Pages

▼
Wednesday, June 13, 2007

Determining the version of XP

›
I received an interesting comment to one of my recent blog posts...the poster was musing that he wished he could determine the version of XP...
7 comments:
Monday, June 11, 2007

Some Registry stuff...

›
I like "Registry stuff". I don't know what the fascination is, but for some reason, I love stuff that has to do with the Regi...
2 comments:

Windows Forensic Analysis Book Review

›
Andrew Hay posted the first review of my book ...that I'm aware of! ;-) Andrew also posted the review on Amazon ! Thanks, Andrew!
2 comments:
Saturday, June 02, 2007

AntiForensics Article

›
I read an interesting article recently that talks about antiforensics . At first glance, the article is something of an interesting piece...
13 comments:

Thoughts on Live Acquisition

›
Recently, I've been doing some thinking about issues surrounding live acquisitions - specifically, acquiring an image from a system that...
1 comment:
Friday, June 01, 2007

A little about my book...

›
I apologize for this brief digression from the normal flow of the blog, but I've been receiving certain comments of late from several ve...
14 comments:
Tuesday, May 29, 2007

XP Firewall

›
Pp 216 - 128 of my book address the Windows XP firewall logs; where the file(s) is/are located on a system, and how they are useful to an i...
2 comments:
Saturday, May 26, 2007

XP Anti-Forensics

›
There is discussion now and again in computer forensic circles regarding "anti-forensics", techniques that are used on systems to ...
2 comments:
Friday, May 25, 2007

Prefetch Analysis

›
I've seen a couple of posts recently on other blogs (here's one from Mark McKinnon ) pertaining to the Windows XP Prefetch capabilit...
10 comments:
Saturday, May 19, 2007

New versions of tools released

›
I ran across a blog post this morning saying that new versions of pwdump6 and fgdump have been released. So what does this have to do wit...

Litchfield on Oracle Live Response

›
Thanks to Richard Bejtlich , I learned this morning that David Litchfield , famed security researcher with NGSSoftware , has released a pape...
5 comments:
Sunday, May 13, 2007

Forensic Visualization

›
A while ago, I ran across an interesting 3D visualization project called fe3d . I remember thinking at the time that this would have been c...
2 comments:
Saturday, May 12, 2007

Forensic Laws

›
I mentioned a concept or idea in my book, but I wanted to follow up on it a bit...I believe to be a theorem . Okay, maybe not a theorem (th...
24 comments:
Friday, May 11, 2007

PPT Metadata

›
I received an email recently asking if I had any tools to extract metadata from PowerPoint presentations. Chapter 5 of my book includes th...
Tuesday, May 08, 2007

Event Logs in Unallocated Space

›
I received an email from a friend recently, asking about finding an Event Log in unallocated (ne "free") space. He mentioned that...
2 comments:
Sunday, May 06, 2007

SOLD OUT!

›
I went by the Syngress site for my book today and saw a message that said, in part: Sorry! This item is currently out of stock at syngress.c...
2 comments:

Interviews

›
For anyone who is curious about my book, Windows Forensic Analysis (ToC and sample chapter available), I've had an opportunity to speak...
5 comments:
Tuesday, May 01, 2007

Something Else To Look For...

›
Not long ago, Didier Stevens blogged about Windows Safe Mode and some Registry keys/values that pertain to Safe Mode. He filed this blog e...
2 comments:
Saturday, April 28, 2007

Something New To Look For

›
Over on the Windows Forensic Analysis group, Hogfly mentioned something he'd found in a honeypot that had been compromised by the MS D...
Tuesday, April 17, 2007

WFA Sample Chapter

›
I wanted to point out to the readers of this blog that Syngress/Elsevier has a sample chapter of my book available online for free download...
8 comments: