Pages

▼
Monday, January 31, 2005

Registry Mining

›
You're probably asking, "what is Registry mining?" Well, have you heard of "data mining"?This is where companies hi...

File Version Information

›
Now and again, you'll find a file on your system that you don't recognize, or know nothing about. It may be sitting in the system32...
4 comments:

Anatomy of...

›
Robert Hensing has some nice updates to his blog entitled "Anatomy of...". It's worth taking a look to see what Robert looks ...
Friday, January 28, 2005

Monitoring and Incident Prevention

›
Something popped up on the Internet Storm Center Handler's Diary entry for today that struck a chord with me. In the entry, the handler...
Thursday, January 27, 2005

Locard's Exchange Principle in the Digital World

›
Ever been watching CSI and hear Grissom say something about "Locard's" or Nick say "possible transfer"? Like most ...
1 comment:
Wednesday, January 26, 2005

Conducting Research

›
I've been wondering for a while now about the status of computer forensics research and publication. Regarding 'research', I...
3 comments:
Monday, January 24, 2005

LogParser 2.2 is out!

›
Microsoft released LogParser 2.2 . I haven't found any details at the MS site regarding what updates have been included in the new vers...
1 comment:
Friday, January 21, 2005

Backdoors to BotNets

›
Ever sat down and just thought about the history of computer intrusions? How about just a small part of it? Well, I did...and wanted to sh...
Tuesday, January 18, 2005

MetaData

›
One topic that isn't covered in any great detail is metadata, particularly in files and documents on Windows systems. The term metada...
2 comments:

Capturing information from live systems

›
I'm sure that over time, I'll have plenty of opportunity to discuss various tools that can be used in the course of incident respons...

Capturing information from live systems

›
I'm sure that over time, I'll have plenty of opportunity to discuss various tools that can be used in the course of incident respons...

Hiding on a Live System

›
Data hiding is a subject that I'll probably be posting on quite a bit as time goes on. Robert Hensing's recent blog entry on adv...
Friday, January 14, 2005

Scanners

›
I was working up a blog entry system monitoring, but it started to get lengthy. I thought I'd just start by breaking out some of the it...

Data Reduction and Representation

›
Data reduction and representation or reporting is a huge issue in the Windows world, even in IR. Maybe more so, in some cases. By now,you...
Wednesday, January 12, 2005

Windows Audit/Logging

›
Eric posted a blog entry on Tues entitled "Keeping the noise down in your security log" that is a 'must read'! He makes s...
2 comments:
Thursday, January 06, 2005

What's using that port?

›
Every now and again, I see posts to public lists asking for an "lsof for Windows", or "how do I found out which process is us...
2 comments:
Wednesday, January 05, 2005

XP and USB Storage Devices

›
As a follow-up to my post on Mounted Devices, here's an MS KB article that talks about how to disable USB storage devices on XP. If you...

Windows Rootkit Detection

›
I recently received an email from a fellow blogger asking about rootkit detectors for Windows. This was interesting, because there are quit...
Thursday, December 30, 2004

CourseWare

›
I've updated my courseware to provide two courses as a follow-on to my book , Basic (Level 1) and Advanced (Level 2) Windows Incident Re...
1 comment:

Interesting ADS tool

›
In following up some leads with information on NTFS Alternate Data Streams (ADSs), I ran across an interesting tool, called Stream Explorer ...