Pages

▼
Tuesday, November 01, 2005

Finding a rootkit

›
Mark Russinovich over on SysInternals.com posted a blog entry yesterday about how he located a rootkit that was installed after he purchase...
Wednesday, October 26, 2005

Peeking inside Word documents

›
I was chatting with someone yesterday who asked me where I found the files I used to test the Word Metadata Dumper , and I simply said, ...
1 comment:
Tuesday, October 25, 2005

Sleuthkit on Windows

›
Hey, guess what I did last night!! I installed Sleuthkit and Autopsy on Windows XP! For you Linux and *BSD gurus who felt a nauseating dis...
4 comments:
Monday, October 24, 2005

Perl for Forensics

›
Perl is freely available, and Perl scripts are essentially open source. Perl is used by forensics products such as The Sleuthkit and ProDis...
3 comments:
Saturday, October 22, 2005

VMWare Playa

›
As a user of VMWare , I received an email the other day that mentioned a new, free product called the VMWare Player . This is a free produc...

Word metadata code posted

›
All, I've posted the code that I mentioned in my previous post on Word metadata . This code produces the output seen in the blog entr...
3 comments:
Sunday, October 16, 2005

Yet, even more on Word metadata

›
While awaiting information on the binary format of shortcut (LNK) files, I decided to try to learn more about structured storage and metad...
Thursday, October 13, 2005

Recent rootkit news

›
I hope you weren't expecting things to stand still... This past Monday, F-Secure had an entry in their blog about a custom version of H...
Tuesday, October 11, 2005

More on Word Metadata

›
This past summer, I gave a couple of presentations , one that covered file metadata. I got to thinking...I've parsed Event Log files an...
3 comments:
Monday, October 10, 2005

Perl Programming on Windows

›
Let's see a show of hands for everyone out there who uses programs Perl on Windows systems. Okay, thank you...please put your hands dow...
2 comments:
Tuesday, October 04, 2005

Book Report

›
I haven't blogged in a while, and I came across something worth blogging about. While I don't have the actual numbers in front of me...
4 comments:
Wednesday, September 28, 2005

Remote Forensics System

›
I was grabbing some tools from the Foundstone tonight, for a presentation I'm working on, when I ran across something called the "R...

System Clock

›
Recently, a post in a public forum appeared, asking about how to verify the accuracy of the system clock. That got me to thinking...how do...
4 comments:
Tuesday, September 27, 2005

Projects

›
Every now and again, I poke my head up for a breath of fresh air and a look around...and I wonder if others face the same issues and challen...
3 comments:
Monday, September 26, 2005

Some way cool visualization stuff

›
F-Secure has a way cool visualization presentation on the Bagle worm ...check it out. Scroll down to the Fri, 23 Sept entry entitled, ...
2 comments:
Friday, September 23, 2005

Creating a timeline analysis tool

›
I'm not a DBA, and I don't play one on TV. So when it comes to writing a timeline analysis tool, I'm not going to be able to do ...
1 comment:

ISC Rootkit Discovery

›
This post appeared on the Incidents.org (ISC) blog two days ago, and is a very interesting read. The handler, Tom Liston, who works with E...
Thursday, September 22, 2005

Visualization

›
I've started to see that this issue of "timeline analysis" really isn't one of getting data as much as it is one of visual...
4 comments:
Tuesday, September 20, 2005

Cross-platform scripts

›
I've heard back from one or two people who've run the lsevt.pl , lsreg.pl , and regp.pl scripts I posted a bit ago. For the most pa...
2 comments:

Issues with timeline analysis

›
I've been doing some searches regarding timeline analysis, delving deeper into this. I still don't think that scatter plots and hist...
3 comments: