FI Tools – Forensic Innovations

Byte Value Distribution (BVD)

Before you can do anything with an unstructured file, you first need to identify its file type. Our products start with the following steps: Calculate hashes (MD5, SHA-1, etc.) for the entire file, and match them to known good and/or

Alternate Data Streams

In 2008, I wrote a blog entry, Simple Techniques That Fool Forensic Tools, that included an introduction to Alternate Data Streams. Now, I’d like to go into more detail, so that you can better understand the use and danger of

Simple Techniques That Fool Forensic Tools

If you were a criminal and wanted to hide computer evidence, how difficult could it be? Actually, you don’t even have to be a criminal, maybe you just want to hide something from a family member or your employer. Your