Pages

▼
Thursday, January 31, 2008

Enter Sandman

›
You're probably wondering, "Since when did Metallica have anything to do with Windows forensics?" My answer to that is...sinc...
2 comments:

Artifact Repositories, part deux

›
I wanted to take my last post on this topic just a bit further... I received an email from someone recently asking me about checklists for ...
4 comments:
Sunday, January 27, 2008

Artifact Repositories

›
I see posts in a number of lists asking about (and for) forensic artifacts for P2P applications...lately, there have been several about Lim...
13 comments:
Tuesday, January 22, 2008

Free AV Scanners

›
Many times during an examination, you may want to do a little data reduction, by scanning your image for the presence of malware. While thi...
19 comments:
Sunday, January 13, 2008

IR Immediate Actions

›
As you may remember, in December 2007 I presented at the HTCIA conference in Hong Kong , the first HTCIA conference for this chapter. It wa...
5 comments:
Tuesday, January 08, 2008

Response to "antiforensics"

›
On one of the online forums this evening, someone posted about reading the latest issue of 2600 and finding an article that mentions the us...
13 comments:
Saturday, January 05, 2008

Metadata, again...

›
I've blogged about metadata for various file types before, and the other day I saw a question regarding metadata in MS Works documents....
3 comments:
Tuesday, January 01, 2008

First Post of '08

›
So, here it is...the first post of 2008 on my blog...what to say, what to say? I'm not a big fan of the "predictions" posts, ...
6 comments:
Saturday, December 29, 2007

Who you gonna call?

›
Remember that old tag line from the '80's? It's right up there with "where's the beef!" However, my question is ...
3 comments:
Friday, December 28, 2007

Deleted Apps

›
Another question I've received, as well as seen in online forums, has to do with locating deleted applications. As Windows performs some...

The MAC Daddy

›
I received a question in my inbox today regarding locating a system's MAC address within an image of a system, and I thought I'd sha...
3 comments:
Sunday, December 23, 2007

Perl Scripting Book

›
It looks like my Perl Scripting book made it out just in time for Christmas! Oddly enough, it only seems to be available on Amazon...I can...
14 comments:
Sunday, December 02, 2007

Windows Shortcut (LNK) files

›
I saw a question in a forum recently regarding Windows Shortcut Files , and thought I would post something that included my findings from a ...
3 comments:
Saturday, December 01, 2007

Forensic Analysis

›
Often (well, often enough) we run into instances where it becomes evident that someone has an unrealistic expectation of what answers forens...
2 comments:
Wednesday, November 21, 2007

Alternative Methods of Analysis

›
Do I need to say it again? The age of Nintendo Forensics is gone, long past. Acquiring a system is no longer as simple as removing the hard...
8 comments:
Tuesday, November 20, 2007

Windows Memory Analysis

›
It's been a while since I've blogged on memory analysis, I know. This is in part due to my work schedule, but it also has a bit to ...
5 comments:
Sunday, November 18, 2007

Jesse's back!

›
Jesse blogged recently about being over at the F3 conference in the UK, and how he was impressed with the high SNR . Jesse shared with me...
Saturday, November 17, 2007

Upcoming Speaking Engagement

›
Next month, I'll be in Hong Kong, speaking to the local police, as well as at the HTCIA-HK conference . The primary topic I've been...
1 comment:
Sunday, November 11, 2007

Pimp my...Registry analysis

›
There are some great tools out there for viewing the Registry in an acquired image. EnCase has this, as does ProDiscover (I tend to prefe...
10 comments:

Pimp my...live acquisition

›
Whenever you perform a live acquisition, what do you do? Document the system, write down things like the system model (ie., Dell PowerEdge ...