Pages

▼
Tuesday, December 27, 2005

The Mystery of MUICache...solved??

›
Holy Registry keys, Batman! Okay, I've been tossing this around for a while, and even put it on the back burner, but never completely fo...
19 comments:
Friday, December 23, 2005

Registry Reference

›
I've been working away on a Registry reference, basically, an Excel spreadsheet of Registry keys. The idea is to list them with some so...
5 comments:
Thursday, December 22, 2005

The age of "Nintendo forensics"...

›
...is coming to a close. Or, rather, it needs to. Looking around, seeing what's going on in the community, and in particular, in the n...
2 comments:

Visibility?

›
Posts have been sporadic, and not nearly as frequent as before...I know. That'll change. For now, though, I've got a question for t...
8 comments:
Thursday, December 01, 2005

Registry Reference

›
One thing I've really noticed over the years is that while some information is available out there on some Registry keys and values, the...
7 comments:
Tuesday, November 01, 2005

Finding a rootkit

›
Mark Russinovich over on SysInternals.com posted a blog entry yesterday about how he located a rootkit that was installed after he purchase...
Wednesday, October 26, 2005

Peeking inside Word documents

›
I was chatting with someone yesterday who asked me where I found the files I used to test the Word Metadata Dumper , and I simply said, ...
1 comment:
Tuesday, October 25, 2005

Sleuthkit on Windows

›
Hey, guess what I did last night!! I installed Sleuthkit and Autopsy on Windows XP! For you Linux and *BSD gurus who felt a nauseating dis...
4 comments:
Monday, October 24, 2005

Perl for Forensics

›
Perl is freely available, and Perl scripts are essentially open source. Perl is used by forensics products such as The Sleuthkit and ProDis...
3 comments:
Saturday, October 22, 2005

VMWare Playa

›
As a user of VMWare , I received an email the other day that mentioned a new, free product called the VMWare Player . This is a free produc...

Word metadata code posted

›
All, I've posted the code that I mentioned in my previous post on Word metadata . This code produces the output seen in the blog entr...
3 comments:
Sunday, October 16, 2005

Yet, even more on Word metadata

›
While awaiting information on the binary format of shortcut (LNK) files, I decided to try to learn more about structured storage and metad...
Thursday, October 13, 2005

Recent rootkit news

›
I hope you weren't expecting things to stand still... This past Monday, F-Secure had an entry in their blog about a custom version of H...
Tuesday, October 11, 2005

More on Word Metadata

›
This past summer, I gave a couple of presentations , one that covered file metadata. I got to thinking...I've parsed Event Log files an...
3 comments:
Monday, October 10, 2005

Perl Programming on Windows

›
Let's see a show of hands for everyone out there who uses programs Perl on Windows systems. Okay, thank you...please put your hands dow...
2 comments:
Tuesday, October 04, 2005

Book Report

›
I haven't blogged in a while, and I came across something worth blogging about. While I don't have the actual numbers in front of me...
4 comments:
Wednesday, September 28, 2005

Remote Forensics System

›
I was grabbing some tools from the Foundstone tonight, for a presentation I'm working on, when I ran across something called the "R...

System Clock

›
Recently, a post in a public forum appeared, asking about how to verify the accuracy of the system clock. That got me to thinking...how do...
4 comments:
Tuesday, September 27, 2005

Projects

›
Every now and again, I poke my head up for a breath of fresh air and a look around...and I wonder if others face the same issues and challen...
3 comments:
Monday, September 26, 2005

Some way cool visualization stuff

›
F-Secure has a way cool visualization presentation on the Bagle worm ...check it out. Scroll down to the Fri, 23 Sept entry entitled, ...
2 comments: