Pages

▼
Monday, October 30, 2006

New Today

›
New Perl module on CPAN I received an email this morning that directed me to a "new" Perl module called Parse::Win32Registry . Fr...
3 comments:
Friday, October 27, 2006

It Bears Repeating

›
There are just somethings that you can't say often enough. For example, tell the ones you love that you love them. Also, tell them tha...
3 comments:
Thursday, October 26, 2006

Windows Memory Updates

›
Andreas recently released a new tool called poolgrep.pl . This lets you run searches across memory pools, looking for things such as timest...
Monday, October 23, 2006

ForensicZone.com

›
For those who haven't seen it, you should check out ForensicZone.com , home of PTFinderFE and SSDeepFE . There's also a number of ...

Vista, RAM dumps, and OS detection (oh, my!!)

›
I received an email from Andreas today, and one of the things he mentioned is that the offset for the Vista kernel in memory is 0x81800000.....
3 comments:
Friday, October 20, 2006

Pool tag finder

›
Andreas released his poolfinder tool the other day, a Perl script for locating pool tags in a memory dump. This script accompanies a pape...

Restore Point Forensics

›
I was doing some digging around the other day, researching System Restore points in XP...they're only in XP (and ME, but we're only ...
5 comments:
Wednesday, October 11, 2006

New HaxDoor variant

›
I picked this one up from the Securiteam blog this evening...it seems there's a new HaxDoor variant out. Symantec's technical writ...
1 comment:

PTFinder Front End

›
Andreas posted this on his blog, and I took a look at it...very cool. This is a front-end for running PTFinder, and even allows you to ch...
3 comments:
Monday, October 09, 2006

Are you a Spider man?

›
I found an announcement on another list today for Spider , a tool from Cornell University for locating sensitive personal information (SSN,...

Parsing Registry files

›
Last week, I mentioned making adaptations to a tool to perform specific tasks. Specifically, adapting the Offline Registry Parser so that...
1 comment:
Saturday, October 07, 2006

Innovation

›
This post is likely to be the first of several, as it's something I've been thinking about for quite a while, and it takes new form ...
4 comments:
Friday, October 06, 2006

d00d, you can do it on Windows, too!

›
Jesse Kornblum had a couple of interesting posts recently on his blog , both relating to ssdeep . Yes, Jesse, I found the ssdeep stuff to b...
Thursday, October 05, 2006

VMWare Converter (beta)

›
I received an email this morning that mentioned the release of VMWare 's Converter tool, which is still in beta. Clicking on the ...
Tuesday, October 03, 2006

Rootkits revisted

›
I was browsing the F-Secure blog this morning and found something interesting...from last Friday, there was this post about reselling stole...

FSP/FRU File Copy Client posted

›
I posted the File Copy Client (FCli) that was mentioned in Windows Forensics and Incident Recovery . After getting enough questions about i...
2 comments:
Monday, October 02, 2006

E-Evidence.info site updated

›
The E-Evidence site was updated earlier today...as always, lots of interesting stuff! Thanks, Christine!

When did a user's access change?

›
I saw a question today on the Windows Forensic Analysis group on Yahoo that I thought was definitely worth repeating here. One of the memb...
1 comment:
Friday, September 29, 2006

New issue of the IJDE

›
The lastest edition of the International Journal of Digital Evidence (IJDE) is out, and the most interesting article (for me, anyway) is Je...
Tuesday, September 26, 2006

Something old, something new...with USB

›
It really amazes me sometimes how a journalist "covering the security scene" will wake up one day and come to the relevation that ...
3 comments: