Digital Forensic Blog

We've written about a few topics here that interest us.

Introducing Pipe Viewer

The Linux Pipe Viewer command shows a progress bar for the volume of data passing through it. Used with commands like DD, it can be used to show the progress of data acquisition

Using Windows Subsystem for Linux for forensics

WSL is a powerful tool that allows Bash scripts and Linux programs to be run on a Windows system. This can also be set up on an offline system, which is best practice configuration for forensic workstations and we show you how we've set this up.

Profiling a Windows disk image with sysprofiler

sysprofiler is a bash script that extracts many common artefacts from a Windows disk image. It supports raw and E01 images and runs on a Linux command line or using WSL.