Pages

▼
Thursday, February 15, 2007

(In)Secure Magazine Mention

›
I received an email from Didier Stevens this morning, letting me know that he'd mentioned me in an article that he wrote for (In)Secure...
4 comments:
Wednesday, February 14, 2007

BlackHat DC

›
Who's going to BlackHat DC ? I found out today that my publisher has a pass available for me, and I'm looking forward to the opport...
1 comment:
Friday, February 09, 2007

Why I like Perl for Forensic Analysis

›
Many times when I post to a list or give a presentation and talk about using Perl, I almost immediately hear comments back such as, "I ...
7 comments:
Tuesday, January 30, 2007

Intentional erasure

›
An interesting question appeared on one of the listservs a bit ago..."what is an investigator's protocol for demonstrating intentio...
5 comments:
Tuesday, January 23, 2007

Scripts for parsing the Registry

›
I was working on a script recently to expand the reach of the Registry Analysis material in my upcoming book, and I thought it would be a go...
Friday, January 19, 2007

SAMParse

›
Not too long ago , I blogged about using the Parse::Win32Registry module to parse raw Registry files, specifically the SAM file. Since then...
6 comments:

St Louis...here I come!

›
I'm headed to the DoD Cybercrime Conference in St. Lous, MO, next week. I'll be presenting at 0830 on Thursday morning. It turns...
6 comments:
Wednesday, January 17, 2007

Legends of the Tech Industry

›
Okay, this post is not specific to Windows or IR, but I wanted to mention this... Ever since I was in graduate school , I've been intere...
5 comments:
Tuesday, January 16, 2007

Fundamentals

›
MS recently posted their Fundamental Computer Investigation Guide for Windows . You can download the document or read the entire doc online...
1 comment:
Sunday, January 14, 2007

P0wned by certs

›
Have we been p0wned by certs? You're probably asking yourself, "What the...?" right about now. Bear with me on this one. Ho...
1 comment:
Saturday, January 13, 2007

New SANS Cert

›
Do we need another SANS cert? I don't think it's so much about us...it's what SANS wants. I was reading TaoSecurity this morni...
5 comments:
Friday, January 12, 2007

IMHO

›
I received some questions from readers and I thought that I'd take a crack at them... With consumer and commerical hard drives getting l...
6 comments:
Friday, January 05, 2007

What's New So Far in 2007

›
Less than a week into 2007, and there's already a bunch of new stuff out that is really useful and really cool. First off, there's a...
1 comment:
Wednesday, January 03, 2007

New Year's Resolutions

›
I read today that there are some technical bloggers that have resolved to not make any New Years resolutions. Uh...okay...but isn't say...
4 comments:
Saturday, December 30, 2006

Tagged!

›
Okay, I haven't blogged in a while...not because I haven't wanted to, but because I've been working (you know, that thing that p...
7 comments:
Wednesday, November 29, 2006

Artifact classes

›
I've been doing some thinking about IR and CF artifacts over the past couple of weeks, and wanted to share my thoughts on something that...
6 comments:
Tuesday, November 28, 2006

MS AntiMalware Team paper

›
I know I'm a little behind on this one, but I saw this morning that back in June, the MS AntiMalware team released an MSRT white paper ...
Monday, November 27, 2006

Some sites of note

›
I've been perusing a couple of new sites that I've run across over the past couple of weeks and wanted to pass them on to others, an...
3 comments:
Sunday, November 26, 2006

A little programming fun, etc.

›
I was working on writing my book yesterday afternoon (for those of you who live in my area and know how nice it was outside, I know...shame ...
3 comments:
Friday, November 17, 2006

How do you do that voodoo that you do?

›
After reading through the SecuriTeam documents , and then reading this SANS ISC post , I have to admit, incident response can be extremely ...
4 comments: