{"id":3765,"date":"2018-03-15T14:41:43","date_gmt":"2018-03-15T18:41:43","guid":{"rendered":"https:\/\/www.digitalforensics.com\/blog\/?p=3765"},"modified":"2025-03-03T20:51:22","modified_gmt":"2025-03-03T20:51:22","slug":"coreldraw-forensics-step-by-step","status":"publish","type":"post","link":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/","title":{"rendered":"CorelDRAW Forensics: step by step"},"content":{"rendered":"<p>CorelDRAW is the best graphics editor, which is developed by a Canadian company Corel Corporation. This graphics editor has great functionality. Criminals can use it for illegal activities, such as fraud, money counterfeiting, etc. Today, we will describe how to detect CoralDRAW artefacts when examining a computer. We will use AXIOM by Magnet Forensics as a tool for analysis, which is one of the best tools for computer forensics.<br \/>\n<!--more--><\/p>\n<p><em>Supported formats<\/em><\/p>\n<p>The CoralDRAW program supports editing of many formats:<\/p>\n<ul>\n<li>Adobe Illustrator (AI)<\/li>\n<li>Font Printer Font Binary File &#8211; Adobe Type 1 (PFB)<\/li>\n<li>Windows Bitmap Image File (BMP)<\/li>\n<li>Raster Image OS\/2 (BMP)<\/li>\n<li>Vector Graphics Format (CGM)<\/li>\n<li>CorelDRAW (CDR)<\/li>\n<li>Corel Presentation Exchange (CMX)<\/li>\n<li>Corel PHOTO-PAINT (CPT)<\/li>\n<li>Corel Symbols Library (CSL)<\/li>\n<li>Theme File Created by CursorXP (CUR)<\/li>\n<li>Microsoft Word (DOC, DOCX or RTF)<\/li>\n<li>Microsoft Publisher (PUB)<\/li>\n<li>Corel DESIGNER (DSF or DES)<\/li>\n<li>AutoCAD Drawing Exchange Format File (DXF)<\/li>\n<li>AutoCAD Drawing Database File (DWG)<\/li>\n<li>Encapsulated PostScript File (EPS)<\/li>\n<li>PostScript (PS or PRN)<\/li>\n<li>GIF<\/li>\n<li>HTML<\/li>\n<li>JPEG (JPG)<\/li>\n<li>JPEG 2000 (JP2)<\/li>\n<li>Image Kodak Photo-CD (PCD)<\/li>\n<li>PICT (PCT)<\/li>\n<li>Adobe Portable Document Format File (PDF)<\/li>\n<li>HPGL Plotter File (PLT)<\/li>\n<li>Portable Network Graphic (PNG)<\/li>\n<li>Adobe Photoshop (PSD)<\/li>\n<li>Corel Painter (RIF)<\/li>\n<li>Scalable Vector Graphics File (SVG)<\/li>\n<li>Macromedia Flash\/Adobe Flash (SWF)<\/li>\n<li>Targa Graphic Image (TGA)<\/li>\n<li>Tagged Image File (TIF or TIFF)<\/li>\n<li>Corel Paint Shop Pro (PSP)<\/li>\n<li>Font TrueType (TTF)<\/li>\n<li>WordPerfect Document (WPD)<\/li>\n<li>WordPerfect Graphic File (WPG)<\/li>\n<li>Raw Images<\/li>\n<li>Wavelet Image (WI)<\/li>\n<li>Windows Metafile (WMF)<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Using CorelDRAW you can edit any of the abovementioned types of formats, but, if CorelDRAW was used on the examined computer you will probably find files with the following extensions:<\/p>\n<ul>\n<li>.CDR is a file extension for vector images created in the design program \u2013 CorelDRAW. A CDR file contains a document that consists of text, lines, shapes, images, colors, and effects.<\/li>\n<li>.CPT is a file extension for bitmap images created in a photo-editing program developed by the Corel Corporation \u2013 Corel PHOTO-PAINT. This program is a part of the CorelDRAW Graphics Suite.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><em>CorelDRAW metadata<\/em><\/p>\n<p>Before starting an analysis, a forensic analyst wants to find information about the installed version of the CorelDraw program, such as date of installation, serial number, owner, etc.<\/p>\n<p>This information can be found in the SOFTWARE file of the Registry, which is located on the following path: C:\\Windows\\System32\\config\\. Also, there is the easier way to do it: select the Registry option in the AXIOM drop-down menu.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3754 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/001.png\" alt=\"\" width=\"508\" height=\"250\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/001.png 508w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/001-300x148.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/001-16x8.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/001-32x16.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/001-28x14.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/001-56x28.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/001-64x31.png 64w\" sizes=\"auto, (max-width: 508px) 100vw, 508px\" \/><\/p>\n<p style=\"text-align: center\">Selection of the Registry option<\/p>\n<p>In this part of AXIOM program, forensic analyst can navigate through all Registry elements of the examined operating system, such as SAM, SECURITY, SOFTWARE, SYSTEM and NTUSER.DAT. It is user-friendly and it speeds-up the working process.<\/p>\n<p>Go to the path: SOFTWARE: Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\04137BC5C6086C240AA5A1DFE029ED5B\\InstallProperties.<\/p>\n<p>Here you can find the following CorelDRAW metadata:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3755 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/002.png\" alt=\"\" width=\"524\" height=\"616\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/002.png 524w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/002-255x300.png 255w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/002-512x602.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/002-14x16.png 14w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/002-27x32.png 27w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/002-24x28.png 24w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/002-48x56.png 48w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/002-54x64.png 54w\" sizes=\"auto, (max-width: 524px) 100vw, 524px\" \/><\/p>\n<p style=\"text-align: center\">Values in the InstallProperties<\/p>\n<p>Unfortunately, we could not find Serial Number in this part of the Registry.<\/p>\n<p>Information from this part of the Registry is partially duplicated to SOFTWARE:Microsoft\\Windows\\CurrentVersion\\Uninstall\\<\/p>\n<p>&nbsp;<\/p>\n<p>(Full paths:<\/p>\n<p>Microsoft\\Windows\\CurrentVersion\\Uninstall\\{EF44BCCD-13F9-4974-862C-CCFAF43EE082}<\/p>\n<p>Microsoft\\Windows\\CurrentVersion\\Uninstall\\{FC41DFBE-6C39-4C84-949B-7CB1E6460C7A}<\/p>\n<p>Microsoft\\Windows\\CurrentVersion\\Uninstall\\{FC9BCB82-55E3-4328-868F-B19112B07B93})<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3756 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/003.png\" alt=\"\" width=\"599\" height=\"549\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/003.png 599w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/003-300x275.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/003-512x469.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/003-16x16.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/003-32x29.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/003-28x26.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/003-56x51.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/003-64x59.png 64w\" sizes=\"auto, (max-width: 599px) 100vw, 599px\" \/><\/p>\n<p style=\"text-align: center\">Values in Uninstall<\/p>\n<p>Unfortunately, the Serial Number of the CorelDraw program was not found in this part of Registry either. Serial Number can be duplicated in the other elements of this tool. For example, Serial Number can be detected in the Registry of the CorelDRAW element \u2013 Corel Website Creator by the path SOFTWARE: WOW6432Node (full path: SOFTWARE: WOW6432Node\\Corel\\Website-Creator\\13.5\\).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3757 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/004.png\" alt=\"\" width=\"552\" height=\"367\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/004.png 552w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/004-300x200.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/004-512x340.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/004-16x11.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/004-32x21.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/004-28x19.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/004-56x37.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/004-64x43.png 64w\" sizes=\"auto, (max-width: 552px) 100vw, 552px\" \/><\/p>\n<p style=\"text-align: center\">Values in WOW6432Node\\Corel\\Website-Creator\\13.5\\<\/p>\n<p>&nbsp;<\/p>\n<p>Consequently, the analysis of the hive SOFTWARE provided us with the following data about the installed version of the CorelDRAW program:<\/p>\n<ul>\n<li>Owner: D\u2026<\/li>\n<li>First Name (owner): D\u2026<\/li>\n<li>Last Name (owner): H\u2026<\/li>\n<li>Company: Hewlett-Packard Company<\/li>\n<li>Local Package: C:\\windows\\Installer\\4f01a2.msi<\/li>\n<li>Display Version: 17.1<\/li>\n<li>Install Date: 03\/01\/2015<\/li>\n<li>Install Source: e:\\x64\\<\/li>\n<li>Publisher: Corel Corporation<\/li>\n<li>Display Name: CorelDRAW Graphics Suite X7 &#8211; Setup Files (x64)<\/li>\n<li>Serial Number: DR17R22-\u2026<\/li>\n<\/ul>\n<p>Is it a good result? It is a very good result.<\/p>\n<p>&nbsp;<\/p>\n<p><em>Recent Files<\/em><\/p>\n<p>The first thing that forensic analyst wants to know is what kind of files were edited via CorelDraw. The Resent files category is useful in this case.<\/p>\n<p>&nbsp;<\/p>\n<p>In old versions of the CorelDRAW program, the Recent Files list is located in the CorelDraw.ini file (path: C:\\Users\\&lt;username&gt;\\AppData\\Roaming\\Corel\\&lt;Product Name&gt;\\Draw\\Workspace\\&lt;workspace name&gt;\\CorelDraw.ini (for example, Product Name: CorelDRAW Graphics Suite X5)).<\/p>\n<p>In newer versions of the CorelDRAW program, this information is stored in the user hive\u00a0NTUSER.DAT:<\/p>\n<p>Software\\Corel\\CorelDRAW\\&lt;version&gt;\\Draw\\Application\u00a0Preferences\\Framework:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3758 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/005.png\" alt=\"\" width=\"358\" height=\"620\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/005.png 358w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/005-173x300.png 173w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/005-9x16.png 9w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/005-18x32.png 18w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/005-16x28.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/005-32x56.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/005-37x64.png 37w\" sizes=\"auto, (max-width: 358px) 100vw, 358px\" \/><\/p>\n<p style=\"text-align: center\">The path to the Framework in the Registry<\/p>\n<p>In the framework section, there is a list of files in the ResentFiles value that are divided with \u2018|\u2019 symbol. These files were opened and edited in the CorelDRAW program.<\/p>\n<p>Unfortunately, this list does not contain timestamps, which means that forensic analyst will not be able to tell when these files were edited in the CorelDRAW program.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3759 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/006.png\" alt=\"\" width=\"678\" height=\"125\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/006.png 678w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/006-300x55.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/006-512x94.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/006-16x3.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/006-32x6.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/006-28x5.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/006-56x10.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/006-64x12.png 64w\" sizes=\"auto, (max-width: 678px) 100vw, 678px\" \/><\/p>\n<p>If these files are present on the examined hard drive, you can analyze their metadata in the file system and find out when they were accessed and edited. In order to do it you need to select File System option in the AXIOM drop-down menu. Go to the place where these CDR files are stored and check their metadata, such as Created, Accessed, Modified.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3760 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/007.png\" alt=\"\" width=\"954\" height=\"105\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/007.png 954w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/007-300x33.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/007-768x85.png 768w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/007-512x56.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/007-920x101.png 920w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/007-16x2.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/007-32x4.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/007-28x3.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/007-56x6.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/007-64x7.png 64w\" sizes=\"auto, (max-width: 954px) 100vw, 954px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><em>Other Activities<\/em><\/p>\n<p>Other activities related with .CDR file can be detected by the analysis of LNK-files and Jump Lists.<\/p>\n<p>Information goes to the LNK files when a user opens a file via Explorer.<\/p>\n<p>Jump Lists provide a user with quick access to recently accessed application files.<\/p>\n<p>In the AXIOM drop-down menu, select the Artifacts option. Enter .CDR in the filter window and then press the \u201cGO\u201d button.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3761 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/008.png\" alt=\"\" width=\"905\" height=\"266\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/008.png 905w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/008-300x88.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/008-768x226.png 768w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/008-512x150.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/008-16x5.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/008-32x9.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/008-28x8.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/008-56x16.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/008-64x19.png 64w\" sizes=\"auto, (max-width: 905px) 100vw, 905px\" \/><\/p>\n<p style=\"text-align: center\">The result of the filter application.<\/p>\n<p>As you can see from the picture above, the result of the filter application provides us with information that 590 Jump Lists artifacts and 532 LNK Files artifacts were found. These artifacts contain timestamps and can be used for the analysis of the intensity of the CorelDRAW program usage. We can make a timeline based on the timestamps of these artefacts. The timeline shows the intensity of the CorelDRAW program usage to the forensic analyst.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3762 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009.png\" alt=\"\" width=\"1275\" height=\"701\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009.png 1275w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-300x165.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-768x422.png 768w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-1024x563.png 1024w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-512x281.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-920x506.png 920w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-16x9.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-32x18.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-28x15.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-56x31.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-64x35.png 64w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-1000x550.png 1000w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/009-1200x660.png 1200w\" sizes=\"auto, (max-width: 1275px) 100vw, 1275px\" \/><\/p>\n<p style=\"text-align: center\">Timeline<\/p>\n<p>You have definitely paid attention to the fact that some artefacts with .CDR extension were detected in the WEB RELATED category. Let us consider the detected artefacts more closely.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3763 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/010.png\" alt=\"\" width=\"309\" height=\"183\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/010.png 309w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/010-300x178.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/010-16x9.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/010-32x19.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/010-28x17.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/010-56x33.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/010-64x38.png 64w\" sizes=\"auto, (max-width: 309px) 100vw, 309px\" \/><\/p>\n<p style=\"text-align: center\">Web Related artifacts<\/p>\n<p>Go to the Chrome Downloads category and check what data are presented there.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3766 size-full\" src=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/011.png\" alt=\"\" width=\"881\" height=\"312\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/011.png 881w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/011-300x106.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/011-768x272.png 768w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/011-512x181.png 512w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/011-16x6.png 16w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/011-32x11.png 32w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/011-28x10.png 28w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/011-56x20.png 56w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/011-64x23.png 64w\" sizes=\"auto, (max-width: 881px) 100vw, 881px\" \/><\/p>\n<p style=\"text-align: center\">Chrome Downloads artifacts<\/p>\n<p>As you can see from the picture above, part of CDR files was downloaded from Internet using Gmail account.<\/p>\n<p>&nbsp;<\/p>\n<p><em>Conclusion<\/em><\/p>\n<p>In this article we have described how to detect metadata of the installed version of the CorelDRAW program (such as date of installation, activation key, owner, etc.), based on the analysis of the Windows Registry. Also, we have described how to find recent files and find out their timestamps; how to detect other activities on the examined computer that are related with opened and edited files via CorelDRAW. In addition, we have shown how to detect the source of the files origin that can contain information relevant to the case (in the presented example, a part of files was downloaded to the computer using Gmail account).<\/p>\n<p>As a tool for analysis, we used the forensic tool \u2013 AXIOM, which allows to perform the described process of analysis in a convenient and functional interface from the very beginning till the end.<\/p>\n<p>&nbsp;<\/p>\n<p>Happy forensicating!<\/p>\n<p><strong>About the authors<\/strong><br \/>\n<a href=\"https:\/\/www.linkedin.com\/in\/oleg-skulkin\/\" rel=\"nofollow\"><strong>Oleg Skulkin<\/strong><\/a>, GCFA, MCFE, ACE, is a DFIR enthusional (enthusiast + professional), <a href=\"https:\/\/www.amazon.com\/Windows-Forensics-Cookbook-Oleg-Skulkin\/dp\/1784390496\"><strong>Windows Forensics Cookbook<\/strong><\/a> and <a href=\"https:\/\/www.amazon.com\/Practical-Mobile-Forensics-Rohit-Tamma\/dp\/1788839196\/\" rel=\"nofollow\"><strong>Practical Mobile Forensics<\/strong><\/a> co-author.<\/p>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/igormikhaylovcf\/\" rel=\"nofollow\"><strong>Igor Mikhaylov<\/strong><\/a>, MCFE, EnCE, ACE, OSFCE, is a digital forensic examiner with more than 20 years of experience and <strong><a href=\"https:\/\/www.amazon.com\/Mobile-Forensics-Cookbook-Igor-Mikhaylov\/dp\/1785282050\/\" rel=\"nofollow\">Mobile Forensics Cookbook<\/a><\/strong> author.<\/p>\n","protected":false},"excerpt":{"rendered":"CorelDRAW is the best graphics editor, which is developed by a Canadian company Corel Corporation. This graphics editor&hellip;","protected":false},"author":126,"featured_media":3764,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"csco_display_header_overlay":false,"csco_singular_sidebar":"","csco_page_header_type":"","footnotes":""},"categories":[6],"tags":[],"class_list":{"0":"post-3765","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-software","8":"cs-entry"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v27.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>CorelDRAW Forensics: A Guide for Digital Investigations<\/title>\n<meta name=\"description\" content=\"Explore the process of CorelDRAW forensics, including detecting file artefacts and analyzing metadata. Learn how to extract key data using AXIOM for effective digital investigations.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CorelDRAW Forensics: step by step\" \/>\n<meta property=\"og:description\" content=\"Explore the process of CorelDRAW forensics, including detecting file artefacts and analyzing metadata. Learn how to extract key data using AXIOM for effective digital investigations.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/\" \/>\n<meta property=\"og:site_name\" content=\"Resources for Sextortion and Online Blackmail Victims\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DigitalForensicsCorp\/\" \/>\n<meta property=\"article:published_time\" content=\"2018-03-15T18:41:43+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-03-03T20:51:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/color-3198094_960_720.png\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"450\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Viktor Sobiecki\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ForensicsCorp\" \/>\n<meta name=\"twitter:site\" content=\"@ForensicsCorp\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Viktor Sobiecki\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/\"},\"author\":{\"name\":\"Viktor Sobiecki\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/person\\\/db7b63895c111dc8ed48df38d20b84ce\"},\"headline\":\"CorelDRAW Forensics: step by step\",\"datePublished\":\"2018-03-15T18:41:43+00:00\",\"dateModified\":\"2025-03-03T20:51:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/\"},\"wordCount\":1332,\"publisher\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/03\\\/color-3198094_960_720.png\",\"articleSection\":[\"Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/\",\"name\":\"CorelDRAW Forensics: A Guide for Digital Investigations\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/03\\\/color-3198094_960_720.png\",\"datePublished\":\"2018-03-15T18:41:43+00:00\",\"dateModified\":\"2025-03-03T20:51:22+00:00\",\"description\":\"Explore the process of CorelDRAW forensics, including detecting file artefacts and analyzing metadata. Learn how to extract key data using AXIOM for effective digital investigations.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/03\\\/color-3198094_960_720.png\",\"contentUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/03\\\/color-3198094_960_720.png\",\"width\":800,\"height\":450},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/coreldraw-forensics-step-by-step\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims\",\"item\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"CorelDRAW Forensics: step by step\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/\",\"name\":\"Resources for Sextortion and Online Blackmail Victims\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#organization\",\"name\":\"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/df-logo.png\",\"contentUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/df-logo.png\",\"width\":393,\"height\":343,\"caption\":\"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims\"},\"image\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/DigitalForensicsCorp\\\/\",\"https:\\\/\\\/x.com\\\/ForensicsCorp\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/person\\\/db7b63895c111dc8ed48df38d20b84ce\",\"name\":\"Viktor Sobiecki\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/viktor-sobiecki_avatar-96x96.jpg\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/viktor-sobiecki_avatar-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/viktor-sobiecki_avatar-96x96.jpg\",\"caption\":\"Viktor Sobiecki\"},\"description\":\"Dr. Viktor Sobiecki currently serves as the Chief Technology Officer (CTO) at Digital Forensics Corporation, where responsibilities span the leadership of advanced cybersecurity initiatives, data breach incident responses, and corporate strategic planning. Professional career has been driven by the intersection of innovation and practical application, particularly in the domains of cybersecurity and cyber crime investigations. He holds a Ph.D. in Computer Science and has contributed extensively to academic and industry advancements through publications, patents, and technological solutions addressing complex real-world challenges. As a professional with over 25 years of experience in the fields of cybersecurity, artificial intelligence, and digital forensics his career spans roles in academic research, software development, corporate leadership, and expert consulting, giving me a comprehensive understanding of the technical, strategic, and practical dimensions of projects. Expertise spans a wide range of technical domains, including: \u2022 Data Breach Incident Response: Managing immediate responses to cybersecurity crises, including the containment and mitigation of threats \u2022 Corporate Strategy Development: Designing long-term strategies to enhance organizational resilience against emerging cyber threats. \u2022 Expert Testimony: Providing legal and technical expertise in high-profile cybersecurity cases. \u2022 Artificial Intelligence and Machine Learning: Designing and implementing algorithms for data analysis, pattern recognition, and anomaly detection. \u2022 Network Security and Data Integrity: Developing solutions to protect critical systems from cyber threats, including encryption protocols and intrusion detection systems. \u2022 Cloud Computing and Hybrid Infrastructures: Creating scalable, resilient architectures for data storage, processing, and security.\",\"sameAs\":[\"https:\\\/\\\/www.digitalforensics.com\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/viktor-sobiecki\\\/\"],\"honorificPrefix\":\"Dr\",\"jobTitle\":\"Chief Technology Officer (CTO)\",\"worksFor\":\"Digital Forensics Corporation\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/author\\\/visor\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"CorelDRAW Forensics: A Guide for Digital Investigations","description":"Explore the process of CorelDRAW forensics, including detecting file artefacts and analyzing metadata. Learn how to extract key data using AXIOM for effective digital investigations.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/","og_locale":"en_US","og_type":"article","og_title":"CorelDRAW Forensics: step by step","og_description":"Explore the process of CorelDRAW forensics, including detecting file artefacts and analyzing metadata. Learn how to extract key data using AXIOM for effective digital investigations.","og_url":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/","og_site_name":"Resources for Sextortion and Online Blackmail Victims","article_publisher":"https:\/\/www.facebook.com\/DigitalForensicsCorp\/","article_published_time":"2018-03-15T18:41:43+00:00","article_modified_time":"2025-03-03T20:51:22+00:00","og_image":[{"width":800,"height":450,"url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/color-3198094_960_720.png","type":"image\/png"}],"author":"Viktor Sobiecki","twitter_card":"summary_large_image","twitter_creator":"@ForensicsCorp","twitter_site":"@ForensicsCorp","twitter_misc":{"Written by":"Viktor Sobiecki","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/#article","isPartOf":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/"},"author":{"name":"Viktor Sobiecki","@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/person\/db7b63895c111dc8ed48df38d20b84ce"},"headline":"CorelDRAW Forensics: step by step","datePublished":"2018-03-15T18:41:43+00:00","dateModified":"2025-03-03T20:51:22+00:00","mainEntityOfPage":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/"},"wordCount":1332,"publisher":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/#primaryimage"},"thumbnailUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/color-3198094_960_720.png","articleSection":["Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/","url":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/","name":"CorelDRAW Forensics: A Guide for Digital Investigations","isPartOf":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/#primaryimage"},"image":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/#primaryimage"},"thumbnailUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/color-3198094_960_720.png","datePublished":"2018-03-15T18:41:43+00:00","dateModified":"2025-03-03T20:51:22+00:00","description":"Explore the process of CorelDRAW forensics, including detecting file artefacts and analyzing metadata. Learn how to extract key data using AXIOM for effective digital investigations.","breadcrumb":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/#primaryimage","url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/color-3198094_960_720.png","contentUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/03\/color-3198094_960_720.png","width":800,"height":450},{"@type":"BreadcrumbList","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/coreldraw-forensics-step-by-step\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.digitalforensics.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims","item":"https:\/\/www.digitalforensics.com\/blog\/software\/"},{"@type":"ListItem","position":3,"name":"CorelDRAW Forensics: step by step"}]},{"@type":"WebSite","@id":"https:\/\/www.digitalforensics.com\/blog\/#website","url":"https:\/\/www.digitalforensics.com\/blog\/","name":"Resources for Sextortion and Online Blackmail Victims","description":"","publisher":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.digitalforensics.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.digitalforensics.com\/blog\/#organization","name":"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims","url":"https:\/\/www.digitalforensics.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2024\/12\/df-logo.png","contentUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2024\/12\/df-logo.png","width":393,"height":343,"caption":"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims"},"image":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DigitalForensicsCorp\/","https:\/\/x.com\/ForensicsCorp"]},{"@type":"Person","@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/person\/db7b63895c111dc8ed48df38d20b84ce","name":"Viktor Sobiecki","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/07\/viktor-sobiecki_avatar-96x96.jpg","url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/07\/viktor-sobiecki_avatar-96x96.jpg","contentUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/07\/viktor-sobiecki_avatar-96x96.jpg","caption":"Viktor Sobiecki"},"description":"Dr. Viktor Sobiecki currently serves as the Chief Technology Officer (CTO) at Digital Forensics Corporation, where responsibilities span the leadership of advanced cybersecurity initiatives, data breach incident responses, and corporate strategic planning. Professional career has been driven by the intersection of innovation and practical application, particularly in the domains of cybersecurity and cyber crime investigations. He holds a Ph.D. in Computer Science and has contributed extensively to academic and industry advancements through publications, patents, and technological solutions addressing complex real-world challenges. As a professional with over 25 years of experience in the fields of cybersecurity, artificial intelligence, and digital forensics his career spans roles in academic research, software development, corporate leadership, and expert consulting, giving me a comprehensive understanding of the technical, strategic, and practical dimensions of projects. Expertise spans a wide range of technical domains, including: \u2022 Data Breach Incident Response: Managing immediate responses to cybersecurity crises, including the containment and mitigation of threats \u2022 Corporate Strategy Development: Designing long-term strategies to enhance organizational resilience against emerging cyber threats. \u2022 Expert Testimony: Providing legal and technical expertise in high-profile cybersecurity cases. \u2022 Artificial Intelligence and Machine Learning: Designing and implementing algorithms for data analysis, pattern recognition, and anomaly detection. \u2022 Network Security and Data Integrity: Developing solutions to protect critical systems from cyber threats, including encryption protocols and intrusion detection systems. \u2022 Cloud Computing and Hybrid Infrastructures: Creating scalable, resilient architectures for data storage, processing, and security.","sameAs":["https:\/\/www.digitalforensics.com\/","https:\/\/www.linkedin.com\/in\/viktor-sobiecki\/"],"honorificPrefix":"Dr","jobTitle":"Chief Technology Officer (CTO)","worksFor":"Digital Forensics Corporation","url":"https:\/\/www.digitalforensics.com\/blog\/author\/visor\/"}]}},"_links":{"self":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts\/3765","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/users\/126"}],"replies":[{"embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/comments?post=3765"}],"version-history":[{"count":1,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts\/3765\/revisions"}],"predecessor-version":[{"id":8037,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts\/3765\/revisions\/8037"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/media\/3764"}],"wp:attachment":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/media?parent=3765"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/categories?post=3765"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/tags?post=3765"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}