Pages

▼
Monday, June 28, 2010

Skillz

›
Remember that scene from Napoleon Dynamite where he talks about having "skillz"? Well, analysts have to have skillz, right? I w...
3 comments:
Tuesday, June 22, 2010

Links and what not

›
Case Notes Chris posted on writing and maintaining case notes a bit ago, using Case Notes . One of the things that is sorely overlooked ma...
Sunday, June 20, 2010

Who's on...uh, at...FIRST?

›
I attended the FIRST conference in Miami last week. My employer is not a member of FIRST, but we were a sponsor, and we hosted the "G...
Thursday, June 10, 2010

Linkz

›
Analysis This post from the Digital Detective site discusses how to manually identify the time zone of a system from the image. This infor...
5 comments:

TSK/Open Source Conference

›
I have to say, when someone who's attended conferences sets out to create a conference, things tend to turn out pretty well. Aaron'...
6 comments:
Monday, June 07, 2010

Anti-forensics

›
The term "anti-forensics" is used sometimes to describe efforts attackers use in order to foil or frustrate the attempts of the go...
6 comments:
Thursday, June 03, 2010

Book Review

›
I recently had an opportunity to read through Handbook of Digital Forensics and Investigation (ISBN-10: 0123742676), edited by Eoghan Casey...

Stuffz

›
Tool Updates Paraben recently sent out an email about an updated version of their P2eXplorer tool being available. This is the product tha...
7 comments:
Wednesday, June 02, 2010

Timelines

›
With a couple of upcoming presentations that address timelines ( TSK/Open Source Conference , SANS Forensic Summit , etc.), I thought that i...
13 comments:
Saturday, May 29, 2010

Some more stuff...

›
Registry I've been working on a book on forensic analysis of the Windows Registry, and I was adding something to my outline the other da...
2 comments:
Wednesday, May 26, 2010

More links...

›
WFA 2/e Book Review Pete r Sheffield posted a review of WFA 2/e over on the SANS Forensic Blog. What can I say, besides, " Thanks, Pe...
Friday, May 21, 2010

Analysis Tips

›
I wanted to throw out a couple of things that I've run across... MFT I've worked a number of incidents where malware has been placed...
2 comments:

Temporal Proximity

›
A couple of years ago, I heard someone...a really smart someone...talk about "temporal proximity". I know that sounds Star Trek-y...
2 comments:
Friday, May 14, 2010

Linkity linkity

›
RegRipper.net Brett updated RegRipper.net recently...take a look. I received some emails recently regarding "404 Not Found" mess...
4 comments:
Friday, April 30, 2010

F-Response & Some Mo Stuffz

›
F-Response I know I've mentioned this already, but this one is worth repeating...Matt's up to v3.09.07 , which includes support for...
3 comments:
Friday, April 23, 2010

Links...and whatnot

›
There seems to be a theme to this post...something along the lines of accessing data through alternate means or sources...and whatnot... Blo...
Wednesday, April 14, 2010

More Links

›
RegRipper in Use Simon posted to the Praetorian Prefect blog recently regarding WinPE. In his post, Simon described installing and using R...
3 comments:
Sunday, April 11, 2010

Links...and whatnot

›
Security Ripcord Don posted recently on his experiences attending the Rob Lee's SANS SEC 508 course. Don has some very interesting ins...
4 comments: