Skip to content
LEX FORTIS
VENTURES
Home
Techniques
Case Studies
Q&A
Tools
About
Get in Touch
Knowledge Base
Questions & Answers
Search, filter by category, and share deep links directly to any answer.
All (55)
Fundamentals (7)
Mobile (9)
Disk (9)
OSINT (8)
CDR/IPDR (8)
Network (6)
Legal (4)
Career/Certification (4)
Showing 55 of 55 questions
Beginner
Fundamentals
What is the order of volatility, and why does it matter?
Beginner
Fundamentals
How is chain of custody maintained and documented?
Beginner
Fundamentals
What does 'forensically sound' actually mean?
Beginner
Fundamentals
How do you verify a forensic image is unaltered?
Beginner
Fundamentals
Why do examiners always work from a copy, never the original?
Intermediate
Fundamentals
What role does a hex editor play in forensic analysis?
Intermediate
Fundamentals
What should contemporaneous forensic notes actually include?
Beginner
Mobile
What is the difference between logical and physical extraction?
Intermediate
Mobile
Can deleted WhatsApp messages be recovered, and how?
Advanced
Mobile
How are locked devices handled, and what are the legal caveats?
Advanced
Mobile
What are JTAG and chip-off extraction, and when are they used?
Intermediate
Mobile
How does ADB backup and adb pull acquisition work?
Advanced
Mobile
What are SQLite WAL and journal files, and why do they matter forensically?
Beginner
Mobile
How is GPS location extracted from photos and videos?
Beginner
Mobile
What is a Faraday bag and why does it matter?
Advanced
Mobile
What is cloud/token-based acquisition for mobile evidence?
Beginner
Disk
Why is a write blocker mandatory, and what happens without one?
Beginner
Disk
What's the difference between RAW/dd, E01/EWF, and AFF image formats?
Intermediate
Disk
What is file carving and when does it fail?
Intermediate
Disk
What's the difference between slack space and unallocated space?
Advanced
Disk
What key Windows/NTFS artifacts should every examiner know?
Advanced
Disk
What is timestomping and how is it detected?
Advanced
Disk
How do examiners handle full-disk encryption like BitLocker, FileVault, or LUKS?
Advanced
Disk
How is steganography typically detected in forensic examinations?
Beginner
Disk
What does a typical Autopsy / Sleuth Kit examination workflow look like?
Beginner
OSINT
What is the OSINT intelligence cycle?
Intermediate
OSINT
What are the most useful Google dorking operators for investigations?
Advanced
OSINT
How is geolocation determined from a photo without GPS metadata?
Advanced
OSINT
What is a sock puppet account, and what OPSEC does it require?
Intermediate
OSINT
How should OSINT findings be documented to remain defensible?
Beginner
OSINT
How does username enumeration work, and what are its limits?
Intermediate
OSINT
What does basic domain and infrastructure reconnaissance involve?
Advanced
OSINT
What are the basics of conducting dark web research safely?
Beginner
CDR/IPDR
What is the difference between CDR and IPDR?
Intermediate
CDR/IPDR
How accurate is cell tower location data?
Beginner
CDR/IPDR
What is the difference between IMEI, IMSI, and MSISDN?
Advanced
CDR/IPDR
How do you identify a SIM swap or device change from CDR data?
Advanced
CDR/IPDR
How do you resolve a subscriber from a public IP address under CGNAT?
Advanced
CDR/IPDR
What is co-location and common-contact analysis?
Intermediate
CDR/IPDR
What legal authorization is required to request CDR/IPDR from a telecom operator?
Intermediate
CDR/IPDR
What are the most common analysis errors in CDR/IPDR work?
Intermediate
Network
What tools are used for RAM acquisition, and how do they differ?
Advanced
Network
What do the core Volatility 3 plugins (pslist, netscan, malfind) actually show?
Advanced
Network
How do you identify command-and-control (C2) traffic in packet captures?
Advanced
Network
What is DNS tunneling and how is it detected?
Intermediate
Network
During a live incident, what should be captured before the network connection is severed?
Intermediate
Network
What should examiners look for in firewall, proxy, and IDS logs?
Beginner
Legal
What legal authorization is required before acquiring a device?
Intermediate
Legal
What makes digital evidence admissible in court?
Intermediate
Legal
What is expected of a forensic examiner acting as an expert witness?
Advanced
Legal
What complicates cross-border digital evidence requests?
Beginner
Career/Certification
Which digital forensics certifications matter most?
Beginner
Career/Certification
What's a realistic entry path into digital forensics as a career?
Intermediate
Career/Certification
How can an aspiring examiner build a credible portfolio before their first job?
Intermediate
Career/Certification
Beyond technical skill, what separates a strong forensic examiner?