Pages

▼
Tuesday, April 28, 2009

Windows AutoRun feature

›
Oh, how I love this ...in order to address the issue with the Windows AutoRun capability, which malware such as Conficker (no, NOT 'C...
10 comments:
Monday, April 27, 2009

Data and Context

›
I receive questions from time to time regarding various bits of information, some of which is presented in my book. I recently received som...
Friday, April 24, 2009

CaptainForensics

›
Hey, be sure to check out the the latest CaptainForensics comic ...wow, very cool!! In this comic, the MergeStreams utility is mentioned.....
3 comments:
Thursday, April 23, 2009

Tools

›
I like to be open to different tools that can be used to assist in analysis, and for those of you who know me, sometimes I write my own . H...
2 comments:
Wednesday, April 22, 2009

Timeline Analysis - XP Restore Points

›
So, MS says that XP's going to be supported at least through 2014...nice. So this means great things for examiners and analysts...great...
Monday, April 20, 2009

Linkfest

›
Taking a page from Claus 's book... I was reading the latest print edition of Hackin9 , and in the In Brief section, there is a small in...

Event Log Analysis

›
I caught a very interesting blog post on the ISC the other day that had to do with Windows Event Logs. In short, the post illustrates a fa...
Sunday, April 19, 2009

Timeline - Sources

›
I saw an interesting Twitter from Rob Lee other day which led me to the MS site, where they said: We plan to provide support for Windows XP...
Thursday, April 16, 2009

Obtaining file system timeline data

›
One of the things I've run across regarding generating timeline data from the file system is that there has to be more than one way to ...
Wednesday, April 15, 2009

F-Response 3G is out!

›
Check out this post over on the F-Response site...Matt's released the lastest and greatest 3rd generation F-Response! I've got it...
2 comments:

Timeline Analysis - RegRipper

›
In my last post on timeline analysis, I described using file system data (via TSK's fls.exe), Event Log data (via a custom Perl script)...
1 comment:
Tuesday, April 14, 2009

SANS Summit Updates

›
Rob Lee has updated the SANS Forensic/IR Summit information, as well as the agenda . Chris Pogue of TrustWave will be joining us in the IR...

New Volatility Plugins

›
Andreas has posted a couple of new Volatility plugins recently that look really interesting, in that he provided the capability to link fil...
Monday, April 13, 2009

Someone uses RegRipper

›
I was pleasantly surprised the other day to receive a forwarded post from a list that I don't have access to where someone had successfu...
3 comments:
Saturday, April 11, 2009

Addressing the need to evolve

›
Been watching the 'net recently to see what's new? I have. Saw the MMPC write-up on Conficker.E recently, and it occurred to me t...
1 comment:
Thursday, April 09, 2009

SANS Forensic Summit Agenda

›
Rob Lee has posted the agenda for the SANS Forensics and Incident Response Summit , to be held 7-9 July 2009 in Washington, DC. I attended t...
4 comments:

New Edition of Captain Forensics is up!

›
The latest edition of CaptainForensics has been posted, check it out! Keep your eyes open for future editions...at the end of this edition,...
Sunday, April 05, 2009

Timeline Analysis, pt VI - Taking Another Step

›
In my last post on timeline analysis, I illustrated how you could use some freely available tools to get started in developing a detailed t...
Wednesday, April 01, 2009

Extending Your Reach

›
As a consultant, one of the things I have always struggled with is an enterprise capability. Often, I'll go on-site for an organization...
3 comments:
Tuesday, March 31, 2009

Some WAY Cool Stuff

›
First...you've GOT to see this . Tell me that the main character doesn't look surprisingly like Marcus Ranum . Second, a huge shou...
4 comments: