Arsenal Consulting

Arsenal Consulting is a computer forensics and information security firm based in Wakefield, just north of Boston, with a second office in Hong Kong. It works for law firms, corporations and government agencies that need electronic evidence examined or security problems investigated. Each engagement is treated as a unique challenge, and the firm can deploy anywhere in the world with powerful, self-sufficient fly-away kits for work on site.

The firm publishes detailed technical casework. Its case study on the Odatv computer of Barış Pehlivan shows how its analysts reconstructed Windows start and stop events from event logs and file system records to uncover an unprecedented series of local and remote attacks and sophisticated evidence tampering. That work relied on an analysis technique Arsenal developed and calls Anchors in Relative Time.

What to Know

• Mark Spencer serves as the firm’s president.
• Anchors in Relative Time is applied to modern Windows computers and storage devices that use Microsoft’s NTFS file system.
• The Odatv analysis examined two separate volumes on a single hard drive, a boot volume and an auxiliary volume.