Chain-of-Custody Forms

Templates & Guides
New

unfurl

Tools
New
These remote lookups can add value to Unfurl, but they also come with risk (as Unfurl is sending out potentially-sensitive hashes to 3rd parties). ...

Hindsight

Tools
New
Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to sup...
New
This script is used only as an extension for X-Ways Forensics (32-bit). It calculates several different hashes for every marked file.

XMBRSum

Tools
New
X-Ways extension to calculate the MD5 sum of the first 440 bytes of sector 0 and compare with known goods.
New
The built-in Oracle viewer component used by X-Ways Forensics does not print some PDF documents properly. There seems to be an issue with the font ...
New
Home of the Metadefender OPSWAT extension for X-Ways that Polito Inc. developed for use with OPSWAT. Metadefender hash query extension for X-Ways ...
New
Description Starting with X-Ways Forensics v16.4 (released in early 2012), investigators have been able to automate and extend the functionality o...
New
Just download and save/move to your WinHex or X-Ways Forensics program folder. Templates are .txt files with a .tpl file extension, and can be view...

rds4xways

Tools
New
Extraction of SHA1 sets from Reference Data Set (RDS) provided by the National Software Reference Library (NSRL) for X-Ways Forensics (or any other...

DFIR Training Blog

Like many others working in DFIR, I occasionally get asked questions on how to get...
Only 10 ways? Probably a lot more. But these are the top 10 that I have seen (some...
DFIR Review – Year in Review Jessica Hyde > Hi!  We at DFIR Review wanted to ta...
Usually, in the “electronic discovery” world, evidence collection consists of si...
One of those common questions asked by attorneys to the DFIR professional is “Why ...
It’s been 5 years this month since DFIR.training started! From a little RSS fe...
This is where the saved minutes take your competence to a much higher level, faste...
Everything in this post applies to any career field, but I am targeting the DFIR...
A few years ago, I wrote a blog post on regulation in the Digital Forensics/Incide...
Hot
In short, everything happened at once or in short succession...the DFIR Training s...
Well, maybe I want a little more, but I would certainly be happy to win a full lic...
Today’s most common DFIR Go-Bag* is a remote connection from your lab to the colle...