Pages

▼
Thursday, June 22, 2006

New Forensics Book

›
I've found a publisher who wants to publish my second book. I've got a contract on my desk right now. Our goal is to have this boo...
7 comments:
Tuesday, June 20, 2006

RCFG/GMU2006

›
I'm due to present at the RCFG GMU2006 conference in August, on two topics. I'll be presenting on "Tracking USB Devices on W...
Friday, June 16, 2006

Case Issues

›
Sitting in my own little microcosm, my own little piece of the world, I tend to wonder sometimes if folks run into the same issues I do duri...
5 comments:
Monday, June 12, 2006

Malware update: Rootkit that uses NTFS ADS

›
Wow, two of my favorite subjects, in one bit of malware ...neat! Rustock (a la Symantec's nomenclature) was discovered on 1 June (the S...
4 comments:

I need your help...

›
...with two things, both with respect to the FRUC/FSPC. The first thing I need your help with is based on a comment/request I received rece...

FRUC and FSPC Cyberspeak Interview

›
The latest Cyberspeak podcast includes my interview regarding the latest version of the Forensic Server Project components. The interview...
Friday, June 09, 2006

Setting up the FRUC INI file

›
Now that the Forensic Server Project has been posted, I should take a moment to post something specifically about the First Responder Utilit...
Thursday, June 08, 2006

FSPC and FRUC posted

›
I've finally uploaded the FRUC v 1.2 (client component of the Forensic Server Project) and the FSPC 1.0c (server component of the Forens...
1 comment:
Saturday, May 27, 2006

What's in YOUR wallet?

›
By "wallet", I'm referring to your CD wallet, or more specifically, your toolkit. What tools do you use during Windows IR/CF a...
4 comments:

SF updates info

›
Folks, I just wanted to point out a couple of things regarding the tools I have posted, and will be posting, to the SF site . First off, I s...
Thursday, May 25, 2006

Forensic Analysis Issues

›
I ran across something recently that I had researched before, and hadn't thought a lot about, so I thought I'd blog about it. You...
2 comments:
Tuesday, May 23, 2006

Sourceforge updates

›
Okay, I know I haven't blogged in a while, but work's been busy. On a positive note, I updated the contents of the WindowsIR Sourcef...
2 comments:
Saturday, April 29, 2006

Future Trends

›
Would I be remiss if I were to NOT discuss future trends in computer forensics? Every now and then you see the curious posting questions a...
2 comments:
Thursday, April 20, 2006

New ProScripts

›
The user forums at TechPathways were recently revamped and updated (WRT functionality). In the process, previous threads were lost. I...
Saturday, April 15, 2006

Reassembling an image file from a memory dump

›
Andreas Schuster posted a tutorial on his blog for reassembling the executable image of a process from a dump of physical memory a bit ago....
Friday, April 14, 2006

Why Perl?

›
I haven't actually been asked this question yet, but I'm anticipating it...why Perl? Why am I using Perl for the RAM dump parsing t...
1 comment:

But...why?

›
When it comes to using dd.exe to dump the contents of physical memory from a Windows system, one thing that's been asked is...why? Why...
Thursday, April 13, 2006

Updated lsproc

›
I've updated lsproc with some small changes. For one, I made a small change to the detection portion of the script. The other change I...
2 comments:

Prefetch files, revisited

›
I was listening to the latest CyberSpeak podcast (8 Apr) today, and picked up a little tidbit. With regards to those .pf files located in t...
1 comment:
Saturday, April 08, 2006

lspd posted

›
I've posted lspd (for "list process details") to the SourceForge site this morning. First, I want to say that this is a tool ...
3 comments: