Ann Bransom

Hunting for File Deletion Artifacts in Google File Stream Data

My current obsession is Google Drive for Desktop File Stream data. But the deleted Google Drive file artifacts are responsible for multiple weeks of sleepless nights. Just. Too. Good.

Read More

Digital Forensics – How Do Images End Up in iOS Safari’s Cache.db

As digital forensic examiners, we often find….um….interesting images in web browser caches. In our iOS mobile device extractions, we are presented with tons of thumbnails with the source file of Cache.db. Can we use these as evidence? Are those creation times trustworthy? Nerd out with me on iOS Safari artifacts and see why images end up in cache.db and, more importantly, why you should be VERY careful when using these artifacts as evidence in your cases.

Read More