Pages

▼
Monday, February 25, 2008

Getting Started, pt II

›
Okay, in the face of recent (and completely bullsh*t) claims by Sen. Clinton that Sen. Obama plagiarized speeches (so the guy used some phr...
3 comments:

When First Responders Attack!!

›
It still happens...an "event" or "incident" occurs within an organization, and the initial response from the folks on-si...
4 comments:
Thursday, February 21, 2008

Important Memory Update

›
I ran across this info today, and thought that I'd post it...it seems quite important, in that it pertains to the use of physical memor...
5 comments:
Wednesday, February 20, 2008

Getting started, or forensic analysis on the cheap

›
Quite often, I'll see posts or receive emails from folks asking about how to get started in the computer forensic analysis field. What ...
17 comments:

Jesse rides again!

›
Jesse Kornblum has done it again! Jesse's one of those guys who releases some really amazing tools for use in the IR and forensic anal...
Friday, February 15, 2008

CIO article on the need for forensics

›
CIO Magazine out of the UK has an interesting article titled In-depth Investigation that discusses the need for computer forensics capabili...

New Docs at SWGDE

›
The Scientific Working Group on Digital Evidence ( SWGDE ) has released some new documents , the most notable of which are the Vista Technic...
3 comments:
Thursday, February 07, 2008

DFRWS 2008 Announcement

›
The DFRWS 2008 CfP and Challenge have been posted! The CfP invites contributions on a wide range of subjects, including: Incident respons...
Thursday, January 31, 2008

Enter Sandman

›
You're probably wondering, "Since when did Metallica have anything to do with Windows forensics?" My answer to that is...sinc...
2 comments:

Artifact Repositories, part deux

›
I wanted to take my last post on this topic just a bit further... I received an email from someone recently asking me about checklists for ...
4 comments:
Sunday, January 27, 2008

Artifact Repositories

›
I see posts in a number of lists asking about (and for) forensic artifacts for P2P applications...lately, there have been several about Lim...
13 comments:
Tuesday, January 22, 2008

Free AV Scanners

›
Many times during an examination, you may want to do a little data reduction, by scanning your image for the presence of malware. While thi...
19 comments:
Sunday, January 13, 2008

IR Immediate Actions

›
As you may remember, in December 2007 I presented at the HTCIA conference in Hong Kong , the first HTCIA conference for this chapter. It wa...
5 comments:
Tuesday, January 08, 2008

Response to "antiforensics"

›
On one of the online forums this evening, someone posted about reading the latest issue of 2600 and finding an article that mentions the us...
13 comments:
Saturday, January 05, 2008

Metadata, again...

›
I've blogged about metadata for various file types before, and the other day I saw a question regarding metadata in MS Works documents....
3 comments:
Tuesday, January 01, 2008

First Post of '08

›
So, here it is...the first post of 2008 on my blog...what to say, what to say? I'm not a big fan of the "predictions" posts, ...
6 comments:
Saturday, December 29, 2007

Who you gonna call?

›
Remember that old tag line from the '80's? It's right up there with "where's the beef!" However, my question is ...
3 comments:
Friday, December 28, 2007

Deleted Apps

›
Another question I've received, as well as seen in online forums, has to do with locating deleted applications. As Windows performs some...

The MAC Daddy

›
I received a question in my inbox today regarding locating a system's MAC address within an image of a system, and I thought I'd sha...
3 comments:
Sunday, December 23, 2007

Perl Scripting Book

›
It looks like my Perl Scripting book made it out just in time for Christmas! Oddly enough, it only seems to be available on Amazon...I can...
14 comments: