Pages

▼
Tuesday, February 23, 2010

More on AV write-ups

›
Okay, okay...the title of this post isn't the greatest, I get it...but no pun intended. Anyway, I left it as is because (a) I couldn...
13 comments:

Researching Artifacts

›
One of the things I really like about this industry is that there's always something new...a new challenge, a new twist to old questions...

IT firm looses...a lot!

›
I caught a very interesting post on Brian Krebs' site this morning...you'll find it here . As an incident responder, the first thing...
3 comments:
Friday, February 19, 2010

Fun Analysis Stuff

›
Event Log Analysis Here's another one for all of you out there doing Event Log Analysis. I installed Office 2007 (ie, version 12) on an...
1 comment:
Wednesday, February 17, 2010

More Links, and a Thanks

›
A Good Example (aka, The Need for Training) I was reading Brian Krebs' blog the other morning, and found an interesting story ...inter...
Monday, February 15, 2010

Links Plus

›
I've spent a lot of space in this blog talking about timeline analysis lately, so I wanted to take something of a different tact for a ...
Monday, February 08, 2010

MFT Analysis

›
As an aside to timeline analysis, I've been considering the relative confidence levels inherent to certain data sources, something I had...
2 comments:

Timeline Analysis...do we need a standard?

›
Perhaps more appropriately, does anyone want a standard, specifically when it comes to the output format? Almost a year ago, I came up with...
14 comments:
Friday, February 05, 2010

Is anyone doing timeline analysis??

›
Apparently, someone is...the Illustrious Don Weber , the inspiration behind the ITB , to be specific. In a recent SecRipcord blog post , he...
13 comments:
Thursday, February 04, 2010

How Did THAT Get There???

›
Didier posted recently regarding a VBA macro in Excel that allowed him to launch a command shell. This got me to thinking about something ...
Wednesday, February 03, 2010

Forensic Analysis and Intel Gathering

›
Continuing the vein of my previous post , while I do see some benefit to an intelligence rating system being adopted and utilized when it co...
2 comments:
Tuesday, February 02, 2010

More Thoughts on Timeline Analysis

›
I had a conversation with Cory recently, and during the conversation, he mentioned that if I was going to present at a conference and talk a...
5 comments:

A Conference By Any Other Name...

›
...would still smell as sweet. In a somewhat lame attempt at paraphrasing Willie the Shakes, I wanted to point out that it's that time o...
1 comment:

Some New Stuff

›
Podcast Caught the new CyberSpeak podcast Monday morning...this one was dated 31 Jan, and was sans Bret...I grabbed it from the CyberSpeak...
Monday, February 01, 2010

Forensic Analysis Process/Procedures

›
I've seen posts recently on some of the lists regarding processing forensic data...in most cases, the original question seems to center ...
1 comment:
Friday, January 29, 2010

Thoughts on APT

›
There's been a great deal of discussion lately about the advanced persistent threat , or APT , and I've seen list posts from folks ...
10 comments:
Tuesday, January 26, 2010

Links

›
Tools David Kovar has written a tool, in Python, to parse the NTFS $MFT, called analyzeMFT . The tool can be downloaded from this site . I...
Wednesday, January 20, 2010

Interesting Analysis

›
I was analyzing a Windows 2003 R2 SP2 image recently, and I ran across some interesting things that I thought might be a good idea to share....
3 comments: