A recent case conducted by Athena Forensics involved mobile phone evidence and allegations that, following an examination and report by the Police, the Defendant had deliberately downloaded indecent images of children to his Samsung mobile phone. The Defendant denied these allegations and Athena Forensics were instructed to carry out a review of the Prosecution evidence. […]
News
Windows File Time/Date Stamps Explained
How Time/Date Stamps can Assist in Proving the Provenance of a File An operating system normally maintains information about a file that includes a time/date stamp. The time/date stamp can record the point that a file had been created, altered and accessed and is generated by the computer’s system clock. By investigating the time/date stamp […]
Master File Table (MFT)
What is the Master File Table? When files are stored on a Windows computer using the NTFS file system, such as images or documents, physical clusters are allocated to the file and the location of the clusters containing the file are recorded within the Master File Table (MFT) that is maintained by the operating system. […]
Thumbcache Images
Thumbcache Images – An Overview Thumbcache files are database files that are automatically generated by the Microsoft Windows operating system from Windows Vista onwards within the ‘hidden’ system directory located at the path \Users\[User Profile Name]\AppData\Local\Microsoft\Windows\Explorer\. How are Thumbcache Images Stored? Images within the Thumbcache files are automatically stored when a folder on the computer […]
File Slack Space
What is File Slack Space? File slack space occurs when a smaller file overwrites a larger one. File Slack space is the difference between the logical end of the file and the physical end of the area containing the file. A simple comparison would be when a one-hour film overwrites a two-hour film on a […]
