Pages

▼
Monday, January 19, 2026

Views on AI & the Anthropic Report

›
There's been a lot of chatter over the use of AI in various fields, and because it's my professional focus, I'm most interested ...
Saturday, January 10, 2026

What's on your clipboard?

›
One of the fascinating aspects of Windows systems, from a DF/IR perspective, for me has been the clipboard. Notice I said, "one of...
1 comment:
Monday, January 05, 2026

Questions I've Been Asked

›
Sometimes I'll get questions via different routes...webinars or podcasts, via social media, DM, or even email. Getting questions is good...
2 comments:
Thursday, January 01, 2026

Windows Defender Support Logs

›
I ran across a LinkedIn post the other day that  mentioned using Windows Defender Support Logs (actually, I think the post referred to them...

Grab Bag

›
This started out as a bit of an end-of-the-year grab bag of posts, but I don't like simply linking to things, dropping links with no exp...
1 comment:
Monday, December 29, 2025

Question on Open Source Tools

›
I received a question recently, one I receive every now and again, asking if there are any updates to an open source tool I created a while ...
Thursday, December 11, 2025

Perspectives on Cybersecurity

›
I'm not a fan of many podcasts. I do like a conversational style, and there are some podcasts that I listen to, albeit not on a regular ...
Wednesday, December 10, 2025

Releasing Open Source Tools to the Community

›
Every now and then, I get contacted by someone who tells me that they used the open source tools I've released in either a college cour...
Saturday, November 29, 2025

Intel in LNK Files

›
I was reading a pretty interesting write-up from Seqrite regarding, in part, the use of pseudo-polyglot documents. In this case, delivery o...
2 comments:
Wednesday, November 26, 2025

Registry: FeatureUsage

›
Maurice posted on LinkedIn  recently about one of the FeatureUsage  Registry key subkeys; specifically, the AppSwitched subkey. Being some...

Unprecedented Complexity

›
I saw it again, just today. Another post on social media stating that IT teams/defenders "face unprecedented complexity".  This on...

Thoughts on Analysis

›
Warning - before you get started reading this blog post, it's only fair that I warn you...in this post, I make the recommendation that y...
1 comment:
Thursday, November 13, 2025

Images

›
In writing Investigating Windows Systems , published in 2018, I made use of publicly available images found on the Internet. Some were image...
Wednesday, November 12, 2025

File Formats

›
I'm a huge fan of MS file formats, mostly because they provide for the possibility of an immense (and often untapped, unexploited) amoun...
Monday, November 10, 2025

What We Value

›
Over the passed couple of days, I've had images pop up in my feed showing people's workstations, most often with multiple screens. I...
3 comments:
Monday, November 03, 2025

Analysis Playbooks: USB

›
In 2005, Cory Altheide and I published the first peer-reviewed paper to address tracking USB devices on Windows systems. Over the years, it...
Friday, October 31, 2025

Registry Analysis

›
First off, what is "analysis"? I submit that "analysis" is what happens when an examiner has investigative goals and con...