Digital Forensics” on April 18. The OverDrive …

Continue reading "Arsenal Consulting’s President Selected to Open the OverDrive Hacking Conference" »

Windows Hibernation Infographic

Why did we design the Windows hibernation infographic? You can imagine how many emails we get about Windows hibernation files since we released Hibernation Recon. We noticed some misconceptions being repeated in these emails, so we decided to address them in an infographic that the digital forensics community could use as a resource and help us improve. We …

Continue reading "Windows Hibernation Infographic" »