Pages

▼
Thursday, July 28, 2011

WFA 3/e

›
I've mentioned a couple of times, in this blog as well as in a couple of lists, that I'm working on completing Windows Forensic Anal...
11 comments:
Monday, July 25, 2011

Updates

›
WRF Review Andrew Hay posted a glowing review of Windows Registry Forensics on Amazon recently.  I greatly appreciate those who have purch...
3 comments:
Thursday, July 21, 2011

Evading Investigators and Analysts

›
I recently had an opportunity to spend two days with some great folks in the Pacific Northwest, talking about timeline creation and analysis...
2 comments:
Wednesday, July 20, 2011

Carbon Black

›
I attended a Carbon Black (Cb) demo recently, at the invitation of the great folks of Kyrus .  The demo was intended to show some of the im...
Saturday, July 09, 2011

More Links, Updates

›
Meetup Our 6 July NoVA Forensic Meetup went very well, and I wanted to thank Tom Harper for putting in the time and effort that it takes t...
7 comments:
Wednesday, July 06, 2011

Structure Adds Context

›
A while ago, I was talking to Cory Altheide and he mentioned something about timeline analysis that sort of clarified an aspect of the analy...
6 comments:

More Links

›
Meetup Just a reminder about tonight's meetup: Location : ReverseSpace (this is our location, unless stated otherwise) Time : 7-8:3...
Monday, July 04, 2011

Links

›
Independence Day Before anything else, Happy 4th!  I hope that everyone takes a moment to remember those who have fought and sacrificed for...
2 comments:
Tuesday, June 28, 2011

Meetup, Tools and other stuff

›
Meetup Just a reminder about our next NoVA Forensic Meetup, scheduled for 6 July.  Tom Harper will be presenting, and he's posted  his ...
3 comments:
Monday, June 27, 2011

Links and Updates

›
CyberSpeak Ovie's got a new podcast up , be sure to check it out. In this podcast, Ovie interviews John Goldfoot, lawyer and author of...
Wednesday, June 22, 2011

Defining "Forensic Value"

›
Who defines "forensic value" when it comes to data?  How does a string of 1s and 0s become "valuable", "evidence...
14 comments:
Monday, June 20, 2011

Awards

›
Not long ago, at the SANS Forensic Summit , I received two awards during the Forensic 4Cast Awards ceremony.  I was not able to attend this...
8 comments:

Links and Updates

›
Reviews Eric Huber posted an excellent review of the DFwOST book that Cory wrote, and I assisted on the writing (full disclosure; I...