Quick Tip: In PowerShell you can quickly hash files and output to CSV by using the following command: Get-ChildItem -path "E:\Folder_To_Hash\" -recurse | Get-FileHash -Algorithm MD5 | Export-Csv -path F:\Example_Artifacts_Report.csv -NoTypeInformation

Quick Tip: Are you working a case involving an SD Card? Serial numbers of SD Cards are generally not passed through to the Windows OS. Instead, the serial number of the SD Card reader that was used is left behind in forensic artifacts such as the Registry and Event Logs.

Quick Tip: Some PC laptops do not have a removable SSD. Imaging these devices can be challenging. You can use Paladin by SUMARI to boot to a forensically sound environment and image to an external harvest drive. SUMURI

Be sure to follow Artifact Intel for tips, tricks, and write-ups on digital forensic topics to help you with your digital forensic investigations ~

What is your favorite digital forensics suite? Comment below....