Pages

▼
Friday, April 29, 2005

New Windows Forensic Group

›
Based on input from everyone, I've created a new group, specific to the discussion of forensic analysis of Windows systems: http://grou...
2 comments:
Wednesday, April 27, 2005

GMail Drive footprints

›
I hope someone finds the following information useful... As a follow-up to my Registry key spreadsheet, Iwanted to take a look at the 'f...
2 comments:
Monday, April 25, 2005

Registry keys posted on the web

›
Okay, I've posted the Excel spreadsheet of Registry keys I've been working on here . Take a look, let me know what you think. Than...
6 comments:
Sunday, April 24, 2005

Gaps in Windows forensic analysis

›
For the past week or so, I've been posting to a couple of lists I'm on, asking about forums or communities where the forensic analys...
12 comments:
Friday, April 22, 2005

Registry Keys

›
I've been working on a spreadsheet containing several workbooks of Registry keys. One workbook contains AutoStart locations, another co...
4 comments:

FRUC Updates on the way

›
A user of the FSP emailed me earlier this week with some issues he'd identified when using the FRUC...specifically, the commands in the...
Monday, April 11, 2005

What keeps you up at night?

›
When it comes to performing the technical aspects of incident response and forensics on Windows systems (ie, data collection and analysis), ...
4 comments:
Friday, April 08, 2005

Interesting stuff on Windows

›
I was working on a spreadsheet containing information about Registry AutoStart locations last night and ran across something pretty interest...
7 comments:
Tuesday, April 05, 2005

Security Event Log Resource

›
I received a message from one of the lists I belong to today, pointing out this Windows Security Event Log resource . This looks like an e...
4 comments:

Yet another incident write-up...

›
Not too long after reading JOAT's blog, I was over on Michael Howard's blog and caught a write-up of how he handled a spyware incide...
1 comment:

Another Serv-U/FTP compromise

›
I was reviewing JOAT's blog this morning, and saw a link to a write-up about the response to an FTP compromise . I read through it and ...
2 comments:
Friday, April 01, 2005

Prefetch files posted

›
I've posted my Prefetch files on my Windows-IR.COM Tools page. Check them out, let me know what you think...

Prefetch files posted

›
I've posted the prefetch files to my Windows-IR.com site, on the Tools page. Take a look...

Book Update

›
I received a report of the sales of my book from the publisher last night...from the publishing date (approx 27 July 2004) through the end o...
Thursday, March 31, 2005

Is anyone else seeing this???

›
Not too long ago, I blogged about ADSs and the Prefetch directory ...and so far, I've only been able to replicate this behaviour on XP P...
3 comments:
Tuesday, March 29, 2005

How good is your Reg-foo?

›
Yes, I'm still working on the Registry Analysis HOWTO, subtitled "Your Reg-foo is very good..." (remember the old, poorly-dubb...
3 comments:

How good is your Reg-foo?

›
Yes, I'm still working on the Registry Analysis HOWTO, subtitled "Your Reg-foo is very good..." (remember the old, poorly-dubb...

Parsing the Prefetch directory

›
One comment from the previous blog entry asked for a program that would parse through the Prefetch directory and list all files, as well as ...
Friday, March 25, 2005

More about the Prefetcher

›
So far, there hasn't been much of a response to my previous Prefetch blog post ...though I have heard that some folks have been thinking...
9 comments:
Wednesday, March 23, 2005

What is the Prefetcher?

›
Ever wondered what the Prefetcher is? As of Windows XP, MS added a prefetcher to improve boot and application launch time . Like many other ...
1 comment: