Pages

▼
Friday, April 30, 2010

F-Response & Some Mo Stuffz

›
F-Response I know I've mentioned this already, but this one is worth repeating...Matt's up to v3.09.07 , which includes support for...
3 comments:
Friday, April 23, 2010

Links...and whatnot

›
There seems to be a theme to this post...something along the lines of accessing data through alternate means or sources...and whatnot... Blo...
Wednesday, April 14, 2010

More Links

›
RegRipper in Use Simon posted to the Praetorian Prefect blog recently regarding WinPE. In his post, Simon described installing and using R...
3 comments:
Sunday, April 11, 2010

Links...and whatnot

›
Security Ripcord Don posted recently on his experiences attending the Rob Lee's SANS SEC 508 course. Don has some very interesting ins...
4 comments:
Tuesday, April 06, 2010

WFA 2/e Amazon Ranking!

›
Good news, all...and thanks to @Syngress for tweeting this this morning! Windows Forensic Analysis 2/e is still ranked #1 on Amazon in the...
6 comments:
Monday, April 05, 2010

ITB 0x1 is out!

›
Don has posted the new ITB , issue 0x1! This issue has an article on plist files, and a write-up on Don's review of the Super Drivelock....
1 comment:
Friday, April 02, 2010

New stuff

›
Speaking The first ever Sleuth Kit and Open Source Digital Forensics Conference is coming up in June, 2010, and I'll be one of the speak...

Thought of the Day

›
I've been working on writing my latest book and got to a section of the first chapter where I talk about analysis and what that means. ...
7 comments:
Tuesday, March 30, 2010

Links

›
Timelines Grayson finished off a malware/adware exam recently by creating a timeline, apparently using the several different tools includin...
2 comments:
Sunday, March 28, 2010

Thought of the Day

›
Don't be dependent upon tools; rather, focus on the goals of your exam, and let those guide you. When starting an exam, what is the firs...
Saturday, March 27, 2010

Thought of the Day

›
Today's TotD is this...what are all of the legislative and regulatory requirements that have been published over the last...what is it.....
Friday, March 26, 2010

Responding to Incidents

›
Lenny Zeltser has an excellent presentation on his web site that discusses how to respond to the unexpected . This presentation is well wor...
2 comments:

Links

›
Evtx Parsing Andreas has released an update to his Evtx Parser tools, bringing the version up to 1.0.4. A great big thanks to Andreas fo...
5 comments:
Tuesday, March 23, 2010

Even More Thoughts on Timelines

›
I realize that I've talked a bit about timeline creation and analysis , and I know that others ( Chris , as well as Rob ) have covered t...
4 comments:
Monday, March 22, 2010

Links

›
File Initialization Eoghan had an excellent post on issues/ pitfalls of file initialization , particularly on Windows systems. After readin...
Wednesday, March 17, 2010

Timeline Creation and Analysis

›
I haven't really talked about timelines in a while, in part because I've been creating and analyzing them as part of every engagemen...
6 comments:
Monday, March 15, 2010

Tidbits

›
Windows 7 XPMode I was doing some Windows 7 testing not long ago, during which I installed a couple of applications in XPMode . The first t...
5 comments: