Pages

▼
Tuesday, May 29, 2007

XP Firewall

›
Pp 216 - 128 of my book address the Windows XP firewall logs; where the file(s) is/are located on a system, and how they are useful to an i...
2 comments:
Saturday, May 26, 2007

XP Anti-Forensics

›
There is discussion now and again in computer forensic circles regarding "anti-forensics", techniques that are used on systems to ...
2 comments:
Friday, May 25, 2007

Prefetch Analysis

›
I've seen a couple of posts recently on other blogs (here's one from Mark McKinnon ) pertaining to the Windows XP Prefetch capabilit...
10 comments:
Saturday, May 19, 2007

New versions of tools released

›
I ran across a blog post this morning saying that new versions of pwdump6 and fgdump have been released. So what does this have to do wit...

Litchfield on Oracle Live Response

›
Thanks to Richard Bejtlich , I learned this morning that David Litchfield , famed security researcher with NGSSoftware , has released a pape...
5 comments:
Sunday, May 13, 2007

Forensic Visualization

›
A while ago, I ran across an interesting 3D visualization project called fe3d . I remember thinking at the time that this would have been c...
2 comments:
Saturday, May 12, 2007

Forensic Laws

›
I mentioned a concept or idea in my book, but I wanted to follow up on it a bit...I believe to be a theorem . Okay, maybe not a theorem (th...
24 comments:
Friday, May 11, 2007

PPT Metadata

›
I received an email recently asking if I had any tools to extract metadata from PowerPoint presentations. Chapter 5 of my book includes th...
Tuesday, May 08, 2007

Event Logs in Unallocated Space

›
I received an email from a friend recently, asking about finding an Event Log in unallocated (ne "free") space. He mentioned that...
2 comments:
Sunday, May 06, 2007

SOLD OUT!

›
I went by the Syngress site for my book today and saw a message that said, in part: Sorry! This item is currently out of stock at syngress.c...
2 comments:

Interviews

›
For anyone who is curious about my book, Windows Forensic Analysis (ToC and sample chapter available), I've had an opportunity to speak...
5 comments:
Tuesday, May 01, 2007

Something Else To Look For...

›
Not long ago, Didier Stevens blogged about Windows Safe Mode and some Registry keys/values that pertain to Safe Mode. He filed this blog e...
2 comments:
Saturday, April 28, 2007

Something New To Look For

›
Over on the Windows Forensic Analysis group, Hogfly mentioned something he'd found in a honeypot that had been compromised by the MS D...
Tuesday, April 17, 2007

WFA Sample Chapter

›
I wanted to point out to the readers of this blog that Syngress/Elsevier has a sample chapter of my book available online for free download...
8 comments:
Sunday, April 15, 2007

Drive Encryption

›
One of the challenges posed by Vista to traditional forensic analysis is the use of BitLocker to encrypt data on the hard drive. However, th...
10 comments:
Monday, April 09, 2007

From the Lab: Mapping USB devices via LNK files

›
My first "From the Lab" post will be to address something I see regularly in forums; how does one tie a specific USB-connected dev...
21 comments:

Great news for IR and live response!

›
There was some great news recently for IR and live response! Over the past couple of years, when discussing the viability and usefulness of ...
8 comments:
Sunday, April 08, 2007

Interesting Tool - SecInspect

›
Now that my book has been released, I'll be posting updates, errata, and comments here in this blog. Some of the updates will include ...
Monday, April 02, 2007

Using Perl in Forensics

›
Ever wondered how some folks use Perl in their jobs, particularly when performing computer forensic analysis? I'm always interested to ...
Saturday, March 31, 2007

Book updates - NukeOnDelete and SysProt AntiRootkit

›
Now that my book is available , I'll be posting things like updates and errata here in the blog. As I mentioned before , one of chapters...
6 comments: