PaulDotCom mailing list archives

Anti-forensic tools

From: iamnowonmai at gmail.com (iamnowonmai)
Date: Wed, 1 Jul 2009 07:37:30 -0400

Excellent point - it is often overlooking the simplest things that weed out
bad analysts and even catch some good ones. Dave Hull posted a blog entry on
how to natively change timestamps within Windows Vista (and 7 I believe) not
that long ago.

On Wed, Jul 1, 2009 at 5:07 AM, Ali Emirlioglu <ali.emirlioglu at gmail.com>wrote:

Don't forget about changing timestamps! It's a good way to catch out bad
forensic analysts and will give good ones a headache or even a ruined day if
you're lucky :P

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20090701/e2535715/attachment.htm

Current thread:

Anti-forensic tools Xander Solis (Jul 01)
- <Possible follow-ups>
- Anti-forensic tools Ali Emirlioglu (Jul 01)
  - Anti-forensic tools iamnowonmai (Jul 01)
    - Anti-forensic tools d4ncingd4n at gmail.com (Jul 01)
    - Anti-forensic tools Adrian Crenshaw (Jul 01)
- Anti-forensic tools Chris Merkel (Jul 01)
- Anti-forensic tools Jim Halfpenny (Jul 01)
- Anti-forensic tools Jody & Jennifer McCluggage (Jul 01)
  - Anti-forensic tools Joel Folkerts (Jul 01)
    - Anti-forensic tools Adrian Crenshaw (Jul 01)
- Anti-forensic tools Mad Marv (Jul 01)
- Anti-forensic tools Cody Ray (Jul 01)
- Anti-forensic tools Chris Merkel (Jul 01)

(Thread continues...)