Pages

▼
Friday, January 29, 2010

Thoughts on APT

›
There's been a great deal of discussion lately about the advanced persistent threat , or APT , and I've seen list posts from folks ...
10 comments:
Tuesday, January 26, 2010

Links

›
Tools David Kovar has written a tool, in Python, to parse the NTFS $MFT, called analyzeMFT . The tool can be downloaded from this site . I...
Wednesday, January 20, 2010

Interesting Analysis

›
I was analyzing a Windows 2003 R2 SP2 image recently, and I ran across some interesting things that I thought might be a good idea to share....
3 comments:
Sunday, January 17, 2010

Analysis Stuff

›
Metadata Didier has posted new versions of his PDFiD and pdf-parser tools. Didier's offerings really kind of run the gamut, don't ...
1 comment:
Friday, January 08, 2010

Links

›
e-Evidence Christina's updated the e-Evidence What's New site...check it out! There's always some good reading here... Tools S...
Monday, January 04, 2010

Browser Stuff

›
Many times during an examination, we'll take a look at the user's browser activity. That might include starting by getting the conte...
11 comments:

Linkilicious in 2010

›
RegRipper Paul Stutz sent me a nice email recently, telling me that he'd not only used RegRipper 's rip.pl on Linux, but he'd u...
Friday, January 01, 2010

First post of 2010

›
For my first post of 2010, I'm pleased to announce that the first edition of the IntoTheBoxes newsletter is out! Check it out! I have...
Wednesday, December 30, 2009

Lions, and tigers, and DECAF...oh, my!

›
Most of us are aware that DECAF is back, with a new version. Ovie had interviewed Mike and posted the podcast (I'd also posted , and ...
7 comments:
Monday, December 28, 2009

Investigating Breaches, pt. II

›
As a follow-on (or one of them, anyway) to my previous post on investigating breaches , I wanted to perhaps scratch the surface a bit more (...
2 comments:

Investigating Breaches

›
I recently received an email from someone who said that he wanted to learn more about "network intrusion investigations". Seeing ...
Wednesday, December 23, 2009

Links and Stuff

›
Practicals I love stuff that is practical...stuff you can look at, follow along on, and by the end of the hour/day, have a new skill. I rec...
2 comments:
Sunday, December 20, 2009

Using RegRipper

›
Now and again, I get stories from folks who've used RegRipper or the accompanying tools (rip, ripXP) to meet their needs. When that hap...
10 comments:
Saturday, December 19, 2009

The Trojan Defense

›
The malware did it...not me. How often do we see or hear of this? I don't see this specific question very often during exams...probably...
8 comments:

DF and Disclosure

›
The subtitle of this post should be something like, "The disclosure discussion comes to digital forensics" or "Yes, Virginia....
6 comments:
Thursday, December 17, 2009

When a tool is just a tool, pt II

›
Okay, this is part II for this post , because I posted an awesome rant to a thread in one of the forums, and I wanted to include that here, ...
3 comments: