42 LLC

42 LLC chooses Viewpoint as eDiscovery platform

PRNewswire
West Coast Digital Forensics Firm Sees Client Value in Viewpoint’s Ability to Execute All Phases of Electronic Discovery Reference Model

HOUSTON, March 15, 2011 /PRNewswire via COMTEX/ — E-Discovery software leader Lateral Data, LP announced today the addition of 42 LLC, a Los Angeles provider …

Shell BAG Format Analysis

Windows uses the Shell BAG data to arrange folders and files in Explorer views, as well as to monitor recently used and frequently used applications in the Start-Menu among other things. Forensic experts use it to find traces of deleted file/folders with associated MAC times and file paths. It even tracks network paths and paths …

Blackberry Backup Parser Update

Thank you to Steve Rasch for identifying an issue with the 42 LLC IPD parser, now named the 42 LLC Blackberry Backup Parser. The script was outputting the subject line into the CC line, which has been corrected. It was a simple fix to make and all should be well. You can download the latest …

Yogesh Khatri’s Prefetch Research

Below are the two articles that Yogesh wrote regarding prefetch file analysis from our old website. Thank you all for you interest in our work.
Prefetch Files Revisited
The Windows prefetch file (.pf) has long been recognized as a useful artifact in the forensic community. It has been commented upon by several experts like Harlan …

Moving to a new site

Thank you all for your continued interest in our research. We have migrated to a new website and are in the process of moving all of the blog entries over. If there is something that you urgently need before then please send us a message via the “Contact Us” link at the top of the …

EnCase EnScripts & other tools

We wanted to post the scripts and tools from our old blog onto our new site for everyone to download. We have packaged everything into one download. Fill out the info below and you will receive a link in your email with the download. You no longer have to register on the site, but will …

Past CEIC Presentations

As CEIC nears this year you will notice that we are not on the agenda. The two biggest reasons is 1) we are too busy to develop any new material for the conference 2) version 7 is being released and we haven’t had the opportunity to play with it yet. Rodney, Ashley, and Ken are …

iPhone Backup Parser Update

We have updated the iPhone Backup Parser to include the older version of backups on Mac OS 10.x. Please let us know if you run into any issues with it.

42 LLC Apple iPhone & iPad Backup Parser v1_3.EnPack

Maine State Police Contraband Recovery Script

42 has been working with the Maine State Police on a script that was originally developed by Lance Muller and BitSec Global Forensics. Mike Webber of BitSec and Lieutenant Glenn Lang of MSP worked with Yogesh Khatri to further develop the script for the latest version of EnCase (6.16). The script …

Prosecuting Attorney

“This is the best report I have seen from anyone in your industry. After reading through it I now know what you know about the computer evidence.”

VP of Litigation, Fortune 500

“42 LLC has done an exemplary job of finding the information we needed to progress a very important legal situation for our company. On top of working extremely well with all of our internal teams and using the information collected to correlate patterns of activity across multiple matters, they have done …

Senior Partner, AmLaw 100

“Without a doubt you are the guys I turn to for all things digital.”

Senior Litigation Partner, AmLaw 100

“After requesting Digital Forensic services from multiple other firms, it became apparent that 42 LLC was the only team that could give our case and the related data the attention it deserved and had the ability to truly find what was there to find. They have gone above and beyond in …

Defense Investigator

“After the government failed to identify critical evidence on a cell phone we were certain existed we turned to 42 for their expertise in mobile device forensics. 42 recovered 206 SMS messages critical to our case which the government’s forensic examiners failed to identify.”