Video Game Device Forensics

As far as I know, this is the only XBox forensics tool that was actually written with forensics in mind.  I’ll have to see if my department can get a copy to play around with.

Greetings from Protowise Labs!

We are happy to announce the official release of XFT 2.0 Game Console Forensics toolkit.  In conjunction with the release, Protowise Labs will be hosting a series of Game Console Forensics Training sessions over the course of the year.  The full day training session includes 8 hours of classroom and hands on sessions, including FATX (Original Xbox) and XTAF (Xbox 360) file system forensics, ATA key recovery and drive unlocking, forensic issues with the Xbox 360, and forensic issues and implications of other game consoles.  Training is $650.00 per seat and includes one XFT license with free updates for 1 year.  Please do not make travel arrangements until training has been confirmed by us via email on or before August 27, 2010.  After registration, you will receive an email invoice, at which time payment is due.  We will send a confirmation email one month prior to training day, at which time you should make travel arrangements.  Again, please do not make travel arrangements prior to confirmation. To register, click the registration link below or go to http://www.protowise.com and click the registration link.  You can view the training syllabus on the Protowise website.  Seats are limited so if the class fills up we will open another session to be scheduled shortly after September.

REGISTER NOW for the  September 27, 2010 training in The Woodlands, Texas.

We hope to see you in The Woodlands in September!

Link to Publication.
Paper by Paul K. Burke and Philip Craiger.

This paper was published in the Journal of Digital Forensic Practice in December of 2006.  It provides a thorough method of analyzing the original XBox using a Linux environment in a forensically sound manner.  Also, it discusses the console’s security measures to prevent tampering (and how this is relevant to the examiner), as well as methods for determining if the console has been modified.