In this blog post Jamie McQuaid from Magnet Forensics discusses the importance of false positives produced by digital forensics software in general and Magnet’s IEF and AXIOM in particular. He notes that false positives are not bugs in forensics software, they’re simply matches to the criteria used to carve through a hard drive or mobile phone with potentially several terabytes of unstructured data. Than he discusses how to identify such false positives and gives some examples. Finally Jamie recommends to use multiple digital forensic tools to verify the results and understand clearly which artifacts are false positives.
Read full blog post here.
