"It was expected that timestamp resolution beyond seconds would be lost..." goo.gl/zFDhlJ #DFIR #eDiscovery

"Sometimes the requesting party requires a native file production, based solely on the benefits that they..." goo.gl/64iiY9 #Ediscovery #Dfir

"The xmpMM:History is an array of ResourceEvents that describe the steps taken to make the changes from..." goo.gl/5pBwDu #Dfir #Ediscovery

We recover the file system timestamps of a file attached to an email via Outlook goo.gl/17yo9d #DFIR #eDiscovery #DigitalForensics

Just published a new blog post on forensic authentication of Word documents and Compound File Binary format. m.klr.co/wfacfb #DFIR #eDiscovery

"The metadata load file would contain, among other things, the cryptographic hash of the original file as..." goo.gl/64iiY9 #Dfir

"Some of the XMP metadata properties in the XMP packet that can be interesting during PDF forensic..." goo.gl/5pBwDu #Dfir

"Additionally, having access to timestamps with 100-nanosecond resolution is useful in date forgery analysis" goo.gl/17yo9d #Dfir

"On a related note, even most mainstream computer forensics software do not display timestamps beyond..." goo.gl/zFDhlJ #DFIR

"For instance, a reviewer lacking the requisite experience can miss hidden content and comments in a..." goo.gl/64iiY9 #Dfir

"XMP allows metadata to be embedded into electronic documents, and enables software and systems to..." goo.gl/5pBwDu #Dfir

Does plucking the file from the filesystem and attaching it to an email result in total loss of filesystem metadata? goo.gl/17yo9d

"Full resolution timestamps can be obtained in numerous ways such as by reviewing the underlying raw..." goo.gl/zFDhlJ #DFIR

"When the end user accesses her e-mails over the web interface, the back-end data structures are queried..." goo.gl/64iiY9 #Dfir #Ediscovery

"According to the PDF 1.7 specification, the document information dictionary contains the following..." goo.gl/5pBwDu #Dfir #Ediscovery

Forensic Analysis of Email Attachment Timestamps in Outlook goo.gl/17yo9d #Dfir #Ediscovery #DigitalForensics

"File system timestamps are not designed to be manipulated by the end user — besides legitimate updates..." goo.gl/zFDhlJ #DFIR

"It is crucial to fully understand what it means to produce in native file format, and to weigh the..." goo.gl/64iiY9 #Dfir #Ediscovery

"The PDF might have been modified by someone in Eastern Standard Time (e.g., in winter) having rolled..." goo.gl/5pBwDu #Dfir #Ediscovery

"File system timestamps can survive the transit to the recipient’s mailbox, sometimes with 100-ns resolution" goo.gl/17yo9d #DFIR