Pages

▼
Thursday, March 16, 2006

Windows Physical Memory Analysis, pt II

›
I've been taking a look at what's out there with regards to analyzing physical memory (RAM) dumps from Windows systems, and correlat...
1 comment:
Saturday, March 04, 2006

Windows Physical Memory Analysis

›
I'll be writing more on this particular subject as time goes on, but I wanted to post something right away. I've noticed over the p...
11 comments:
Friday, March 03, 2006

ProScript posted

›
I've posted another ProScript to the Techpathways forum ...this one consolidates the other two that I previously posted. It dumps user...
3 comments:
Tuesday, February 28, 2006

Perl module upload to CPAN

›
I've uploaded another module to my directory on CPAN ...this one is called File::ReadEvt. This is another module that reads a binary fi...
2 comments:
Tuesday, February 21, 2006

Quoted

›
Joab Jackson quote me in this article over on Government Computer News. File metadata has been an issue for a while, and this isn't an...
1 comment:

In the news...

›
If you own a Windows system (home user, corporate or university admin, etc.), you will want to see Brian Krebs ' latest article in the W...
Friday, February 17, 2006

Determining group membership from an image

›
A while back, I received this question..."how do I figure out a user's group membership from an image?" Well, I didn't kn...
3 comments:
Sunday, February 12, 2006

What do you do when...??

›
Sometimes you find yourself in one of those situations, where the customer calls you and wants to know: Who copied or modified a file, or Wh...
4 comments:

What the...??

›
What is the weirdest/most interesting thing you've seen when performing an investigation of a Windows system? I once was asked to look a...
2 comments:
Tuesday, February 07, 2006

The Forensic Server Project

›
Recently, I've received a couple of emails about the Forensic Server Project (aka, FSP), seen it written up in the Helix 1.7 Beginner...
2 comments:

Images to play with

›
From other forums, I've found example images that can be used to sharpen your skills in forensic analysis. For example, there are some i...
8 comments:

Registry research

›
Is anyone out there doing research into the Windows Registry, from a forensic perspective? I know that there are viewers available to allow ...
3 comments:
Sunday, January 29, 2006

The Evolution of Live Response

›
In my last post , I mentioned that the FRU and FSP had been demos as part of the CERT VTE. Very cool. If you've read this blog for an...
1 comment:
Thursday, January 26, 2006

In search of...

›
No, this isn't a flashback to that old Leonard Nimoy show ...it's about training. I got an email last night (don't have permiss...
Wednesday, January 25, 2006

Cool Magazines

›
Recently, with the demise of Phrack , I've run across a couple of very interesting online magazines, or e-zines. From Richard Bejtlich...
1 comment:
Tuesday, January 24, 2006

"Ooops, I did it again..."

›
No, this isn't a post about what would be on my iPod if I had one...it's even better. Recently, the NSA posted a document entitled,...
Thursday, January 12, 2006

The need for IR training

›
This ComputerWorld article caught my eye this morning...I've done vulnerability assessments before, and I fully agree with all of these ...
2 comments:
Wednesday, January 11, 2006

What is "security"??

›
Good question. We each approach topics like this differently, based on our background, experiences, etc. This thread on Slashdot caught my...
Thursday, January 05, 2006

How are you spending your security dollars?

›
I was reading some comments on another blog today, and one comment in particular caught my eye. A retired CIO lamented the fact that "m...

New NIST document (draft)

›
I was reviewing the updated E-evidence.info site this morning, and one of the interesting things I came across was the draft NIST SP800-86 ,...
2 comments: