Pages

▼
Thursday, June 30, 2005

Reading Windows files in binmode()

›
For the past couple of days, I've been writing Perl scripts to parse binary data on Windows systems...I've been staring at 1s and 0s...
Friday, June 24, 2005

More on memory dump analysis, and some other stuff

›
First, I'm back from the MISTI "Cracking eFraud" conference. It was great to meet a lot of the folks there, both other prese...
5 comments:
Saturday, June 18, 2005

Upcoming conferences

›
Next week, I'll be presenting at the MISTI " Cracking eFraud " conference in Boston. My presentation is on using the Windows...

Memory collection and analysis follow-up

›
This topic is by no means closed...in fact, I think that the discussion of dealing with physical memory, memory analysis, etc., for forensic...
2 comments:
Thursday, June 16, 2005

RAM, memory dumps, and debuggers...oh, my!

›
One of my recent posts on obtaining the contents of physical memory using userdump.exe attracted the attention of some folks as MS , and I ...
7 comments:
Wednesday, June 15, 2005

Dumping and analyzing physical memory

›
Well, my research into dumping and analyzing physical memory is progressing. I can't say that I'm finding a positive answer...all I...
3 comments:

Memory Dump Analysis

›
One of the things I'm seeing, or should I say, have been seeing for a while, is a move away from the purist approach to forensics, in th...
Sunday, June 12, 2005

Shooting oneself in the foot...

›
I haven't found any really good malware analysis postings lately, but higB (*secureme blog) came to my rescue and posted about a recent...
Thursday, June 09, 2005

Some help needed with PE headers

›
The day before yesterday, I started digging into PE headers while looking at some malcode. One of the tools I've been using is PEView ,...
7 comments:
Wednesday, June 08, 2005

Schneier on Attack Trends

›
Bruce Schneier posted an interesting blog entry the other day on attack trends seen by Counterpane's monitoring service. The post seems...

MS Security Document

›
I ran across an interesting document today at the MS Download Center entitled, "The Security Monitoring and Attack Detection Planning G...
Tuesday, June 07, 2005

Case studies, and T&E again

›
I was going through the E-Evidence.info site again this morning...the site is updated with new stuff each month...and saw the Internal Inves...
Monday, June 06, 2005

IR Tools

›
I ran across something this morning over on Mike Howard's blog about the use of netsh in troubleshooting the XP SP 2 firewall. The blog...

Training, time, and job responsibilities

›
As sort of a crossover from my last post , I thought I'd blog about some of the responses I received directly to my email inbox... The b...
Friday, June 03, 2005

The need for training

›
I ran across something interesting this morning...it's not new, but it's the first time I've seen it. I was checking out what...
2 comments:
Tuesday, May 17, 2005

Data Reduction, revisited

›
I thought I'd take a moment to revisit the topic of data reduction. What steps are you using to perform data reduction? What are you do...
2 comments:

Remember the KISS principle

›
How often do you see someone post to a list with a question that they could have answered themselves had they bothered to test it out? I ran...
1 comment:
Thursday, May 05, 2005

I've got a question about a Registry value...

›
The other day, on one of the lists I am subscribed to, someone raised an interesting point. This issue addresses the following Registry key...
2 comments:
Monday, May 02, 2005

Seltzer on Rootkits

›
I received a link to Larry Seltzer's new article on rootkits this morning. It's dated 20 April, so why do I mention it? While the a...
Friday, April 29, 2005

New Windows Forensic Group

›
Based on input from everyone, I've created a new group, specific to the discussion of forensic analysis of Windows systems: http://grou...
2 comments: