Login

r/computerforensics

Bitlocker Suspended / Waiting for Activation
▲ 8 r/computerforensics

Bitlocker Suspended / Waiting for Activation

Hello all

We have a couple of Windows devices in the past that either had Bitlocker suspended or "Waiting for Activation". The latter is often the case with freshly shipped Windows 11 devices. In those cases, the the volume is encrypted using a clear key protector, see:

https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/planning-guide#bitlocker-provisioning

There is no active key protector (i.e. no recovery key, no password or anything) that could be extracted.

In those cases, we can image the device with for example FTK Imager, but when opening the image, FTK cannot read it. However, when we for example mount it in Windows as a volume in FTK Imager, the whole disk is readable.

Does anyone know how to avoid this issue, which tools (e.g. Encase, X-Ways, Autopsy,...) have no issue with reading the E01 or how you typically deal with this?

We want to of course avoid changing any setting on the device before acquiring the disk and we would like to directly work on the physical acquisition / E01.

u/Suitable-Reason-9325 — 7 days ago
▲ 13 r/computerforensics

Need Help!!! A Friend Was Hit By A Van, An AI Manipulated dashcam Video Is Suspected.

EDIT: shortened and added red flags

I’m posting this for a friend who was seriously hurt while on electric scooter crossing on green light using pedestrian crossing.

There are some concerns about the dashcam video that was provided afterward by the driver who hit her, and we’re trying to figure out whether it’s worth hiring a digital forensics investigator to look at it.

Her lawyer says the video is fine, and if she wishes to challenge it she has to pay put of pocket

My friend remembers the vehicle approaching in one lane, changing lanes, and then hitting her. But in the video we were given, the clip only starts a few seconds before the impact, and the vehicle already appears to be in the lane where the collision happens.

Red flags we’ve found with the dashcam video:

The metadata contains “WXVer,” which appears to be connected to WeChat, and the file creation date is later than the date shown inside the recording. That strongly suggests the file we received is not the untouched original dashcam file and went through some kind of processing/export/sharing first.

The resolution is only 480×360. That seems extremely low compared with what the dashcam would normally record, so a lot of the original image detail has been lost.

The file is a MOV/H.264 file that has been re-encoded. So this is not the original camera recording in its native form. Re-encoding can also remove some of the technical information.

If you’re a digital forensics investigator and would be willing to review the video, please DM me.

reddit.com
u/d666ane — 11 days ago
▲ 12 r/computerforensics

Unexplained NTFS ACL change — what artifact am I missing?

I'm investigating an unexplained ACL change on a Windows 10 Pro 19045 NTFS volume.

A folder was created on E:\ at 22:27:07 on 2026-10-03 and initially inherited an Authenticated Users (AU) ACE. By 22:54:19, the ACE and inheritance were gone.

I'm trying to determine what process/account caused the change.

What I checked

I collected and examined Security.evtx, SYSTEM/SOFTWARE hives, BAM/DAM, Prefetch, ActivitiesCache, Amcache, NTFS Operational and Storport logs.

Key findings:

No 4670 events in the available Security log retention.

icacls.exe first Prefetch creation: 23:04:50 (after the window).

No takeown.exe Prefetch or BAM entry.

No ACL-capable executable appears in BAM during the window.

PowerShell 5.1 was not running during the window.

cmd.exe was active 22:27:29–22:33:29, but its command history is unavailable.

Explorer was active around the event.

pwsh.exe cannot be confirmed or excluded.

No useful NTFS/storage event links to the change.

The relevant window is approximately:

22:27:07 → 22:54:19

Question

Is there another Windows forensic artifact or technique I should check that could identify the process/account that modified the security descriptor?

Or is this simply impossible to attribute retrospectively because File System Object Access auditing/SACLs were not enabled?

I'm particularly interested in artifacts that could distinguish an explicit ACL write from inheritance/security-descriptor behavior during folder creation.

reddit.com
u/No-Stage5475 — 11 days ago
▲ 28 r/computerforensics

Digital Forensics Tech exemptions

Greetings, I hope all is well! Long story short, recently got my Masters in Digital Forensics, and I also have received an opportunity for a digital forensics technician role for a local LE agency. I am just wondering if anyone here works for one, and also what to expect, as I myself come from an IT support background. Thanks!

Edit: Expectations, just realized I made a typo in my title

reddit.com
u/Quiet_Gas_3908 — 14 days ago
▲ 6 r/computerforensics

Best way to decrypt a file vault encrypted USB drive and image the data

Hi all,

I’m working on a case with a USB drive that appears to be encrypted with FileVault. The drive was already imaged and we allegedly have the password, but I’m looking for a way to decrypt/image the FileVault partition without altering the data.

I’m hoping someone can point me in the right direction. Does this drive need to be connected to a Mac computer to enter the password, or is there other software that can perhaps mount the image on a Windows machine? Maybe Mount Imager Professional?

If the drive has to be connected to a Mac computer, what’s the best way to image just that partition? (There were other partitions on the drive that were not encrypted.)

Years ago, there was FTK Imager for Mac - I’m not sure if that is still around and supported.

Any insight is appreciated. Thanks in advance.

reddit.com
u/hotsausce01 — 12 days ago
▲ 7 r/computerforensics

Time machine backups

Does anyone have forensic articles that reference time machine backups? Like if a macOS has 6 backups stored do you need to process all?

reddit.com
u/EmoGuy3 — 14 days ago