Meridian Discovery

Just published a new blog post on forensic authentication of Word documents and Compound File Binary format. https://m.klr.co/wfacfb #DFIR #eDiscovery

We recover the file system timestamps of a file attached to an email via Outlook https://goo.gl/17yo9d #DFIR #eDiscovery #DigitalForensics

"The xmpMM:History is an array of ResourceEvents that describe the steps taken to make the changes from..." https://goo.gl/5pBwDu

"Sometimes the requesting party requires a native file production, based solely on the benefits that they..." https://goo.gl/64iiY9

"It was expected that timestamp resolution beyond seconds would be lost..." https://goo.gl/zFDhlJ #DFIR #eDiscovery

"File system timestamps can survive the transit to the recipient’s mailbox, sometimes with 100-ns resolution" https://goo.gl/17yo9d #DFIR

"The PDF might have been modified by someone in Eastern Standard Time (e.g., in winter) having rolled..." https://goo.gl/5pBwDu

"It is crucial to fully understand what it means to produce in native file format, and to weigh the..." https://goo.gl/64iiY9

Forensic Analysis of Email Attachment Timestamps in Outlook https://goo.gl/17yo9d

"According to the PDF 1.7 specification, the document information dictionary contains the following..." https://goo.gl/5pBwDu #Dfir #Ediscovery

"When the end user accesses her e-mails over the web interface, the back-end data structures are queried..." https://goo.gl/64iiY9 #Dfir #Ediscovery

"Full resolution timestamps can be obtained in numerous ways such as by reviewing the underlying raw..." https://goo.gl/zFDhlJ #DFIR

Does plucking the file from the filesystem and attaching it to an email result in total loss of filesystem metadata? https://goo.gl/17yo9d