Pages

▼
Monday, July 27, 2009

Links

›
If you're at all interested in steganography , including not only the technology but also available tools, you should check out this pa...
2 comments:
Tuesday, July 21, 2009

Links and Stuff

›
The Forensic 4Cast Awards (live video-cast) were posted at the end of the last week; a huge thanks to everyone who submitted nominations an...
Sunday, July 19, 2009

More Perl-y goodness

›
I've uploaded a new script (handle.pl) to the files section of the Win4n6 Yahoo group...this is a script I wrote this morning to proces...
3 comments:
Saturday, July 18, 2009

Update on USB Devices

›
I posted to the Win4n6 Yahoo Group on USB removable storage devices and tracking connections, and got some really good confirmation from Rob...
1 comment:
Tuesday, July 14, 2009

SANS Summit Question

›
During the recent SANS Forensic Summit , there were a number of questions handed to Rob during the panels that went unanswered due to time c...
12 comments:
Saturday, July 11, 2009

Links and New Stuff

›
The MalwareForensics site , based on the book by the same name , is up and running...pretty nice so far. If you're involved in incident...

Windows Registry Forensic Analysis

›
Based on some comments I received from folks who reviewed WFA 2/e , I am strongly considering writing a book on Windows Registry Forensic An...
6 comments:

SANS Forensic Summit

›
I spent all day last Tuesday in downtown DC attending the SANS Forensic Summit...it was totally awesome and well worth every second I was th...

User Account Analysis

›
Something I picked up on recently (albeit not directly at the SANS Summit) was how to determine if a password had been set on a system, when...
Friday, July 10, 2009

RipXP Released!

›
I've decided to release RipXP , which I've demo'd at both SANS Forensic Summits, as is. Go to the RegRipper site Downloads sect...
3 comments:
Monday, July 06, 2009

SANS Forensic Summit 2009

›
I'm really looking forward to getting to the SANS Forensic Summit tomorrow! This is a great place to meet, listen to some great presen...
1 comment:
Saturday, July 04, 2009

The Case of the Missing MFT Entry

›
A bit ago, I received an email from someone mentioning the following facts with respect to an examination they were doing: - Malware was sus...
11 comments:
Monday, June 22, 2009

Links

›
My interview with Lee Whitfield is up as Forensic4Cast episode 17 . Lee asked some interesting questions, so be sure to listen to the entir...
3 comments:
Wednesday, June 17, 2009

#1 on Amazon!

›
Just today, I found out that WFA 2/e is #1 in the Amazon Sales Rank for Forensics books! Awesome! Thanks to everyone who's reviewed th...
5 comments:
Tuesday, June 16, 2009

Buy F-Response, get a free copy of WFA 2/e!

›
Hey, no kidding! Check it out ! Matt's offering a free (as in "beer") copy of WFA 2/e with each purchase or renewel of F-Re...
Sunday, June 14, 2009

WFA 2/e eBooks

›
I've received a number of emails regarding ebook versions of WFA 2/e, and at this point, all I've been able to determine is that Els...
8 comments:
Saturday, June 13, 2009

Thoughts on Timeline Analysis

›
I was chatting with Chris Pogue (a fellow Syngress book author attending the SANS Forensic Summit ) a bit over the past couple of days on ...
10 comments:
Friday, June 12, 2009

Very Interesting Developments

›
I don't often get presented with issues of copyright violation and intellectual property theft, but I did see this one today. It seems...
20 comments:

SANS Forensic Summit

›
Folks, let's not forget that the SANS Forensic Summit is coming up! Check out the list of speakers, presentations, and panels...this c...
Tuesday, June 09, 2009

More Links

›
NetWitness announced on 8 June the availability of NetWitness Insight. This is a very interesting announcement, in part because, IMHO, Net...