Pages

▼
Saturday, May 29, 2010

Some more stuff...

›
Registry I've been working on a book on forensic analysis of the Windows Registry, and I was adding something to my outline the other da...
2 comments:
Wednesday, May 26, 2010

More links...

›
WFA 2/e Book Review Pete r Sheffield posted a review of WFA 2/e over on the SANS Forensic Blog. What can I say, besides, " Thanks, Pe...
Friday, May 21, 2010

Analysis Tips

›
I wanted to throw out a couple of things that I've run across... MFT I've worked a number of incidents where malware has been placed...
2 comments:

Temporal Proximity

›
A couple of years ago, I heard someone...a really smart someone...talk about "temporal proximity". I know that sounds Star Trek-y...
2 comments:
Friday, May 14, 2010

Linkity linkity

›
RegRipper.net Brett updated RegRipper.net recently...take a look. I received some emails recently regarding "404 Not Found" mess...
4 comments:
Friday, April 30, 2010

F-Response & Some Mo Stuffz

›
F-Response I know I've mentioned this already, but this one is worth repeating...Matt's up to v3.09.07 , which includes support for...
3 comments:
Friday, April 23, 2010

Links...and whatnot

›
There seems to be a theme to this post...something along the lines of accessing data through alternate means or sources...and whatnot... Blo...
Wednesday, April 14, 2010

More Links

›
RegRipper in Use Simon posted to the Praetorian Prefect blog recently regarding WinPE. In his post, Simon described installing and using R...
3 comments:
Sunday, April 11, 2010

Links...and whatnot

›
Security Ripcord Don posted recently on his experiences attending the Rob Lee's SANS SEC 508 course. Don has some very interesting ins...
4 comments:
Tuesday, April 06, 2010

WFA 2/e Amazon Ranking!

›
Good news, all...and thanks to @Syngress for tweeting this this morning! Windows Forensic Analysis 2/e is still ranked #1 on Amazon in the...
6 comments:
Monday, April 05, 2010

ITB 0x1 is out!

›
Don has posted the new ITB , issue 0x1! This issue has an article on plist files, and a write-up on Don's review of the Super Drivelock....
1 comment:
Friday, April 02, 2010

New stuff

›
Speaking The first ever Sleuth Kit and Open Source Digital Forensics Conference is coming up in June, 2010, and I'll be one of the speak...

Thought of the Day

›
I've been working on writing my latest book and got to a section of the first chapter where I talk about analysis and what that means. ...
7 comments:
Tuesday, March 30, 2010

Links

›
Timelines Grayson finished off a malware/adware exam recently by creating a timeline, apparently using the several different tools includin...
2 comments:
Sunday, March 28, 2010

Thought of the Day

›
Don't be dependent upon tools; rather, focus on the goals of your exam, and let those guide you. When starting an exam, what is the firs...
Saturday, March 27, 2010

Thought of the Day

›
Today's TotD is this...what are all of the legislative and regulatory requirements that have been published over the last...what is it.....
Friday, March 26, 2010

Responding to Incidents

›
Lenny Zeltser has an excellent presentation on his web site that discusses how to respond to the unexpected . This presentation is well wor...
2 comments:

Links

›
Evtx Parsing Andreas has released an update to his Evtx Parser tools, bringing the version up to 1.0.4. A great big thanks to Andreas fo...
5 comments:
Tuesday, March 23, 2010

Even More Thoughts on Timelines

›
I realize that I've talked a bit about timeline creation and analysis , and I know that others ( Chris , as well as Rob ) have covered t...
4 comments: