Pages

▼
Showing posts with label analysis. Show all posts
Showing posts with label analysis. Show all posts
Saturday, January 23, 2016

Analysis

›
A bit ago, I posted about doing analysis , and that post didn't really seem to get much traction at all.  What was I trying for?  To sta...
Wednesday, January 20, 2016

Resources, Link Mashup

›
Monitoring MS's Sysmon was recently updated to version 3.2, with the addition of capturing opens for raw read access to disks and volu...
1 comment:
Sunday, January 12, 2014

Malware RE - IR Disconnect

›
Not long ago, I'd conducted some analysis that I had found to be...well, pretty fascinating...and shared some of the various aspects of...
4 comments:
Wednesday, December 18, 2013

Shellbags

›
Dan recently posted what has to be one of the most thorough/comprehensive blog articles regarding the Windows shellbags artifacts.  His po...
1 comment:
Monday, May 13, 2013

Understanding Data Structures

›
Sometimes at conferences or during a presentation, I'll provide a list of tools for parsing a specific artifact (i.e., MFT, Prefetch fil...
1 comment:
Saturday, January 19, 2013

BinMode: Parsing Java *.idx files

›
One of the Windows artifacts that I talk about in my training courses is application log files, and I tend to sort of gloss over this topic...
5 comments:
Saturday, January 12, 2013

There Are Four Lights: The Analysis Matrix

›
I've talked a lot in this blog about employing event categories when developing, and in particular, when analyzing timelines, and the ...
1 comment:
Wednesday, October 31, 2012

Shellbag Analysis, Revisited...Some Testing

›
I blogged previously on the topic of Shellbag Analysis, but I've found that in presenting on the topic and talking to others, there may...
Monday, September 03, 2012

Links, Tools, Etc.

›
Windows 8 Forensics There is some great information circulating about the Interwebs regarding Windows 8 forensics.  There's this YouTub...
2 comments:
Wednesday, August 15, 2012

ShellBag Analysis

›
What are "shellbags"? To get an understanding of what "shellbags" are, I'd suggest that you start by reading Chad T...
7 comments:
Thursday, June 14, 2012

Timeline Analysis, and Program Execution

›
I mentioned previously that I've been preparing for an upcoming Timeline Analysis course offered through my employer.  As part of that...