In doing some manual parsing of files from sample forensic images I came across two different databases related to information from the Google Docs application. Cello.dbFirst up is the Cello folder and database found at:data\data\com.google.android.apps.docs\app_cello\<ACCOUNT_NAME>\cello.dbThe main tables of interest were:itemsdeleted_itemsFor all images I had (Magnet CTF and Josh Hickman samples) "deleted_items"... [Read More]

 Previous (Android): Week 1 | Week 2 | Week 3 | Week 4Previous (Linux): Week 5 | Week 6 | Week 7 | Week 8Previous (Memory): Week 9 | Week 10As we continue moving on, we get more memory questions around IP addresses and URLs. These ones were quick to solve with the knowledge (and most of the heavy lifting) done from last week.Challenge 11 (Dec... [Read More]

 Previous (Android): Week 1 | Week 2 | Week 3 | Week 4Previous (Linux): Week 5 | Week 6 | Week 7 | Week 8Previous (Memory): Week 9Using the same image as week 9 we can again dive into Warren's memory banks for more questions, this week supplied by Jamey Tubbs.Challenge 10 ( Dec 7 - 14) Part 1 (15)*At the time of the... [Read More]

Previous (Android): Week 1 | Week 2 | Week 3 | Week 4Previous (Linux): Week 5 | Week 6 | Week 7 | Week 8With month 2 in the book, we kick off Memory for the month of December! Aaron Sparling kicks it off with seven (yes, seven!) questions with lots of points up for grabs.Image File: LinkChallenge 9 ( Nov 30 - Dec... [Read More]

As part of my own benefit I created a Start.Me page for a bunch of FOSS forensic tools and utilities that I currently have in my toolkit. I've also included RSS feeds for blogs I follow as well as YouTube channels and some other links to sites I frequent.You can... [Read More]