<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Forensics &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/category/forensics/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Thu, 13 Nov 2025 12:21:54 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>Forensics &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>AD1 Format Package</title>
		<link>https://blog.cerbero.io/ad1-format-package/</link>
					<comments>https://blog.cerbero.io/ad1-format-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 13 Nov 2025 12:21:54 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[AccessData]]></category>
		<category><![CDATA[Evidence]]></category>
		<category><![CDATA[IR]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3275</guid>

					<description><![CDATA[We released the AD1 Format package, which adds basic support for AccessData Custom Content Image files. AD1 images are logical evidence containers created by FTK Imager and other AccessData tools, used to store selected files or folders from a system rather than a full physical disk image.]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/ad1-format-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3275</post-id>	</item>
		<item>
		<title>Prototype Memory &#038; Services</title>
		<link>https://blog.cerbero.io/prototype-memory-services/</link>
					<comments>https://blog.cerbero.io/prototype-memory-services/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 05 May 2025 10:21:29 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Dump]]></category>
		<category><![CDATA[Memory]]></category>
		<category><![CDATA[Snapshot]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3139</guid>

					<description><![CDATA[We are excited to announce the release of version 0.3 of our Memory Analysis package, currently in beta. This update introduces two major features: support for prototype Page Table Entries (PTEs) and the ability to enumerate and display Windows services from memory captures. Prototype PTEs are a crucial aspect of Windows memory management. These entries &#8230; <a href="https://blog.cerbero.io/prototype-memory-services/" class="more-link">Continue reading<span class="screen-reader-text"> "Prototype Memory &#038; Services"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/prototype-memory-services/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3139</post-id>	</item>
		<item>
		<title>Memory Decompression &#038; Pagefiles</title>
		<link>https://blog.cerbero.io/memory-decompression-pagefiles/</link>
					<comments>https://blog.cerbero.io/memory-decompression-pagefiles/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 28 Apr 2025 15:04:47 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Dump]]></category>
		<category><![CDATA[Memory]]></category>
		<category><![CDATA[Snapshot]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3132</guid>

					<description><![CDATA[Windows 10 (version 1507) introduced memory compression, a feature that allows certain memory pages to be compressed and managed by the &#8220;MemCompression&#8221; process. As a result, in a memory snapshot, some pages may be unavailable because they reside in compressed memory. Memory compression in Windows is optional and can be disabled if desired, but it &#8230; <a href="https://blog.cerbero.io/memory-decompression-pagefiles/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Decompression &#038; Pagefiles"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-decompression-pagefiles/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3132</post-id>	</item>
		<item>
		<title>Memory Analysis Package</title>
		<link>https://blog.cerbero.io/memory-analysis-package/</link>
					<comments>https://blog.cerbero.io/memory-analysis-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 25 Mar 2025 08:46:58 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Dump]]></category>
		<category><![CDATA[Memory]]></category>
		<category><![CDATA[Snapshot]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3108</guid>

					<description><![CDATA[We&#8217;re excited to announce the release of the new Memory Analysis package, capable of analyzing memory dumps from all Windows versions, from XP to 11, both x86 and x64. The package will be available to all licenses of Cerbero Suite. Today we&#8217;re rolling out the beta for all commercial licenses, and it will be accessible &#8230; <a href="https://blog.cerbero.io/memory-analysis-package/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Analysis Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-analysis-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3108</post-id>	</item>
		<item>
		<title>Windows DMP and Hibernation Files</title>
		<link>https://blog.cerbero.io/windows-dmp-and-hibernation-files/</link>
					<comments>https://blog.cerbero.io/windows-dmp-and-hibernation-files/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 29 Apr 2019 10:25:56 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[DMP]]></category>
		<category><![CDATA[Hibernation]]></category>
		<category><![CDATA[News]]></category>
		<guid isPermaLink="false">https://cerbero-blog.com/?p=1762</guid>

					<description><![CDATA[As we&#8217;re closing in on the release date of version 3.0, it&#8217;s time to announce some more new features: the advanced edition will come with support for Windows DMP and Windows Hibernation files. There are many internal formats of Windows DMP files and Cerbero now supports all of the most common ones. Here are for &#8230; <a href="https://blog.cerbero.io/windows-dmp-and-hibernation-files/" class="more-link">Continue reading<span class="screen-reader-text"> "Windows DMP and Hibernation Files"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/windows-dmp-and-hibernation-files/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1762</post-id>	</item>
		<item>
		<title>Heap &#038; File Carving</title>
		<link>https://blog.cerbero.io/heap-file-carving/</link>
					<comments>https://blog.cerbero.io/heap-file-carving/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 12 Mar 2018 14:22:11 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Heap]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1715</guid>

					<description><![CDATA[Along with the newly released 2.9 version of Profiler Advanced, we have improved support for memory images. Before going into the main topics of this post, it is worth mentioning that loading and scanning times have been drastically improved for memory images. Apart from the important internal optimizations, the user is now given the choice &#8230; <a href="https://blog.cerbero.io/heap-file-carving/" class="more-link">Continue reading<span class="screen-reader-text"> "Heap &#038; File Carving"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/heap-file-carving/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1715</post-id>	</item>
		<item>
		<title>Windows Memory Forensics: Close to Release</title>
		<link>https://blog.cerbero.io/windows-memory-forensics-close-to-release/</link>
					<comments>https://blog.cerbero.io/windows-memory-forensics-close-to-release/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Sun, 05 Nov 2017 22:21:18 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Memory]]></category>
		<category><![CDATA[Raw images]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1682</guid>

					<description><![CDATA[We&#8217;re extremely proud to announce that the upcoming 2.8 version of Profiler Advanced comes with full-fledged support for raw Windows memory images! As few of our users might remember a two years old demo about this topic. Thanks to the work of the past months of our team, we could finalize that idea into a &#8230; <a href="https://blog.cerbero.io/windows-memory-forensics-close-to-release/" class="more-link">Continue reading<span class="screen-reader-text"> "Windows Memory Forensics: Close to Release"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/windows-memory-forensics-close-to-release/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1682</post-id>	</item>
		<item>
		<title>Windows Memory Forensics</title>
		<link>https://blog.cerbero.io/windows-memory-forensics/</link>
					<comments>https://blog.cerbero.io/windows-memory-forensics/#comments</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Sun, 25 Oct 2015 18:21:01 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[PoC]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1586</guid>

					<description><![CDATA[Let&#8217;s begin with an image: Yep. That&#8217;s an icon. In an executable. In a process address space. In a raw memory dump. And here is the video demonstration: This is just a proof-of-concept. We still haven&#8217;t decided whether to develop this further. It really depends on whether the forensic community is interested in having such &#8230; <a href="https://blog.cerbero.io/windows-memory-forensics/" class="more-link">Continue reading<span class="screen-reader-text"> "Windows Memory Forensics"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/windows-memory-forensics/feed/</wfw:commentRss>
			<slash:comments>3</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1586</post-id>	</item>
		<item>
		<title>Torrent Support</title>
		<link>https://blog.cerbero.io/torrent-support/</link>
					<comments>https://blog.cerbero.io/torrent-support/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 23 Sep 2015 14:50:31 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[P2P]]></category>
		<category><![CDATA[Torrent]]></category>
		<category><![CDATA[Trackers]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1567</guid>

					<description><![CDATA[Following our recent introduction to Scan Providers, here&#8217;s a first implementation example. In this post we&#8217;ll see how to add support for Torrent files in Profiler. Of course, the implementation shown in this post will be available in the upcoming 2.5.0 release. Let&#8217;s start by creating an entry in the configuration file: [Torrent] label = &#8230; <a href="https://blog.cerbero.io/torrent-support/" class="more-link">Continue reading<span class="screen-reader-text"> "Torrent Support"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/torrent-support/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1567</post-id>	</item>
		<item>
		<title>Raw File System Analysis (FAT32 File Recovery)</title>
		<link>https://blog.cerbero.io/raw-file-system-analysis-fat32-file-recovery/</link>
					<comments>https://blog.cerbero.io/raw-file-system-analysis-fat32-file-recovery/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 29 Oct 2013 11:16:07 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[FAT32]]></category>
		<category><![CDATA[File System]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1355</guid>

					<description><![CDATA[This post isn&#8217;t about upcoming features, it&#8217;s about things you can already do with Profiler. What we&#8217;ll see is how to import structures used for file system analysis from C/C++ sources, use them to analyze raw hex data, create a script to do the layout work for us in the future and at the end &#8230; <a href="https://blog.cerbero.io/raw-file-system-analysis-fat32-file-recovery/" class="more-link">Continue reading<span class="screen-reader-text"> "Raw File System Analysis (FAT32 File Recovery)"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/raw-file-system-analysis-fat32-file-recovery/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1355</post-id>	</item>
	</channel>
</rss>
