Pages

▼
Sunday, August 31, 2008

Fun Stuff

›
While attending DFRWS 2008, I also attended the Forensic Rodeo. I say "attended" because I originally had no intention of partici...
Saturday, August 30, 2008

RegRipper News and Mentions

›
I'm never really sure who's using RegRipper and how they're using it, or how they'd like to use it. However, getting input ...
9 comments:
Wednesday, August 27, 2008

The Need for Speed

›
The recent Best Western issue illustrates an important point, which was mentioned in many of the posted articles on this issue... Complianc...
7 comments:
Sunday, August 24, 2008

The Demented Musings of an Incident Responder

›
I respond, therefore I am . H. Carvey, 2008 I thought I'd jot down some of the things I see from time to time in the field... In some n...
3 comments:
Saturday, August 23, 2008

Browser Artifact Analysis

›
There are a number of times where an analyst would need to know a bit about a user's web browsing activities in order to determine what ...
6 comments:
Wednesday, August 20, 2008

What's in your clipboard

›
When I've written about performing incident response data collection ( here and here ), I've mentioned retrieving any available dat...
Saturday, August 16, 2008

Volatility 1.3 is out!

›
Volatility 1.3 is out! Volatile Systems (AAron, et al.) improves upon their venerable open-source memory analysis tool with this latest ver...
Friday, August 15, 2008

NRDFI

›
I received an email from AccessData the other day in my work inbox, advertising something called the National Repository for Digital Forensi...
7 comments:

Data Exfiltration

›
Similar to copied files , one of the questions that responders and analysts get from time to time is, how do I tell what data was copied of...

F-Response: Imaging RAIDs

›
Matt Shannon posted an excellent article to his blog this morning called Singing in the RAID ...it's a must read , folks. Take a look. ...
2 comments:

DFRWS2008

›
I have to say...I'm not an avid conference goer/crasher, but I have been to a few security conferences, starting with Usenix back on ...
Monday, August 11, 2008

Open Memory Forensics Workshop

›
This is the first time this workshop has been put on, but I have to say that it was a rousing success right off the starting blocks! An ex...
1 comment:
Friday, August 08, 2008

File Associations

›
Now and again, I'll see posts in the lists asking questions about files based on the names and/or the extensions of the files. If the n...
2 comments:
Thursday, August 07, 2008

Upcoming Events

›
It seems that one of my partners-in-crime and I will be attending a couple of events together this year...stay tuned for some good times! O...
1 comment:
Tuesday, August 05, 2008

MRT

›
The SANS Internet Storm Center had an interesting post the other day about the MS Malicious Software Removal Tool (aka, MRT). What I took...
Monday, August 04, 2008

ProDiscover 5 is out!

›
Technolo gy Pathways announced today that ProDiscover 5.0 is now available! Updates include: - Added the ability to investigate, extract, ...
1 comment:
Sunday, August 03, 2008

The Question of "whodunnit?"

›
One of the questions that comes up from time to time during an examination is "whodunnit?" Take an examination involving, let...
1 comment:
Wednesday, July 23, 2008

Copying Files

›
Every now and again, I see the question of "where does Windows keep logs of files copied to a thumb drive, or CD/DVD?" Recently, ...
1 comment:
Tuesday, July 22, 2008

The Future of IR

›
Many readers like to hear what others think is "the future" of something...what changes are coming down the road, how a certain se...

Imaging Devices in the Registry

›
I ran across an interesting blog this morning that had to do with Windows image acquisition devices , and where files are stored. These de...