Pages

▼
Sunday, September 27, 2009

Where was Waldo?

›
I was talking to some really, really smart folks last week about some things you could do with data that resulted from computer forensic an...
23 comments:
Friday, September 25, 2009

Linkity-Link

›
Now and again, the question comes up about writing technical forensic examination reports. Often in some forums, you'll see someone say...
4 comments:
Wednesday, September 16, 2009

Parsing .job Files

›
John McCash recently posted an interesting article to the SANS Forensic blog on decoding the binary Scheduled Task .job file format (John...
9 comments:
Thursday, September 10, 2009

Mo' Stuff

›
Man, there is just so much stuff sometimes, that it takes several posts to get it all in... Perhaps one of the biggest things to come throu...
2 comments:
Wednesday, September 09, 2009

Thoughts on Tool Verification

›
A recent thread over on ForensicFocus got me to thinking about the issue of tool verification. In that thread, there is discussion of veri...
7 comments:
Tuesday, September 08, 2009

RegRipper Wishlist

›
I posted something similar to the RegRipper forums, but I'll do the same here...I'm looking to consolidate a RegRipper wishlist, so ...
2 comments:

Tools for mounting images

›
A while ago, I posted on mounting DD images , and I wanted to provide an updated list of some of the tools that you can use to do just that ...
5 comments:

Stuff

›
Been out of pocket, enjoying my temporary unemployment for a while, and now I'm back in the game... Richard Bejtlich posted his review o...
1 comment:
Wednesday, September 02, 2009

More Links

›
I found another review of WFA 2/e this morning, this one on the ISC^2 web site, from Jesse Lands...thanks! I greatly appreciate when folks...
2 comments:
Monday, August 31, 2009

What is "Registry Analysis"??

›
What is this thing called (that's the second time I've used that Benny Hill reference in this blog)... Registry analysis ? For most...
4 comments:

Links and Stuff (Registry research)

›
The subtitle of this blog post is "There are more things in heaven and earth than are dreamt of in your EnScript", to paraphrase H...
Wednesday, August 26, 2009

Goin' commando

›
Cory had post a bit ago about using alternatives to commercial analysis suites when conducting an exam, and that got me to thinking...when ...
7 comments:
Monday, August 24, 2009

Virtualization

›
What is a way to use a system to perform various activities, but leave minimal traces? One might think that any of the available cleaner to...

Papers, Tools, and Such

›
If you do any work at all with network traffic captures (ie, .pcap files), you should take a look at Claus's Network Capture Tools and U...
Tuesday, August 18, 2009

Tools and Links

›
From DFRWS 2009 ( papers here ) and Andreas's tweets I found out about NFI Defraser , a utility that reportedly detects full or partial...
1 comment:
Sunday, August 16, 2009

HelpNet Security Interview Posted

›
I recently responded to an email Q&A session for HelpNet Security ...it's posted here . Thoughts?
6 comments:
Thursday, August 13, 2009

Timeline Creation Tools Posted

›
I've posted the currently available timeline creation tools to the Files section of the Win4n6 Yahoo group , along with a PDF document ...
Monday, August 10, 2009

Links and Stuff

›
Once again, I present for your reading pleasure an odd mish-mash of links to information that defy categorization... I no longer do PCI fore...
Saturday, August 08, 2009

Thoughts on using a "trusted shell"

›
Recently I've seen the topic of using a "trusted shell", especially when performing live response on Windows systems, brought ...
Tuesday, August 04, 2009

More work on Timeline Analysis

›
I saw that there's a new post over on the SANS Forensic blog about generating timelines for analysis by adding "alternative" ...
2 comments: