Pages

▼
Sunday, January 29, 2006

The Evolution of Live Response

›
In my last post , I mentioned that the FRU and FSP had been demos as part of the CERT VTE. Very cool. If you've read this blog for an...
1 comment:
Thursday, January 26, 2006

In search of...

›
No, this isn't a flashback to that old Leonard Nimoy show ...it's about training. I got an email last night (don't have permiss...
Wednesday, January 25, 2006

Cool Magazines

›
Recently, with the demise of Phrack , I've run across a couple of very interesting online magazines, or e-zines. From Richard Bejtlich...
1 comment:
Tuesday, January 24, 2006

"Ooops, I did it again..."

›
No, this isn't a post about what would be on my iPod if I had one...it's even better. Recently, the NSA posted a document entitled,...
Thursday, January 12, 2006

The need for IR training

›
This ComputerWorld article caught my eye this morning...I've done vulnerability assessments before, and I fully agree with all of these ...
2 comments:
Wednesday, January 11, 2006

What is "security"??

›
Good question. We each approach topics like this differently, based on our background, experiences, etc. This thread on Slashdot caught my...
Thursday, January 05, 2006

How are you spending your security dollars?

›
I was reading some comments on another blog today, and one comment in particular caught my eye. A retired CIO lamented the fact that "m...

New NIST document (draft)

›
I was reviewing the updated E-evidence.info site this morning, and one of the interesting things I came across was the draft NIST SP800-86 ,...
2 comments:
Tuesday, December 27, 2005

The Mystery of MUICache...solved??

›
Holy Registry keys, Batman! Okay, I've been tossing this around for a while, and even put it on the back burner, but never completely fo...
19 comments:
Friday, December 23, 2005

Registry Reference

›
I've been working away on a Registry reference, basically, an Excel spreadsheet of Registry keys. The idea is to list them with some so...
5 comments:
Thursday, December 22, 2005

The age of "Nintendo forensics"...

›
...is coming to a close. Or, rather, it needs to. Looking around, seeing what's going on in the community, and in particular, in the n...
2 comments:

Visibility?

›
Posts have been sporadic, and not nearly as frequent as before...I know. That'll change. For now, though, I've got a question for t...
8 comments:
Thursday, December 01, 2005

Registry Reference

›
One thing I've really noticed over the years is that while some information is available out there on some Registry keys and values, the...
7 comments:
Tuesday, November 01, 2005

Finding a rootkit

›
Mark Russinovich over on SysInternals.com posted a blog entry yesterday about how he located a rootkit that was installed after he purchase...
Wednesday, October 26, 2005

Peeking inside Word documents

›
I was chatting with someone yesterday who asked me where I found the files I used to test the Word Metadata Dumper , and I simply said, ...
1 comment:
Tuesday, October 25, 2005

Sleuthkit on Windows

›
Hey, guess what I did last night!! I installed Sleuthkit and Autopsy on Windows XP! For you Linux and *BSD gurus who felt a nauseating dis...
4 comments:
Monday, October 24, 2005

Perl for Forensics

›
Perl is freely available, and Perl scripts are essentially open source. Perl is used by forensics products such as The Sleuthkit and ProDis...
3 comments:
Saturday, October 22, 2005

VMWare Playa

›
As a user of VMWare , I received an email the other day that mentioned a new, free product called the VMWare Player . This is a free produc...

Word metadata code posted

›
All, I've posted the code that I mentioned in my previous post on Word metadata . This code produces the output seen in the blog entr...
3 comments:
Sunday, October 16, 2005

Yet, even more on Word metadata

›
While awaiting information on the binary format of shortcut (LNK) files, I decided to try to learn more about structured storage and metad...