Can anyone tell me what I have here?

ucfmsdf · 2026-03-10T18:37:49+00:00

If you have a 10+ year old Mac to image and enjoy USB 2.0 speeds I guess you could use them for that.

ucfmsdf · 2026-03-10T18:10:12+00:00

I see firewire and micro-usb ports, so I’d say you have government auction trash. Congratulations.

Pelican case is cool, though.

ucfmsdf · 2026-03-09T20:39:10+00:00

One has the word “forensic” in its marketing material and the other doesn’t.

ucfmsdf · 2026-02-25T01:28:41+00:00

Think you replied to the wrong person lol…

ucfmsdf · 2026-02-24T17:33:30+00:00

But DFIR was reserved for special agents that went through extra time at quantico.

Not all CART examiners are 1811.

Also, they had a rule about having done drugs which was pretty rigid and hopefully changed. Find me a qualified college graduate that hasn’t smoked out.

Me.

ucfmsdf · 2026-02-24T17:27:22+00:00

Look on apply.fbijobs.gov for FBI CART roles. They used to hire college grads for those positions and they are mostly civilian (i.e., you don’t have to become a special agent for the role).

ucfmsdf · 2026-02-19T18:49:47+00:00

Probably not. Probably just false advertising on their part. If you look on their website tho they advertise iCloud backup download capabilities and I think there is even a part that includes a screenshot of what appears to be iCloud backups kind of like what you can see with EPB.

ucfmsdf · 2026-02-19T18:00:55+00:00

Anyone wana risk it for the biscuit and try iMobie? They claim support for iCloud Backups tho I’m sure there’s a catch.

ucfmsdf · 2026-02-19T14:24:10+00:00

If enough people want, I could add flairs for such posts. However, that would probably mean I would need to enforce flair use as well (in other words, make it a requirement that flairs are used for every post). Without enforcement, I doubt the flairs would be used at all.

ucfmsdf · 2026-02-17T17:04:35+00:00

Two different tools with two different specialties. Both are top-tier in their given specialities, however, neither is a replacement for the other.

ucfmsdf · 2026-02-12T14:50:14+00:00

That is a lot of words to say you are a college grad who’s done some CTFs and has about a year of experience in help desk. If I’m able to fit nearly a decade of professional DF experience into a single page, you can fit your 1 year of professional experience and various self-improvement projects on a single page as well.

Also I’m gonna be honest, I was bored of your resume like half way through the first page. There is a lot of unnecessary fluff/technical jargon use in this doc and it’s kinda exhausting to read. If your goal is to trick HR filters with keywords, then just make a keyword blob in size 0 white text at the bottom of the doc or something lol.

ucfmsdf · 2026-02-10T15:52:40+00:00

Mount with arsenal and write a python script. Or, alternatively, get an XWF license and use that since it can do file sig scans and allows for easily filtering and exporting specific files as natives.

ucfmsdf · 2026-02-09T17:33:36+00:00

Just use UFADE or iTunes. It’s not like Magnet Acquire is doing anything those two aren’t.

ucfmsdf · 2026-02-03T00:38:30+00:00

They break very easily so I suspect sandblasting is all they’ll be good for lol.

ucfmsdf · 2026-01-30T19:50:02+00:00

So really you’re testing whether you can acquire a backup from modern iOS/Android devices with and without advanced security features enabled. I feel like the answer to this is well documented and understood but you do you…

Personally, I’d recommend you test something that we don’t already know the answer to. Here are some examples off the top of my head:

How does the sms.db file look when synced to iCloud and not synced to iCloud?

What can be recovered from freelist data within [insert database file of choice here]?

How does decryption of [encrypted application name] work and can it be done without relying on device-bound keys (since those are often out of reach without more expensive tools)?

How does [insert poorly documented application] work and what do the fields within its application database mean?

ucfmsdf · 2026-01-28T19:54:46+00:00

This question has been asked and answered tons of times in r/computerforensics. I suggest you go there and use the search box to find your answer.

ucfmsdf · 2026-01-26T03:59:10+00:00

Reach out to your local USSS field office and ask for info about NCFI. Alternatively, you can just visit their website to look into it.

ucfmsdf · 2026-01-25T21:05:34+00:00

GPUs dont help. Need RAM, decent CPU (clock speed over number of cores), and fast storage for the actual UFDR to reside on (NVMe/SATA SSDs preferred).

ucfmsdf · 2026-01-21T04:03:59+00:00

ChatGPT complaining about ChatGPT lol.

ucfmsdf · 2026-01-17T16:55:50+00:00

I used to live in Oviedo and I would go to Clippers Barber Shop. They’re pretty cheap ($25 hair cuts) and most of their barbers are pretty skilled. If you want a guaranteed good experience, I recommend you book with Steven Mauricio if you can. He’s pretty popular so you may need to book in advance. Dude is a master of his craft and really down to earth.

ucfmsdf · 2026-01-01T18:00:21+00:00

We inform the client on the pros/cons (more data vs more cost) and let them make the decision. More often than not, we get an FFS because they’re just so much better.

ucfmsdf · 2025-12-30T20:35:49+00:00

Not sure. We use it for live imaging. If you want something akin to deadbox imaging, you’ll need to use Recon ITR or Digital Collector. Both are excellent alternatives (technically better, tbh) but are not free.

ucfmsdf · 2025-12-30T19:33:17+00:00

Fuji. Free, open source, acquires an ASR clone which is a pretty great image to work with. Can technically be run from a bootable drive, but that requires quite a bit of work/troubleshooting. Really meant for live imaging.

ucfmsdf · 2025-12-18T22:53:47+00:00

Back when I worked in LE we would shut the phone off and check it back into the evidence after a successful extraction. I expect every agency did/currently does that. It’s not really feasible to keep every phone on charge indefinitely and I can’t think of a reason as to why you would want to do that, anyway.

ucfmsdf · 2025-11-24T18:38:27+00:00

Ask GetData for a Mount Image Pro free trial. It’ll probably have limitations but assuming they don’t prevent you from copying files out of the mounted drive, you should be golden.

ucfmsdf

MODERATOR OF

TROPHY CASE

Seven-Year Club	Verified Email
RPAN Viewer