Windows Incident Response

The Windows Incident Response Blog is dedicated to the myriad information surrounding and inherent to the topics of IR and digital analysis of Windows systems. This blog provides information in support of my books; "Windows Forensic Analysis" (1st thru 4th editions), "Windows Registry Forensics", as well as the book I co-authored with Cory Altheide, "Digital Forensics with Open Source Tools".

Pages

▼

Wednesday, February 23, 2005

The Original Debuggers

Have you ever wondered how long computer programs have had bugs? Well, here's your answer ...

Tuesday, February 22, 2005

SysInternals gets in on the game

I received an IM from a friend of mine tonight informing me of a new tool released on the SysInternals site called RootkitRevealer . Accor...

More thoughts on GhostBuster, etc.

I'll be one of the first to agree that the GhostBuster approach to rootkit detection is sound. However, there are several caveats that n...

More stuff on rootkits from Microsoft

I received an email this morning from Microsoft regarding a new page that's been posted regarding the Strider stuff I mentioned earlier....

New Book???

I've been tossing around some ideas, based on comments I've received about my book . My first thought was to write a second edition...

Friday, February 18, 2005

Incident Scenario #1, follow up

As of this morning, there are 4 comments under the subject blog entry , and after reading them, I thought I'd post some of my own commen...

Wednesday, February 16, 2005

Interesting Research at MS

Doing some follow-up reading to the previous blog entry, I ran down an interesting research project at Microsoft called " Shield , the ...

Rootkit detection, the MS way

Jacco Tunnissen dropped me a line this morning to let me know about the Strider Ghostbuster technical paper from Microsoft . Jacco had re...

Tuesday, February 15, 2005

Thoughts on the use of WMI and WDM in a managed environment

Beetle of the Shmoo Group has an excellent presentation (from ToorCon ) called "Wireless Weapons of Mass Destruction for Windows"....

Incident Scenario #1

I figured that while I'm working on providing actual data, I'll post a " Counterhack "-style scenario for folks...the firs...

Incidents Question, part 2

Speaking of incidents, who out there is doing incident response on Windows systems? Seriously...from some of the lists I read (ie, Security...

Incidents Question, part 1

I've been thinking about some of the stuff I've presented on, as well as talked to others about, and a thought came up...has anyone...

Thursday, February 10, 2005

Where's...uh...Waldo?

Someone posted a comment to my Blog Topics Follow-Up post that was pretty extensive. Unfortunately, they didn't sign it or provide any ...

From the world of, "Is this really such a good idea?"

Windows XP and 2003 have a neat little utility called 'fsutil.exe'. According to MS , fsutil allows you to manage aspects of your f...

Wednesday, February 09, 2005

Promqry, revisited

Okay, I think I've figured out how promqry.exe works. If you see my previous blog entry on the subject, I mentioned that promqry.exe u...

Tuesday, February 08, 2005

Tools of the Trade

I figured I'd get started by listing some tools that you can use with the FRU/FSP, their use, etc. So, when you're doing incident...

Forensic Server Project

As promised, I'm going to blog more often on the Forensic Server Project , or FSP. I'd like to kick that off with a brief descripti...

Microsoft Sniffer Detector

Tim Rains of MS PSS Security fame released a new tool last week, and I read about it on Robert Hensing's blog this morning. The tool i...

Monday, February 07, 2005

Blog topics follow-up

I wanted to share the responses I received with regards to my Blog Topics post... First off, there really weren't many responses at a...

Tuesday, February 01, 2005

Blog topics?

Just out of curiosity, as I'm posting on topics of interest that pop up, what would you, the reader, like to see more of in this blog? ...

View web version

Powered by Blogger.