Pages

▼
Wednesday, December 24, 2008

Flippin' Sweet!!

›
I found out today that WFA 2/e is available on Amazon for pre-order! Publisher's info here .
7 comments:
Monday, December 22, 2008

Using RegRipper

›
Ever wonder how to use RegRipper for analysis? After all, the tool pulls data from Registry hive files, and while there is a considerable ...
2 comments:
Saturday, December 20, 2008

Some Good Reading...

›
I wanted to post some interesting items I've run across and read recently... Brian Krebs wrote an excellent article that appeared on th...

Perl Module Updated!

›
Just in time from Christmas, James MacFarlane has give us some Perly goodness! James has updated Parse::Win32Registry to version 0.41! T...
3 comments:
Thursday, December 18, 2008

RegRipper

›
RegRipper made the SANS Forensics blog today in a post by John McCash about Windows viewers . Pretty cool stuff! John has deployed RegRi...

Less blogging, more writing

›
There's likely a noticeable slow-down in posts to this blog, and that will continue, as I'm working on the second edition of Windows...
5 comments:
Saturday, December 06, 2008

Windows Hibernation files

›
Matthieu has made his Exploiting Windows Hibernation File presentation available...for anyone interested at all in Windows memory analysis,...
5 comments:

Issues with AV

›
I noticed Hogfly's been blogging lately about issues with AV, here and here . It's some good stuff, and I think bears repeating......
1 comment:
Friday, December 05, 2008

Honor Thy Settings

›
Some of us have been working with the Sality virus lately, which reportedly propagates by writing an autorun .inf file and an executable fi...
6 comments:
Sunday, November 30, 2008

Changing the Face of IR

›
Major corporations handle our sensitive data...referred to as PII , PHI, PCI . Sometimes, they don't do such a great job of securing an...
5 comments:
Monday, November 24, 2008

IR Preparedness

›
As a responder, I often hear two reasons for folks calling for help after a breach has occurred (aside from the rather obvious one, that is)...
Thursday, November 20, 2008

Yet another way to use RegRipper

›
The other day, John McCash sent me an email that said the following (posted with permission): I figured out how to make Encase switch the cu...
4 comments:
Saturday, November 15, 2008

New Code Posted

›
I posted JT's deleted .zip code to the RegRipper site this morning...go to Downloads, click on RegRipper, and you'll see the zippe...
Thursday, November 13, 2008

Rootkit Detection For Free

›
During an engagement not long ago, the customer's IT staff had collected bits of the suspect network traffic, and then using the source ...
Wednesday, November 12, 2008

More Deleted Keys Goodness!

›
I was performing some analysis recently, and ran across some real analysis goodness. First off, I was using my usual tools to parse and ana...
Friday, October 31, 2008

Random Updates

›
I've been on the road a bit lately, and as such don't really have much info for a single post, but I have a couple of small tidbits ...
3 comments:
Thursday, October 23, 2008

Bridging the Gap

›
I work for a large corporation that includes a vulnerability research organization. This organization is responsible for discovering vulner...
Wednesday, October 22, 2008

What do you need as a responder?

›
Many times when working with customers or talking with folks who interface with incident responders (or are incident responders), the topic...
Tuesday, October 21, 2008

New Tools

›
Thought I'd take a page from Claus 's book and update everyone as to some new tools that are available... First, over on the Volatil...
2 comments:
Monday, October 20, 2008

'Zines

›
For a while now, I've been asking others about what they thought about a forensics/IR magazine...a 'zine (print or electronic) dedic...
6 comments: