The views expressed in this blog are those of the owner and do not reflect the views or opinions of the owner’s employer. All content provided on this blog is for informational purposes only. The owner of this blog makes no representations as to the accuracy or completeness of any information on this site or found by following any link on this site. The owner will not be liable for any errors or omissions in this information nor for the availability of this information. The owner will not be liable for any losses, injuries, or damages from the display or use of this information. This policy is subject to change at any time. The owner is not an attorney, and nothing posted on this site should be construed as legal advice. Litigation Support Tip of the Night does not provide confirmation that any e-discovery technique or conduct is compliant with legal, regulatory, contractual or ethical requirements.
Nirsoft has another get free utility called BlueScreenView, which can be downloaded here. BlueScreenView will generate a table listing information about the times in the past that your PC has crashed. It scans minidump files to get this information.
A minidump contains memory for a single process.
imagecacheviewer is another great free utility from Nirsoft. It scans image caches of web browsers (IE, Chrome, and FireFox) and lists images viewed on the web, and the metadata associated with them.
It's a great, simple forensics tool that lets you quickly collect important digital evidence.
'Forensically sound' is a term widely used in digital forensics and electronic discovery. A 'forensically sound copy' may be required for ESI to be admissible in court.
Rodney McKemmish is a former director of KPMG Forensic. His chapter "When Is Digital Evidence Forensically Sound?" for Advance in Digital Forensics IV, provides a precise definition of the term. See, McKemmish, R., 2008, in IFIP International Federation for Information Processing, Volume 285; Advances in Digital Forensics IV; Indrajit Ray, Sujeet Shenoi; (Boston: Springer), pp. 3–15, available at, https://link.springer.com/content/pdf/10.1007%2F978-0-387-84927-0_1.pdf . McKemmish reviews several authorities, including NIST’s Disk Imaging Tool Specification, and the Department of Justice's guide Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations. He gives four criteria for the term:
1. Has the meaning and, therefore, the interpretation of the electronic evidence been unaffected by the digital forensic process?
The binary data can not be changed. It will not necessarily matter that dates and times are displayed in different formats than are shown for the original data.
2. Have all errors been reasonably identified and satisfactorily explained so as to remove any doubt over the reliability of the evidence?
A forensic examiner has to identify and document errors in the process. Any changes must be accounted for. For example I/O errors should be recorded. These are Input/Output actions (e.g., reading or copying data) in accessing disks and drives.
3. Is the digital forensic process capable of being independently examined and verified in its entirety?
An audit trail should be created that outside parties can review.
4. Has the digital forensic analysis been undertaken by an individual with sufficient and relevant experience?
Only specialists should acquire the evidence.