I access a files which name is "abc.doc", no doubt a lnk file "abc.doc.lnk" shows up. Few minutes or hours later I access "abc.doc" again, what will happen then? "abc.doc.lnk" still or another lnk file "abc.doc…

The scenario is about Business Secret and our client do worry about data leakage. They want to know whether Suspect copy those data to external hard drive or not. In fact it is not easy for Forensic guys to answer this question. Of course if you copy…

The examples in this topic focus on the following Sync Framework types: FileSyncProvider FileSyncOptions FileSyncScopeFilter SyncOrchestrator SyncCallbacks Understanding File Synchronization   Sync Framework implements a synchronization provider that…

My friend is a developer and her colleague May was suspected of stealing the source code of an important project "X". The Police searched her apartment and seized her brand new laptop which OS is Win10 Pro.  Forensic guy Terry used EnCase to do…

原文: http://www.networkworld.com/article/2931534/it-management/what-are-unix-swap-swp-files.html --------------------------------------------------------------------------------------------------------------- When someone mentions a "swap file",…

https://msdn.microsoft.com/en-us/sync/bb887623 Introduction to Microsoft Sync Framework File Synchronization Provider Introduction Microsoft Sync Framework is a comprehensive综合 synchronization同步 platform that enables collaboration合作 and offline scena…

QUESTION 13 View the Exhibit.Examine the following command that is executed for the TRANSPORT table in the SH schema:SQL> SELECT DBMS_STATS.CREATE_EXTENDED_STATS('sh', 'customers_obe', '(country_id,cust_state_province)') FROM dual;Which statement des…

Total Commander 8.52 Beta 1http://www.ghisler.com/852_b1.php 10.08.15 Release Total Commander 8.52 beta 1 (32/64) 05.08.15 Fixed: Windows 10: Loading drive buttonbar hanging on some devices (e.g. Surface Pro 3) when SD-Card was in internal card reade…

Name                                             Disclosure Date  Rank    Description ----                                             ---------------  ----    -----------    aix/hashdump                                                      normal  A…

When it comes to lnk file analysis, we should put more emphasis on the volume serial number. It could help forensic guys to identify whether files exist(ed) on certain volume or not. Let's take a look at lnk files as below: 1. Take a look at AndroidG…