Well done is better than well said.

Towards the end of 2011 I was nearing graduation for my Master’s degree in Digital Forensics from the University of Central Florida and I was looking to further bolster my resume by adding more “keywords” to it. Rather than having just Windows and Linux, I wanted to add Mac to the list, so I bought a Macbook Pro. When is the best time to buy a Mac? Purchasing on Black Friday got me a nice discount, which was then even improved upon by Amazon. Without the student discount, their pricing was still lower than Apple’s with the student discount (Apple charges for shipping).

So the Mac arrives and it works. A few weeks in and I have no sound. What is going on here? Aren’t these things supposed to be the best computers out there and Windows sucks, yadda yadda yadda? Apparently not, because I have no audio!

Not knowing much about the workings of an Apple laptop, I do what I would in Windows, I open up the Task Manager, or Activity Monitor on a Mac. To do this, go to Launchpad > Utilities > Activity Monitor. (There is no shortcut to Activity Monitor, but you can create one or use Spotlight by pressing Command + Space, then start typing Activity Monitor. By default, Activity Monitor opens with My Processes displayed; I don’t want My Processes, I want All Processes, because it’s going to be running at the system level.

Activity Monitor has a great feature in the upper right, next to the dropdown to select All Processes, called a search filter. If you search for sound, nothing appears, BUT if you search for audio, you get one process: coreaudiod. Notice that the user is _coreaudiod, so this would not present itself if we were searching in My Processes.

Read more

I’m very excited to announce that I will be upgrading this website to my own unique layout with an amazing personal branded logo. I think the logo turned out great, let me know what you guys think.

The logo and layout are being designed by Logiq Design. Truly a job well-done!

The Syngress book Digital Triage Forensics: Processing the Digital Crime Scene by Stephen Pearson and Richard Watson is an interesting book that will most likely not be helpful to many people. What I mean by this is that Digital Triage Forensics (DTF) is about responding to a battlefield scene and preserving the evidence, while getting valuable intel as quickly as possibly. Performing exams on the battlefield isn’t something you’re going to do unless you want to get shot by a sniper, mortared, etc., so the standard Computer Forensic Field Triage Process Model (CFFTPM), is not the best choice, which is why DTF has been developed.

Chapter 4 Using the DTF Model to Process Digital Media has some nice information in it for someone looking for introductory material to the computer forensics field. DTF explains the differences between physical and logical drives with a library analogy, the hardware needed to conduct an exam, and some software available for use to help throughout the exam. The material is delivered in an easy to understand manner, but again, it’s basic.

Chapter 5 Using the DTF Model to Collect and Process Cell Phones and SIM Cards was a decent chapter on cell phone collections, but again, no ground breaking research here. There are some tools covered that show they are certainly worthy of being mentioned, such as the HTCI Isolation Chamber. However, there is not much presented here that is not covered in the introduction level books to mobile forensics. Read more