Working cases the last week an old song that we sang as a kid at summer camp has been on my mind. The lyrics were something like this: Make new friends, but keep the old One is silver and the other gold This same sentiment should be applied to the forensic world as well. Rephrasing to: Find new artifacts, but keep the old One is silver and the other gold The recent cases I’ve worked have included new mobile tech we all need to know and learn. The thing is, it almost always also includes PCs as well. Many times it also includes some kind of P2P program from Ares and eMule to BitTorrent. Without fail, I continue to lean on the basic forensic knowledge I learned all those years ago from my first forensic training course in 2002. Basic metadata like OS file dates/times cannot be properly interpreted without knowing the version of Windows running on the system. (i.e. Last Accessed post Windows XP) Foundation