Created: Saturday, 05 January 2013
Updated: Saturday, 01 June 2024

In March 2024, all backed and client libraries are updated, and the site moved to python3.12 rutime.

In April 2023, this site was migrated to GAE standard environment using python3.10 rutime. All back end libraries have been updated as well. Client code stills uses backbone and jquery, but it is planned to move to more modern js frameworks and completely get rid of jquery. A lot of functionality had to be removed due to Google abolishing respective backend apis. For more details read below what has changed.

This site was completely revamped in 2017 using the following technologies:

  • ~~twitter bootstrap4 as html template~~, icons by fonts-awesome
  • site fonts served by google-fonts
  • server side code, flask (a python microframework)
  • ~~search engine: GAE + twitter typeahead~~
  • client side CRUD actions based on backbone framework (REST support included)
  • textarea uses markdown syntax
  • persistence by Google Datastore
  • hosted on Google App Engine
  • unit testing GAE testbeds + nosetests
  • js,css, html minification achieved with gulp4
  • ~~continuous deployment using TravisCI.~~
VirusTotal Hashwindowsntfsraid EnCase6 unallocated policy MD5 directory entry $DATA forensics ntfsfat32CV recovered fileCV security file systems ADS $MFTpassword $mft

Understanding $DATA attribute

The following scenario demonstrates a potentially confusing situation you might face as an investigator. Knowing extensively the NFTS internals...

Password policies - Password creation

Designing a password policy for applications facing the internet has always been a hot issue. Basically, the decision to enforce a set of...

Recovering a deleted file from FAT32

Assume you use a forensic software that has recovered file system metadata of a deleted jpeg file from a FAT32 formatted volume with a cluster...

Reconstructing a RAID 5 that holds an NTFS volume without knowing its configuration.

To save readers' precious time I would like to emphasize the fact that that this guide applies in raids containing an NTFS formatted...

Questions on File Systems and Windows Forensics.

Below you will find questions that test your knowledge on this subject. I wrote them while I read material mainly from books in file systems...

VirusTotal EnCase6 Hash Set

For the examiners who wish to locate malware in EnCase 6 based on virus signature, I have downloaded the latest VirusTotal database and...


Since March 2012, I work as a digital forensics examiner, I examine cases such as copyright infringements, data breaches, hacking (defacing,...

© 2012 - 2024 Armen Arsakian updated atSaturday 01 June 2024Contact: contact at

-2569 . 4516