Main Page

From ForensicsWiki
Revision as of 09:58, 13 March 2017 by .FUF (Talk | contribs) (Reverted edits by Jakymartain (talk) to last revision by Anjita)

Jump to: navigation, search

This is the Forensics Wiki, a Creative Commons-licensed wiki devoted to information about digital forensics (also known as computer forensics). We currently list a total of 924 pages.

Much of computer forensics is focused on the tools and techniques used by investigators, but there are also a number of important papers, people, and organizations involved. Many of those organizations sponsor conferences throughout the year and around the world. You may also wish to examine the popular journals and some special reports.


2016-03-30: Site Maintenance on 2016-04-01 Attention Forensic Wiki community, site maintenance will be occurring on 1 April 2016 from 9AM EST to 1PM EST. During this time Forensic Wiki will not be available as it will be offline to perform environment upgrades.

2015-08-26: – A support email address (support AT was created for all your forensicswiki needs. This is a mailing list that goes to the appropriate staff that will assist with site maintenance, issues, etc. If you have questions or issues with the site please send us an email.

2015-07-18: Forensic Wiki has been acquired by Harris Corporation for the betterment of the community. All licensing and data rights are staying the same, there’s just corporate funding behind the site now. The wiki will remain as an international resource, with no editorial input from Harris whatsoever. All of the existing editorial controls and checks and balances will remain in place. All of the existing accounts carry forward.

2013-05-15: You can now subscribe to Forensics Wiki Recent Changes with the ForensicsWiki FeedBurner Feed

Featured Forensic Research

May 2014

Sven Ka ̈lber, Andreas Dewald, Steffen Idler - Forensic Zero-Knowledge Event Reconstruction on Filesystem Metadata
Lecture Notes in Informatics P-228,2014
Author : Sven Ka ̈lber, Andreas Dewald, Steffen Idler
Title : Forensic Zero-Knowledge Event Reconstruction on Filesystem Metadata
In : Lecture Notes in Informatics -
Address :
Date : 2014

Abstract: Criminal investigations today can hardly be imagined without the forensic analysis of digital devices, regardless of whether it is a desktop computer, a mobile phone, or a navigation system. This not only holds true for cases of cybercrime, but also for traditional delicts such as murder or blackmail, and also private corporate investigations rely on digital forensics. This leads to an increasing number of cases with an ever-growing amount of data, that exceeds the capacity of the forensic experts. To support investigators to work more efficiently, we introduce a novel approach to automatically reconstruct events that previously occurred on the examined system and to provide a quick overview to the investigator as a starting point for further investigation. In contrast to the few existing approaches, our solution does not rely on any previously profiled system behavior or knowledge about specific applications, log files, or file formats. We further present a prototype implementation of our so-called zero knowledge event reconstruction approach, that solely tries to make sense of characteristic structures in file system metadata such as file- and folder-names and timestamps.

(See also Past Selected Articles)

Featured Article

Forensic Linux Live CD issues
Forensic Linux Live CD distributions are widely used during computer forensic investigations. Currently, many vendors of such Live CD distributions state that their Linux do not modify the contents of hard drives or employ "write protection." Testing indicates that this may not always be the case. Read More...


You can help! We have a list of articles that need to be expanded. If you know anything about any of these topics, please feel free to chip in.