Pages

▼
Thursday, March 31, 2005

Is anyone else seeing this???

›
Not too long ago, I blogged about ADSs and the Prefetch directory ...and so far, I've only been able to replicate this behaviour on XP P...
3 comments:
Tuesday, March 29, 2005

How good is your Reg-foo?

›
Yes, I'm still working on the Registry Analysis HOWTO, subtitled "Your Reg-foo is very good..." (remember the old, poorly-dubb...
3 comments:

How good is your Reg-foo?

›
Yes, I'm still working on the Registry Analysis HOWTO, subtitled "Your Reg-foo is very good..." (remember the old, poorly-dubb...

Parsing the Prefetch directory

›
One comment from the previous blog entry asked for a program that would parse through the Prefetch directory and list all files, as well as ...
Friday, March 25, 2005

More about the Prefetcher

›
So far, there hasn't been much of a response to my previous Prefetch blog post ...though I have heard that some folks have been thinking...
9 comments:
Wednesday, March 23, 2005

What is the Prefetcher?

›
Ever wondered what the Prefetcher is? As of Windows XP, MS added a prefetcher to improve boot and application launch time . Like many other ...
1 comment:

Registry HOWTO format

›
I've been working out some ideas regarding a HOWTO for the Registry and wanted to post what I'd come up with so far, and solicit tho...
4 comments:
Tuesday, March 22, 2005

The popular media does it again.

›
I received a link to an eWEEK article this morning, entitled " Hacking Tools Can Strengthen Security ", by Cameron Sturdevant. Th...

CNN News

›
I picked up something pretty interesting on CNN this morning, specifically this quote from a story : "...new research suggests many com...

Latest goings on

›
Have you been keeping abreast of the happenings in the world of Windows incident response? My first thought is that it shouldn't be har...
Wednesday, March 16, 2005

Lions and tigers and rootkits...oh, my!

›
As each day passes, I run across more and more fallout from MS's mention of rootkits at the RSA conference. I've found mention of th...

HOW TOs, part deux

›
Well, about the only thing I've gotten back with regards to the HOW TOs is stuff about the Registry. That works out well, as I'm al...
4 comments:

What is this thing called, love?

›
Okay, the title of this entry is an obscure reference to Benny Hill , but fans of the show may remember it... I see it all the time, and I s...
3 comments:
Tuesday, March 15, 2005

HOW TOs

›
Here's a question to the reader...with regards to incident response on Windows systems, what kind of "HOW TO" guides would you...
7 comments:

Imaging physical memory

›
I got a message from a buddy of mine last night asking me about imaging physical memory (RAM) on Windows systems. The "how" of th...
4 comments:

Comments from a previous blog entry...

›
In my previous "rootkit saga continues..." blog entry , there were some comments that I...uh...wanted to comment on... Geez, can y...
2 comments:

The Rootkit Saga continues...

›
Robert seems to be busy keeping the rootkit saga going over on his blog , with some interesting tidbits about how RootkitRevealer interacts...
Thursday, March 10, 2005

Blogging...

›
I haven't had many new ideas for blogging lately...so I thought I'd pose a question to the readers... There are sites that offer up ...
6 comments:
Thursday, March 03, 2005

The Registry as a log file

›
You're probably looking at the title of this entry and wondering..."what is this guy on??!! And where can I get some??!" Wel...
Wednesday, March 02, 2005

Using WMI

›
Over the past couple of days, I've been working on updating some of the WMI code I keep on hand...updating what I have, and adding to it...