Pages

▼
Monday, July 31, 2006

Extracting Executable Images from RAM Dumps

›
In his Cyberspeak podcast interview , Jesse Kornblum mentioned the tool I'd recently released called Lspi.pl , for L i S t P rocess I m...

"Genius" Kornblum on fuzzy hashing

›
Jesse Kornblum was recently interviewed by the CyberSpeak podcast guys with regards to his "fuzzy hashing" paper to be presented...
Thursday, July 20, 2006

LiSt Process Image upload

›
I've uploaded lspi 0.4 to my SourceForge site , and if you use lsproc or want to be able to automatically extract process image files f...
2 comments:
Monday, July 17, 2006

Automatic binary reassembly from a RAM dump

›
A bit ago, Andreas Schuster posted to his blog about reconstructing executable images from a RAM dump ( 1 , 2 , 3 ). The first method list...
8 comments:
Wednesday, July 12, 2006

Forensics Magazine

›
A bit ago, I blogged about cool technical e-zines that are available. Since then, CheckMate really seems to have come along, and I've...
10 comments:
Tuesday, July 11, 2006

Have you seen...?

›
I'm looking for a couple of things before I get started down the road in collecting my own data regarding forensic artifacts, so I thoug...

Book FAQ

›
In putting together my next book, one of the things I've put a lot of thought into is providing examples, as well as exercises. For exa...
Thursday, June 22, 2006

New Forensics Book

›
I've found a publisher who wants to publish my second book. I've got a contract on my desk right now. Our goal is to have this boo...
7 comments:
Tuesday, June 20, 2006

RCFG/GMU2006

›
I'm due to present at the RCFG GMU2006 conference in August, on two topics. I'll be presenting on "Tracking USB Devices on W...
Friday, June 16, 2006

Case Issues

›
Sitting in my own little microcosm, my own little piece of the world, I tend to wonder sometimes if folks run into the same issues I do duri...
5 comments:
Monday, June 12, 2006

Malware update: Rootkit that uses NTFS ADS

›
Wow, two of my favorite subjects, in one bit of malware ...neat! Rustock (a la Symantec's nomenclature) was discovered on 1 June (the S...
4 comments:

I need your help...

›
...with two things, both with respect to the FRUC/FSPC. The first thing I need your help with is based on a comment/request I received rece...

FRUC and FSPC Cyberspeak Interview

›
The latest Cyberspeak podcast includes my interview regarding the latest version of the Forensic Server Project components. The interview...
Friday, June 09, 2006

Setting up the FRUC INI file

›
Now that the Forensic Server Project has been posted, I should take a moment to post something specifically about the First Responder Utilit...
Thursday, June 08, 2006

FSPC and FRUC posted

›
I've finally uploaded the FRUC v 1.2 (client component of the Forensic Server Project) and the FSPC 1.0c (server component of the Forens...
1 comment:
Saturday, May 27, 2006

What's in YOUR wallet?

›
By "wallet", I'm referring to your CD wallet, or more specifically, your toolkit. What tools do you use during Windows IR/CF a...
4 comments:

SF updates info

›
Folks, I just wanted to point out a couple of things regarding the tools I have posted, and will be posting, to the SF site . First off, I s...
Thursday, May 25, 2006

Forensic Analysis Issues

›
I ran across something recently that I had researched before, and hadn't thought a lot about, so I thought I'd blog about it. You...
2 comments:
Tuesday, May 23, 2006

Sourceforge updates

›
Okay, I know I haven't blogged in a while, but work's been busy. On a positive note, I updated the contents of the WindowsIR Sourcef...
2 comments:
Saturday, April 29, 2006

Future Trends

›
Would I be remiss if I were to NOT discuss future trends in computer forensics? Every now and then you see the curious posting questions a...
2 comments: