Pages

▼
Tuesday, June 24, 2008

Most Wished For...

›
Grabbed this image off of Amazon this morning..."Windows Forensic Analysis" is the #1 Most Wished For book in the Computers & ...
10 comments:
Tuesday, June 17, 2008

Determing the OS version from an image

›
I was perusing the ForensicWiki list of recently added pages this evening and ran across an interesting page/placeholder titled, Determining...
5 comments:

Memory Collection and Analysis, part II

›
Based on my last post, I wanted to throw some quick tests together and see how things worked out...here's the results of what I found......
19 comments:
Saturday, June 14, 2008

Memory Collection and Analysis

›
As a follow-on to my previous post regarding OMFW, there have been some developments in the area of memory dumping and parsing (ie, collect...
12 comments:
Wednesday, June 11, 2008

NTFS Alternate Data Streams

›
NTFS Alternate Data Streams (ADSs) have been around since the dawn of...well... NTFS . Windows OSs ship with plenty of tools to create (and...
1 comment:

Portable Devices on Vista

›
Rob Lee shared an interesting tidbit of Vista Registry goodness with me recently...basically, the Vista Registry maintains some historical d...
4 comments:
Tuesday, June 10, 2008

RegRipper Plugin Updates

›
Pretty much everyone is aware by now that the full version of RegRipper is available on SF.net . I made a couple of minor updates to some o...
4 comments:
Thursday, June 05, 2008

Some UpComing Events

›
There are some interesting events coming up this summer (and beyond) that I wanted to point out to folks... DFRWS is this summer (11-13 Aug...
5 comments:
Monday, June 02, 2008

Job Openings

›
Okay, I'm going to take a slight divergence from the normal content of this blog to reach out to all of you, my loyal readers...accordin...
3 comments:
Saturday, May 31, 2008

Innovation

›
I was reading a list entry recently, looking at some of the functionality that was being added to a popular forensic analysis application, a...
5 comments:
Monday, May 26, 2008

RegRipper Update

›
I wanted to let folks know that I've posted the latest version of RegRipper to SF.net. The file you're looking for is "rr_2.0...
7 comments:
Sunday, May 25, 2008

More Free Tools

›
To continue adding to the list of free tools (earlier posts here and here ), here are a couple of gems I found recently... NetworkMiner - ...
1 comment:
Wednesday, May 21, 2008

F-Response - Extend Your Arsenal

›
I recently played with F-Response Enterprise Edition , and I have to tell you, this stuff rocks! Excuse me...R0x0rz! Imagine as an incide...
Thursday, April 24, 2008

RegRipper Video Posted

›
Hogfly emailed me last night to let me know that he'd posted a video on how to use F-Response and RegRipper together in live response...
6 comments:
Sunday, April 20, 2008

Updated RegRipper

›
I posted an updated version of RegRipper (2.01A, Basic Edition) up on SF.net ...I had a couple of small updates to the GUI, mostly in the ar...

Free Analysis

›
What??!? "Free" (as in 'beer') analysis? A bit ago, I blogged about Forensic Analysis on the Cheap , and I wanted to rev...
4 comments:
Friday, April 18, 2008

Cutaway does Windows IR

›
The Security Ripcord site has a great new article on Windows IR , and using system resources to get the data you need. I know that some fol...
Tuesday, April 08, 2008

RegRipper on SF.net

›
I've posted RegRipper v2.0A Basic Edition to SF.net. The archive includes the source and EXEs for RegRipper and rip.exe (as well as t...
9 comments:
Sunday, April 06, 2008

Bejtlich on IR, Forensics

›
Richard Bejtlich, of TaoSecurity fame, recently blogged about an article he'd written for CSO Magazine, entitled Computer Incident Det...
Saturday, April 05, 2008

Ripping the Registry w/ rip.exe

›
While I was developing the RegRipper, I found that I could use some means of testing plugins without having to fire up the RegRipper GUI eac...
9 comments: