In the conclusion to our 3 part series, we look at at how easy it is to make the wrong conclusion in examining deleted files based on MFT data.

The SANS 3MinMax series with Kevin Ripa is designed around short, three-minute presentations on a variety of topics from within Digital Forensics, Incident Response, and to a lesser degree, Information Security.

About the author:
An investigator at heart, Kevin Ripa bought his first computer as a tool for writing reports for his private investigation agency. As he worked through typical user issues, the "why" of what was going wrong in his machine kept him up at night. So Kevin turned his investigative skills toward his computer and quickly became fascinated by the world inside of it. Now a 25-year veteran of the digital investigations field, Kevin's enthusiasm has not waned: "IT security and digital forensics still inspire me every day, and I can't wait to wake up in the morning and get to work!"
Kevin is a SANS Certified instructor and the co-author of the SANS course FOR498: Battlefield Forensics and Data Acquisition. For more information about the course, visit: [ Ссылка ]

If you would like to suggest a topic for the next 3MinMax episodes, please email 3minmax@sans.org or reach out to Kevin via twitter at @kevinripa ([ Ссылка ])

свернуть