Pages

▼
Sunday, November 30, 2008

Changing the Face of IR

›
Major corporations handle our sensitive data...referred to as PII , PHI, PCI . Sometimes, they don't do such a great job of securing an...
5 comments:
Monday, November 24, 2008

IR Preparedness

›
As a responder, I often hear two reasons for folks calling for help after a breach has occurred (aside from the rather obvious one, that is)...
Thursday, November 20, 2008

Yet another way to use RegRipper

›
The other day, John McCash sent me an email that said the following (posted with permission): I figured out how to make Encase switch the cu...
4 comments:
Saturday, November 15, 2008

New Code Posted

›
I posted JT's deleted .zip code to the RegRipper site this morning...go to Downloads, click on RegRipper, and you'll see the zippe...
Thursday, November 13, 2008

Rootkit Detection For Free

›
During an engagement not long ago, the customer's IT staff had collected bits of the suspect network traffic, and then using the source ...
Wednesday, November 12, 2008

More Deleted Keys Goodness!

›
I was performing some analysis recently, and ran across some real analysis goodness. First off, I was using my usual tools to parse and ana...
Friday, October 31, 2008

Random Updates

›
I've been on the road a bit lately, and as such don't really have much info for a single post, but I have a couple of small tidbits ...
3 comments:
Thursday, October 23, 2008

Bridging the Gap

›
I work for a large corporation that includes a vulnerability research organization. This organization is responsible for discovering vulner...
Wednesday, October 22, 2008

What do you need as a responder?

›
Many times when working with customers or talking with folks who interface with incident responders (or are incident responders), the topic...
Tuesday, October 21, 2008

New Tools

›
Thought I'd take a page from Claus 's book and update everyone as to some new tools that are available... First, over on the Volatil...
2 comments:
Monday, October 20, 2008

'Zines

›
For a while now, I've been asking others about what they thought about a forensics/IR magazine...a 'zine (print or electronic) dedic...
6 comments:
Saturday, October 18, 2008

Summit Takeaways

›
I recently received an email from the organizers of the SANS Forensic Summit and was asked to provide my biggest takeaways from the summit, ...
1 comment:
Wednesday, October 15, 2008

SANS Forensic Summit

›
The SANS Forensic Summit , a first-of-its-kind event for incident responders and forensic analysts, is over and I have to give a hearty and ...
13 comments:
Tuesday, October 07, 2008

RegRipper Plugin Generator

›
Jason Koppe , whom I met at DFRWS (Jason, Cory and I "helped" close out the tab at the reception at the Wharf Rat on Monday even...
3 comments:
Monday, October 06, 2008

New Registry Analysis Tools

›
As I mentioned earlier , James Macfarlane has released an update to his Parse::Win32Registry Perl module. In order to install the module, ...

Bluetooth in the Registry

›
Does anyone out there have Registry hive files available from a system that they've used (or know has been used) to complete Bluetooth ...
4 comments:
Saturday, October 04, 2008

Hackin9 Registry Analysis Article

›
I received word this past week that an article I had written on Registry Analysis would be appearing in an upcoming issue of Hackin9 magazi...

SANS Forensic Summit

›
As the SANS Forensic Summit draws nigh, I've been preparing the demos for my presentation, Secrets of Registry Analysis Revealed . In ...
6 comments:
Tuesday, September 30, 2008

Rootkit Detection

›
I received a comment to an older post from James (thanks, James!) yesterday who pointed me toward a very interesting article on Rootkit.com ...
Monday, September 29, 2008

Updates - 29 Sept

›
Some new items have popped up on the IR radar over the past week or so... CyberSpeak podcast with an interview of Kevin Mandia . Kevin tal...