Pages

▼
Friday, September 29, 2006

New issue of the IJDE

›
The lastest edition of the International Journal of Digital Evidence (IJDE) is out, and the most interesting article (for me, anyway) is Je...
Tuesday, September 26, 2006

Something old, something new...with USB

›
It really amazes me sometimes how a journalist "covering the security scene" will wake up one day and come to the relevation that ...
3 comments:
Monday, September 25, 2006

Perl Programming on Win32

›
Back in the day ('round about '99 or so), I was struggling to learn Perl programming on the Windows platform...I could do the simple...

MetaData and eDiscovery

›
In yesterday's CyberSpeak podcast , mention was made of issues with Office document metadata and eDiscovery. Several commercially avail...
9 comments:
Wednesday, September 20, 2006

FIRST Conf '07 CfP

›
FIRST opened their call for papers (CfP) for the 19th Annual FIRST Conference , to be held in Seville, Spain, in June, 2007. The CfP page ...

Vista RC1 Install

›
The other night, I installed Vista RC1 via VMWare . Before doing so, I made sure to read up on any issues identified in the VMWare Knowle...
1 comment:
Friday, September 15, 2006

ProDiscover 4.8 is out!

›
Last week, I received an early announcement from Chris Brown about the release of ProDiscover 4.8 , so I downloaded it to check it out. I...
Thursday, September 14, 2006

OS Detection, Explained

›
Okay...the code's been posted to SF.net , so I thought I'd describe what it does... The archive listed under "OS Detection...
2 comments:
Wednesday, September 13, 2006

OS Detection from a RAM Dump, part deux

›
Okay, here's where I'm at on this so far... I'm implementing a method of OS detection from a RAM dump by going to the kernel bas...
Sunday, September 10, 2006

OS Detection from a RAM Dump

›
I mentioned earlier that I'm working on a script that will help with OS detection from a RAM dump, either dd-style or a VMWare .vmem fi...
Thursday, September 07, 2006

Gromozon Rootkit

›
I received a link to an SCMagazine article about the Gromozon rootkit this morning, and I found some interesting tidbits in the writeup. Th...
2 comments:

Extracting and authenticating files from RAM dumps

›
Andreas had an interesting post a while back regarding authenticating executable files reconstructed from RAM dumps (Andreas, can you enabl...
1 comment:
Wednesday, September 06, 2006

Win2003SP1 and RAM dump parsing

›
The saga of memory analysis continues... Okay, so the other night I was working on some OO Perl code for parsing RAM dumps, and I decided t...
2 comments:
Tuesday, September 05, 2006

What's new

›
Thought I'd take a moment to post some new items that I've run across, just this morning... First, I was checking email this morning...
2 comments:
Friday, September 01, 2006

Using Perl in the Enterprise

›
This post isn't specifically about IR and forensics, but it is sorta...tangentially. I was reading on a blog entry today how to use Powe...
Thursday, August 31, 2006

Getting WEP passphrases

›
Remember a bit ago when I blogged about getting wireless SSIDs out of the Registry? Well, a little while after that, the guys over at the ...

Getting user info from an image

›
A while ago, I posted on how to determine a user's group membership from the Registry files in an image. Andreas Schuster also posted ...
1 comment:

IR Tools review

›
I took a look at IR tools recently, and today ran across an SC Magazine review of forensic tools ...as it turns out, the review is of IR to...
Tuesday, August 29, 2006

LiveView

›
Ever wondered what was going on with a system while it was running? Have you ever been looking at an image in your analysis - tool - of - c...
4 comments:
Monday, August 28, 2006

Interesting Event IDs

›
Every now and then, when I analyze a Windows box, the Event Logs end up being pretty important to the issue at hand, and not just because th...
1 comment: