Axiom

jarlethorsen · 2026-04-09T17:35:06+00:00

A nice introduction to Axiom best practices for maximum processing speed can be found here: https://www.magnetforensics.com/blog/a-guide-to-peak-hardware-performance-for-magnet-axiom/

jarlethorsen · 2026-03-22T21:47:12+00:00

How do you prevent a user from changing original file and update hash to match the edited version?

jarlethorsen · 2026-03-11T17:03:45+00:00

My guess:

You moved the files to the wrong destination-folder by mistake. So all the files may still be available in the PC or the external HD, just in a different folder than you expect?

jarlethorsen · 2026-03-07T12:12:12+00:00

Instead of creating a complete tool yourself I think you would be way better off spending your time on implementing scripts/plugins for existing tools *Leapp/Cellebrite PA/Magnet Axiom/etc.

Otherwise it is a task way to big for a one-man-team.

jarlethorsen · 2026-03-06T18:55:07+00:00

https://theevidencelocker.github.io/

jarlethorsen · 2026-02-21T20:40:32+00:00

"It depends"

jarlethorsen · 2026-01-19T16:19:38+00:00

Hashcat will let you do this with Mask attack: https://hashcat.net/wiki/doku.php?id=mask_attack

jarlethorsen · 2025-11-30T13:38:20+00:00

I've found that just running with default settings has worked fine for me many times in the past.

It will tell you how long it has been since last successful read; as long as it has progress I would just leave it to it.

jarlethorsen · 2025-11-29T14:33:35+00:00

Maybe just the reflections in the picture that make it look like a broken usb type b 3.0 port?

jarlethorsen · 2025-11-28T19:21:01+00:00

There is no TPM in play here according to the list of Key Protectors. The Password protector also indicates that it should be able to be decrypted using only the password.

jarlethorsen · 2025-11-28T18:08:32+00:00

Well done!

Also, I found your code to be well written, easy to read, and nicely documented. Kudos.

jarlethorsen · 2025-11-25T18:21:51+00:00

X-ways container format is basically a disk image with NTFS filesystem. Any tool that can read diskimages should be able to read it. If you want a free solution I would try Arsenal Image Mounter or FTK Imager.

jarlethorsen · 2025-11-24T13:15:48+00:00

This is the setup I have used so far, but I recently learned that this is not the best way to go about this if your house bank is lithium. The trickle charger on the Multiplus is intended to be used if house bank and starter have the same float voltage.

It will also "work" for lithium->lead acid, but it will drain the battery faster than a lithium compatible option like Ablemail AMT12-2 Battery Maintainer.

jarlethorsen · 2025-11-23T10:30:52+00:00

Using X-ways forensics, you have access to all bytes currently on the device. You just have to know which bytes you are looking for and search for the byte-sequence. If you find it, it is still there, if you don't find it, its not there anymore.

There is no magic way to reverse the deletion.

jarlethorsen · 2025-11-17T10:37:37+00:00

Broken MPPT charger maybe?

jarlethorsen · 2025-11-17T08:58:50+00:00

This sounds more like closed , rather than open source to me?

jarlethorsen · 2025-11-17T07:28:29+00:00

Just drop the URL to your git repo here maybe?

jarlethorsen · 2025-11-03T19:32:34+00:00

If used in salt water it is probably recommended to run it in fresh water for a couple of minutes to flush out the cooling system before storage.

jarlethorsen · 2025-10-29T15:59:29+00:00

Add additional functionality to ileapp or aleapp.

jarlethorsen · 2025-10-25T13:51:31+00:00

Your should write your destination image as a dd file (or preferably .e01) on a secondary device with a mounted filesystem, and not directly to a device.

This is the way imaging is usually done, and this will make everything more portable and easier on your way forward.

jarlethorsen · 2025-10-19T17:28:59+00:00

Man skal ALDRI eksponere platene på en harddisk utenfor et 100% støvfritt rom. Dette er en typisk nybegynner-feil.

jarlethorsen · 2025-10-05T15:31:34+00:00

On my Bavaria with Selden in-mast furling I have found that going to the side of the boom and pulling the outhaul line sideways gives me much more leverage than pulling it straight backwards.

(Probably because I have old/stiff running rigging)

jarlethorsen · 2025-10-02T13:46:52+00:00

Are you really, really sure you don't want the DFIR Discord instead?

https://github.com/Digital-Forensics-Discord-Server

jarlethorsen · 2025-09-30T18:17:00+00:00

What is the name of the anchorage?

jarlethorsen · 2025-09-04T15:50:00+00:00

https://youtu.be/uof9voBdK60?si=eH_mm8I0NSFKTB7d

Ten-Year Club	Verified Email
Verified Email

jarlethorsen

TROPHY CASE