https://kartiksankhla.com/tags/forensics/ Recent content in Forensics on Kartik Sankhla Hugo en-us Sat, 30 May 2026 00:05:00 +0530 https://kartiksankhla.com/posts/court-admissible-fat32/ Sat, 30 May 2026 00:05:00 +0530 https://kartiksankhla.com/posts/court-admissible-fat32/ A FAT32 USB image examined the way a court requires — no GUI shortcuts, every claim tied to raw bytes: recovering a deleted JPEG, and catching four files wearing the wrong extension. https://kartiksankhla.com/posts/the-file-we-couldnt-recover/ Sat, 30 May 2026 00:05:00 +0530 https://kartiksankhla.com/posts/the-file-we-couldnt-recover/ A user created five files and deleted some. Recovering them from an ext3 image meant Trash artifacts, orphan inodes full of GNOME metadata — and proving why one file was gone for good.