Pages

▼
Wednesday, November 21, 2007

Alternative Methods of Analysis

›
Do I need to say it again? The age of Nintendo Forensics is gone, long past. Acquiring a system is no longer as simple as removing the hard...
8 comments:
Tuesday, November 20, 2007

Windows Memory Analysis

›
It's been a while since I've blogged on memory analysis, I know. This is in part due to my work schedule, but it also has a bit to ...
5 comments:
Sunday, November 18, 2007

Jesse's back!

›
Jesse blogged recently about being over at the F3 conference in the UK, and how he was impressed with the high SNR . Jesse shared with me...
Saturday, November 17, 2007

Upcoming Speaking Engagement

›
Next month, I'll be in Hong Kong, speaking to the local police, as well as at the HTCIA-HK conference . The primary topic I've been...
1 comment:
Sunday, November 11, 2007

Pimp my...Registry analysis

›
There are some great tools out there for viewing the Registry in an acquired image. EnCase has this, as does ProDiscover (I tend to prefe...
10 comments:

Pimp my...live acquisition

›
Whenever you perform a live acquisition, what do you do? Document the system, write down things like the system model (ie., Dell PowerEdge ...
Thursday, November 08, 2007

Pimp my...forensics analysis

›
How often do you find yourself in the position where, when performing forensic analysis, you end up either not having the tools you need (ie...
Saturday, October 27, 2007

Some new things...

›
I've been offline and not posting for a while, I know...not much time to post with so much going on during my day job (but that's a ...
3 comments:
Saturday, September 15, 2007

Registry Analysis

›
You've probably noticed a huge gap between posts...sorry about that. Contrary to popular belief, I don't just sit around all day wr...
2 comments:

Conference Presentations

›
I noticed from Anton's blog that the DFRWS 2007 papers were posted and available. I agree with Anton, a couple of the presentations a...
Monday, September 03, 2007

More on (the) UserAssist keys

›
Didier Stevens has continued some of his excellent work regarding the UserAssist keys in the Registry. This morning, he posted an entry th...
2 comments:
Wednesday, August 29, 2007

TechTalk Interview

›
Back on 10 June, I did an interview on TechTalk , and I saw today that it's posted here . There's some other news...CNN, weather, e...
1 comment:
Tuesday, August 21, 2007

Vista IR

›
I recently started doing some testing of IR tools on Vista, using Vista Ultimate (32-bit) installed into a VMWare Workstation 6.0 virtual m...
13 comments:
Saturday, August 18, 2007

Copying Files

›
I've been party to or heard a good number of discussions lately regarding USB removable storage devices, and one of the topics that inva...
1 comment:
Friday, August 17, 2007

IR "Best Practices"

›
I know it's been a while since I've posted, but work has been really keeping me busy...that's an excuse that we all use, but tha...
Monday, July 16, 2007

Book Review

›
Donald Tabone posted a review of my book, Windows Forensic Analysis , here . In his review, Mr. Tabone included this: What I dislike about ...
10 comments:
Saturday, July 14, 2007

Thoughts on RAM acquisition

›
As a follow-on to the tool testing posts, I wanted to throw something else out there...specifically, I'll start with a comment I receiv...
7 comments:
Thursday, July 12, 2007

Tool Testing Methodology, Memory

›
In my last post , I described what you'd need to do to set up a system in order to test the effects of a tool we'd use on a system ...
3 comments:

Tool Testing Methodology

›
As I mentioned earlier, the newly-released ACPO Guidelines state: By profiling the forensic footprint of trusted volatile data forensic too...
Wednesday, July 11, 2007

Are you Security Minded?

›
Kai Axford posted on his blog that he's been "terribly remiss in his forensic discussions". This originated with one of Kai...