Recent Posts

How to detect when OCFA is done processing

1 minute read

As emailed to be by Jochen:I think it is possible to detect completion of the process, even if it is not that simple, due to the distributed nature of OCFA. ...

REAPER SVN Access

less than 1 minute read

Instructions for using SVN to get the newest version of the REAPER Project:These instructions are for SVN from a Linux command line, and specifically Debian....


REAPER Preview Setup and Configuration

3 minute read

(Command line instructions)6 Nov. 2010REAPERlive Preview:Extracting a working directoryOnce you have downloaded the REAPERlivePreview build pa...

REAPERlive Preview POC Released

less than 1 minute read

REAPERlive Preview has been released as a proof of concept. The ISO is available for download at sorceforge. Currently only images are displayed, but lists o...


Read-Only Loopback to Physical Disk

1 minute read

I have been testing file carving to try to preview the contents of a drive before imaging. File carving takes a long, long time. A faster solution (I think) ...

REAPER Preview

1 minute read

Throughout the time I have been developing REAPER, many people in more developed countries have expressed a need for a type of forensic preview ability. Mayb...


DFRWS 2009 - Montreal

less than 1 minute read

Our group in the Centre for Cybercrime Investigation gave a presentation at the Digital Forensic Workshop 2009. The submitted paper can be found here. Also a...