Pages

▼
Wednesday, August 29, 2007

TechTalk Interview

›
Back on 10 June, I did an interview on TechTalk , and I saw today that it's posted here . There's some other news...CNN, weather, e...
1 comment:
Tuesday, August 21, 2007

Vista IR

›
I recently started doing some testing of IR tools on Vista, using Vista Ultimate (32-bit) installed into a VMWare Workstation 6.0 virtual m...
13 comments:
Saturday, August 18, 2007

Copying Files

›
I've been party to or heard a good number of discussions lately regarding USB removable storage devices, and one of the topics that inva...
1 comment:
Friday, August 17, 2007

IR "Best Practices"

›
I know it's been a while since I've posted, but work has been really keeping me busy...that's an excuse that we all use, but tha...
Monday, July 16, 2007

Book Review

›
Donald Tabone posted a review of my book, Windows Forensic Analysis , here . In his review, Mr. Tabone included this: What I dislike about ...
10 comments:
Saturday, July 14, 2007

Thoughts on RAM acquisition

›
As a follow-on to the tool testing posts, I wanted to throw something else out there...specifically, I'll start with a comment I receiv...
7 comments:
Thursday, July 12, 2007

Tool Testing Methodology, Memory

›
In my last post , I described what you'd need to do to set up a system in order to test the effects of a tool we'd use on a system ...
3 comments:

Tool Testing Methodology

›
As I mentioned earlier, the newly-released ACPO Guidelines state: By profiling the forensic footprint of trusted volatile data forensic too...
Wednesday, July 11, 2007

Are you Security Minded?

›
Kai Axford posted on his blog that he's been "terribly remiss in his forensic discussions". This originated with one of Kai...

Updates, etc.

›
Not posting anywhere close to regularly lately, I felt that a couple of updates and notices of new finds were in order... First off, James M...
2 comments:

ACPO Guidelines

›
The Association of Chief Police Officers (ACPO), in association with 7safe , has recently released their updated guide to collecting electr...
8 comments:
Thursday, July 05, 2007

Windows Forensic Analysis Book Review Posted

›
Richard Bejtlich has posted a review of Windows Forensic Analysis on Amazon . 5 (count 'em!) stars! Wow! The review starts with: Wo...
4 comments:
Wednesday, June 27, 2007

Book Updates

›
I got word yesterday that Syngress is going to discontinue selling hard copy books from their web site. They will continue to sell ebooks, ...
4 comments:
Sunday, June 17, 2007

What is RAM, legally speaking?

›
Ever wondered what the legal definition of "RAM" is? I was perusing the Computer Forensics and Incident Response blog this morni...
5 comments:
Saturday, June 16, 2007

Restore Point Analysis

›
Others have posted bits and pieces regarding System Restore Point analysis (Stephen Bunting's site has some great info ), and I've e...
4 comments:
Thursday, June 14, 2007

EventLog Analysis

›
In my book , I covered the Windows 2000, XP, and 2003 EventLog file header and event record structure in some detail. There's also a P...
2 comments:
Wednesday, June 13, 2007

Determining the version of XP

›
I received an interesting comment to one of my recent blog posts...the poster was musing that he wished he could determine the version of XP...
7 comments:
Monday, June 11, 2007

Some Registry stuff...

›
I like "Registry stuff". I don't know what the fascination is, but for some reason, I love stuff that has to do with the Regi...
2 comments:

Windows Forensic Analysis Book Review

›
Andrew Hay posted the first review of my book ...that I'm aware of! ;-) Andrew also posted the review on Amazon ! Thanks, Andrew!
2 comments:
Saturday, June 02, 2007

AntiForensics Article

›
I read an interesting article recently that talks about antiforensics . At first glance, the article is something of an interesting piece...
13 comments: