Friday, March 13, 2026

Digital Forensics:Timestamp Decoder

Mobile Forensics Lab I

Mobile Phone Forensics

What is Timestamp Decoder?

Timestamp Decoder is a FREE forensic utility for converting data found on desktop and mobile devices into human-readable timestamps. It is the most comprehensive tool available for decoding timestamps.

To open this case in the software, an investigator would launch Autopsy, click Open Case, and select this Drug_Dealer.aut file.

The Target Evidence: You can see that the archive (J8AXB7647798GRJ-20210421_0920.tar), which was added as a Logical File data source in your earlier steps, is successfully reloaded and mapped under the LogicalFileSet1 host directory.

Step 1: Navigating the File System (Data Sourcing)

Path: com.android.providers.calendar -> databases

This directory contains the database files responsible for storing the device's native calendar data.

Step 2: Selecting the Target Database

In the top-center Listing panel, the database file has been selected:

File Name: calendar.db
File Path: The full path at the top reveals it originates from the ingested logical file extraction: /LogicalFileSet1/Image/J8AXB7647798GRJ-20210421_0920.tar/data/data/com.android.providers.calendar/databases

Step 3: Utilizing the Built-In SQLite Viewer

Instead of viewing raw data, the investigator clicked the Application tab in the lower content viewer pane.

Autopsy automatically recognizes that calendar.db is an SQLite database.

Step 4: Analyzing the Target Evidence Row

The investigator has highlighted Row 36, which contains highly relevant data for the case:

title: The entry is named "Pizza delivery". (In drug investigations, this is often a code word used for a transaction/drop-off).
eventLocation: Autopsy extracts GPS coordinates directly from this field: 33.529455426023574, -112.0847381568517. This allows investigators to pinpoint exactly where the meeting was planned to take place on a map.
dtstart / dtend: These columns contain the Unix Epoch Timestamps (1618039800000)

To convert the Unix timestamp identified in your forensic evidence, follow these step-by-step

Option 1: Using DCode (Forensic Tool)

DCode is a specialized tool for investigators to handle multiple timestamp formats.

Select Format: In the Decode Format dropdown, select Unix: Numeric Value.
Set Time Zone: Ensure Add Bias is set to UTC 00:00 for a standard forensic report.
Input Value: Type or paste 1618039800000 into the Value to Decode field.
Execute: Click the Decode button.
Result: The Date & Time field will display Sat, 10 April 2021 07:30:00 UTC.

Option 2: Using EpochConverter (Online)

Input: Enter 1618039800000 into the main conversion box.
Convert: Click Timestamp to readable date.
Check Precision: The tool will automatically assume the timestamp is in milliseconds because it is 13 digits long.
Result: It will show the date as Saturday, April 10, 2021 at 7:30:00 AM GMT.

Option 3: Using CyberChef (Advanced Web Tool) https[:]//gchq.github[.]io/CyberChef

Select Category: Click on Date / Time in the left-hand operations pane.
Choose Recipe: Drag From UNIX Timestamp into the Recipe column.
Configure Units: In the recipe options, change the Units dropdown to Milliseconds (ms).
Input Data: Paste 1618039800000 into the Input box on the top right.
Result: The converted time, Sat 10 April 2021 07:30:00.000 UTC, will appear instantly in the Output box.

อ่านเพิ่มเติม:

Lab : practical exercise to map GPS coordinates extracted
Convert Chrome/WebKit timestamps to human-readable date
SQLite Forensics with OSForensic
UTC
Timestamp

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น ช่วยเตือนความจำ

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #ComputerForensics #dfir #forensics #digitalforensics #computerforensic #investigation #cybercrime #fraud

Monday, March 9, 2026

Digital Forensics:practical exercise to map GPS coordinates extracted

Practical exercise to map GPS coordinates extracted

Mobile Forensics Lab II

This lab guide provides a step-by-step practical exercise to map GPS coordinates extracted from an Autopsy investigation using open-source mapping tools.

Lab Objective

In this lab, you will act as a forensic analyst. You will take the raw geolocation data extracted from the calendar.db file in Autopsy (33.529455426023574, -112.0847381568517) and map it to identify the physical meeting location of the suspect and the supplier.

Prerequisites & Tools

The target GPS coordinates: 33.529455426023574, -112.0847381568517
An internet browser.
Access to an open mapping tool (e.g., Google Maps or OpenStreetMap).

Step 1: Analyze and Format the Coordinates

Before plugging data into mapping software, you must understand its structure.

Latitude (North/South): 33.529455426023574
Longitude (East/West): -112.0847381568517
Step 2: Input the Data into a Mapping Tool
1. Open your web browser and navigate to Google Maps.
2. Click on the Search bar in the upper left corner.
3. Copy and paste the coordinates exactly as they appeared in Autopsy, separated by a comma:
  33.529455426023574, -112.0847381568517
4. Press Enter or click the search icon.

Step 3: Analyze the Visual Data (Pinpoint Location)

1. Observe where the red map pin drops. Zoom in using the + button to view street-level details.
2. Switch from the standard map view to Satellite view (usually in the lower-left corner) to examine the physical surroundings.
3. Identify the landmark.
  - Analysis observation: These coordinates point directly to a specific retail/commercial parking lot area in Phoenix, Arizona.

อ่านเพิ่ม: Timestamp Decoder

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #ComputerForensics #dfir #forensics #digitalforensics #computerforensic #investigation #cybercrime #fraud

Saturday, March 7, 2026

Mobile Forensics Lab IV (blockchain investigation technique)

Mobile Forensics Lab IV

Question ?

From what Bitcoin wallet did he get paid the last time for his job?

1.The WhatsApp messages give us a hint as to how much Bitcoin was sent for services ontwo occasions

2.First transmission with known tx hash was in March and it is not the latest

Mobile Forensics Lab I (blockchain investigation technique)

3.The second one is in April and it mentions an amount and then the message 'I see a bit lessthan that' (Navigate to Data Artifacts → Messages→ (msgstore.db)WhatsApp → Sort by Date/Time

The next step involves us doing a search on https://blockchair.com/bitcoin/outputs (or asimilar service) where we have to enter the evidence that we do have. We can filter by the date and time (April 15th, 2021 between 17:20 and 17:40) as well as the range of bitcoin value (0.0913 and around). This will give us the output of only one transaction that took place within those set parameters. Following that transaction link gives us our result:

Technical Overview

The demonstrate an blockchain investigation technique using Blockchair (a blockchain search engine and explorer). Instead of searching for a specific wallet address or Transaction Hash (TxID), the investigator is using database filtering to isolate a specific transaction based on two known parameters: Time and Approximate Value

Step-by-Step Explanation

Step 1: Accessing Advanced Search Filters

When conducting a forensic search by timestamp, standard blockchain explorers fail because they only index by cryptographic hashes. Blockchair allows table-based queries.

Activate the Time Filter: Check the Time property on the left-hand panel to open the date configuration window.
Set the Condition: Change the condition to "Between". This allows you to define a specific temporal window rather than searching for an exact second (which might fail due to network propagation delays).
Define the Date and Time: Select April 15, 2021 on the calendar. Check the "Include time" box to ensure the query filters down to the specific hour and minute (17:32:16 UTC).

Step 2: Applying the Value Range Filter

Filtering by time alone on a high-traffic day like April 15, 2021, would still yield thousands of transactions (noise). To isolate the correct artifact, a second layer of filtering is applied based on the transaction amount.

Activate the Value Filter: Check the Value property on the left panel and select BTC as the currency denomination.
Set a Margin of Error (Range Query): Select "Between" instead of "Exact".
Input the Range: Enter a tight lower bound (`0.09228260`) and upper bound (`0.09228263`).
Forensic Note: Using a range query is a best practice in blockchain forensics. It accounts for potential decimal roundings, miner fee deductions, or slight discrepancies in how different ledger platforms display values.

Step 3: Isolating and Analyzing the Target Output

Once you click Apply, Blockchair queries its indexed database and filters out all non-matching ledger data.
Verify Active Filters: The blue tags at the top (`Time (UTC) x` and `Value (BTC) x`) confirm that the dataset is successfully restricted to your specific parameters.
Extract the Artifact: You now have the exact block number (`679,370`) and the partial Transaction Hash (`88c1f...d07fe`). Clicking on this hash will allow the investigator to trace the Input addresses (senders) and Output addresses (recipients) to map the flow of funds.

อ่านเพิ่มเติม:

Timestamp Decoder

Lab : practical exercise to map GPS coordinates extracted

Convert Chrome/WebKit timestamps to human-readable date

The WebKit Precision Time or High-Resolution Time timestamp format is used by Google Chrome (Chromium) in its base::Time class.

The values in screenshot (e.g., 13257408048478972) are Chrome Webkit Timestamps. This format represents the number of microseconds elapsed since January 1, 1601 (UTC).

To convert this to a human-readable UTC format, you can use the following methods:

Google Chrome stores forensic artifacts primarily within the user profile directory, often in a Default or Profile * folder. Key locations include History (SQLite), Cookies, Cache, Bookmarks, and Session data. On Windows, this is typically C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default

Step 1: Locating the Source Files

The investigation starts by navigating to the user's browser profile directory. In Chromium-based browsers, this is usually found in the "Default" folder.

Forensic Value: This folder contains the raw SQLite databases that store everything from history and cookies to saved logins.

Key SQLite Artifacts & Forensic Value

Step 2: Identifying the Artifact Tables

Once the investigator has the files, they need to know which database and table to query for specific evidence.

History Database: Uses tables like urls (for links) and visits (for timestamps).

Step 3: Extracting Raw Data

Using a database viewer (like DB Browser for SQLite), the investigator opens the History file and views the urls table.

The Problem: The last_visit_time column contains long, 17-digit numbers (e.g., 13257408048478972).

Step 4: Decoding the Timestamp

The investigator uses a conversion tool (like epochconverter.com) or a SQL formula to translate the raw number into a recognizable date.

Input: The raw 17-digit timestamp is entered into the converter.
Output: The tool reveals the precise UTC/GMT time. In your example:
- Timestamp: 13257408048478972
- Result: Wednesday, February 10, 2021 at 5:20:48 AM UTC.

www[.]online-python[.]com

Specialized tools like ChromeHistoryView simplify the process by automatically parsing the raw SQLite database into a readable format.

1. Automating the Connection

Instead of manually opening the History SQLite file, this tool reads the file directly from the browser's profile path. It maps the columns from multiple internal tables into a single consolidated view.

2. Focus on the `visits` Table

While the urls table contains the website addresses, the visits table is the "engine" of the timeline. It contains the crucial forensic data shown in your screenshot:

visit_time: The tool automatically converts the 17-digit Webkit timestamp into the "Visited On" column (e.g., 2/10/2021 5:20:48 AM).

ChromeHistoryView

Friday, March 6, 2026

guide to converting a VirtualBox Virtual Disk Image (.vdi) into a raw forensic image format

Guide to converting a VirtualBox Virtual Disk Image (`.vdi`) into a raw forensic image format

The step-by-step guide to converting a VirtualBox Virtual Disk Image (.vdi) into a raw forensic image format (.img/.dd) and verifying data integrity using MD5 and SHA256 hashing algorithms, based on your forensic lab artifacts.

Step 1: Navigate to the VirtualBox Directory

VirtualBox includes a powerful command-line utility called VBoxManage.exe. To use it, open your Command Prompt (cmd) as an Administrator and change the directory (cd) to the default VirtualBox installation path:

cd "C:\Program Files\Oracle\VirtualBox"

guide to converting a VirtualBox Virtual Disk Image (.vdi) into a raw forensic image format

Step 2: Calculate Source File Hashes (Pre-Conversion)

Following digital forensic best practices, you must baseline the integrity of the original evidence file (FT4A.vdi) before performing any processing. Use the built-in Windows certutil tool to generate the baseline hashes:

Verify md5 Hash:

certutil -hashfile "G:\Virtual Machine\FT4A\FT4A.vdi" md5

Result: 3f 1a 68 7c da 78 fa cc f7 ae ca 01 c3 56 8e 5a

Verify SHA256 Hash:

certutil -hashfile "G:\Virtual Machine\FT4A\FT4A.vdi" sha256

Result: f5 70 a4 14 11 71 5b 44 ef 0b f7 63 16 91 0d 9c 12 6a 3c 5c 7f a2 47 c3 5c e3 37 27 fe 56 7a 3f

Step 3: Convert the .VDI File to Raw .IMG Format

Execute the clonehd or convertfromraw block manipulation command structure natively via VBoxManage. Pass your target virtual drive container path as the input source and point your final destination path to the uncompressed raw output sector target (--format raw):

VBoxManage convertfromraw "G:\Virtual Machine\FT4A\FT4A.vdi" "G:\Image from VDI.img" --format raw

Step 4: Verify Post-Conversion Evidence Integrity (Hash Matching)

To ensure that no data corruption, alteration, or bit-flipping occurred during the format migration process, calculate the cryptographic signature values of the newly generated raw output file (Image from VDI.img):

Verify MD5 Hash:

certutil -hashfile "G:\Image from VDI.img" md5

Result: 3f 1a 68 7c da 78 fa cc f7 ae ca 01 c3 56 8e 5a (Match)

Verify SHA256 Hash:

certutil -hashfile "G:\Image from VDI.img" sha256

Result: f5 70 a4 14 11 71 5b 44 ef 0b f7 63 16 91 0d 9c 12 6a 3c 5c 7f a2 47 c3 5c e3 37 27 fe 56 7a 3f (Match)

Conclusion: Because the checks for both MD5 and SHA256 line up perfectly with a 100% true identical correlation, data integrity has been verified.

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูล เผยแพร่ความรู้และให้โอกาสในการค้นคว้าหาข้อมูลเพื่อการศึกษา บุคคลที่สนใจโดยทั่วไป รวมถึงนักเรียน นิสิต นักศึกษา ในการเรียนรู้เท่านั้น

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#DataBreachCheck #คิดก่อนPrompt #AISecurity #NCSA2026

#WINDOWSFORENSIC #COMPUTERFORENSICS #DFIR #FORENSICS #DIGITALFORENSICS #COMPUTERFORENSIC #INVESTIGATION #CYBERCRIME #FRAUD

Disk Images

Disk Images
Photo by Gemini

1. digitalcorpora[.]org

2.cfreds.nist[.]gov

3.github[.]com/sajinshivdas/Digital-Forensics-Lab

4.dfir[.]training/downloads/test-images

5. ashemery[.]com/dfir.html

6. circl[.]lu/services/forensic-training-materials

7. dftt.sourceforge[.]net

8. linuxleo[.]com