Pages

▼
Saturday, May 31, 2008

Innovation

›
I was reading a list entry recently, looking at some of the functionality that was being added to a popular forensic analysis application, a...
5 comments:
Monday, May 26, 2008

RegRipper Update

›
I wanted to let folks know that I've posted the latest version of RegRipper to SF.net. The file you're looking for is "rr_2.0...
7 comments:
Sunday, May 25, 2008

More Free Tools

›
To continue adding to the list of free tools (earlier posts here and here ), here are a couple of gems I found recently... NetworkMiner - ...
1 comment:
Wednesday, May 21, 2008

F-Response - Extend Your Arsenal

›
I recently played with F-Response Enterprise Edition , and I have to tell you, this stuff rocks! Excuse me...R0x0rz! Imagine as an incide...
Thursday, April 24, 2008

RegRipper Video Posted

›
Hogfly emailed me last night to let me know that he'd posted a video on how to use F-Response and RegRipper together in live response...
6 comments:
Sunday, April 20, 2008

Updated RegRipper

›
I posted an updated version of RegRipper (2.01A, Basic Edition) up on SF.net ...I had a couple of small updates to the GUI, mostly in the ar...

Free Analysis

›
What??!? "Free" (as in 'beer') analysis? A bit ago, I blogged about Forensic Analysis on the Cheap , and I wanted to rev...
4 comments:
Friday, April 18, 2008

Cutaway does Windows IR

›
The Security Ripcord site has a great new article on Windows IR , and using system resources to get the data you need. I know that some fol...
Tuesday, April 08, 2008

RegRipper on SF.net

›
I've posted RegRipper v2.0A Basic Edition to SF.net. The archive includes the source and EXEs for RegRipper and rip.exe (as well as t...
9 comments:
Sunday, April 06, 2008

Bejtlich on IR, Forensics

›
Richard Bejtlich, of TaoSecurity fame, recently blogged about an article he'd written for CSO Magazine, entitled Computer Incident Det...
Saturday, April 05, 2008

Ripping the Registry w/ rip.exe

›
While I was developing the RegRipper, I found that I could use some means of testing plugins without having to fire up the RegRipper GUI eac...
9 comments:

Registry Analysis Myths

›
No, sorry...I don't have a lisp... Based on a recent comment , it occurred to me that there are several myths regarding Registry analysi...

More about the Registry...

›
While my recent posts have been about Registry analysis, I didn't want to ignore the work that has been done with regards to extracting ...

Windows Oddities

›
Here are a couple of odd things about forensic analysis of Windows systems that I thought I'd share... Windows Accounts A user on one of...
3 comments:
Tuesday, April 01, 2008

More Registry Analysis...

›
I think that in discussing Registry analysis, one of the shortcomings we're facing is the translation to the analyst of why something li...
3 comments:
Monday, March 31, 2008

WFA slashdotted!

›
Yes, WFA was slashdotted ! Thanks to Don for the review! In the past (Aug 2004), Richard Bejtlich showned a correlation between a book rev...
2 comments:
Friday, March 28, 2008

Registry Analysis - What Is It??

›
That's right...what is this thing we call " Registry analysis "? When someone performs "Registry analysis", what ar...
17 comments:
Thursday, March 13, 2008

New WFA Review Posted

›
Rob Lee posted a review of Windows Forensic Analysis today...check it out! I have to tell you, it's a good one! Rob really hits home ...
2 comments:
Wednesday, March 05, 2008

Event Log Analysis

›
In keeping with the Getting Started posts, I wanted to include something that may be of interest with regards to finding corroborating artif...
7 comments:
Monday, February 25, 2008

Getting Started, pt II

›
Okay, in the face of recent (and completely bullsh*t) claims by Sen. Clinton that Sen. Obama plagiarized speeches (so the guy used some phr...
3 comments: