Skip to main content

Posts

Showing posts from June, 2018

How to Explain Deleted Data: For Attorneys, Clients, Juries and More

How to Explain Deleted Data For Attorneys, Clients, Juries and More I was recently asked by a colleague for an analogy to help them explain how it was possible to recover data that a user had emptied from the Recycle Bin / Deleted. The question reminded me that it’s easy to slip into the belief that everyone inherently knows how stuff works. Attending forensic training and conferences we sometimes forget that what appears to us to be basic and simple, can sound like Star Trek Next Generation’s well known technobabble. i.e. “Increase the neutrino stream to the warp engine transducers”. Completing reviews of digital data and finding new artifacts can be exhilarating for a forensic investigator. The feeling of accomplishment at finding the truth from the data is euphoric. That is the fun part. The truly difficult part comes when we have to explain the information verbally and in written form so that it is useful to those that need it most. The recipients can include management, cl

Reviewing PDFs: Reports & Discovery

Quick Tip on Reviewing Report/Discovery PDFs Acrobat Document Scrolling Settings: Changing Acrobat so that documents are automatically set to Single Page Scrolling view as default This isn't my typical forensics blog, but I'm sure I'm not the only one that reviews numerous pages of reports/discovery before performing a forensic examination. If you are not reviewing reports prior to an exam, how do you know what you are looking for? I've always been annoyed by the default view in Acrobat. Trying to scroll through a PDF and having it jump to the next page when I'm still reading the previous page at the bottom. I seemed to waste time changing the Page Display setting under View for continuous scrolling. Not only does this make it easier to read, but it also makes scrolling through an OCR'd PDF faster. This is especially true when scrolling with a wheel-mouse, touchpad or on touchscreen computers.  1.             Open Adobe Acrobat