Pages

▼
Monday, May 21, 2012

My Apology

›
On 19 May, something of a firestorm seems to have erupted.  While I don't know most of what's been said, nor by whom, some friends h...
30 comments:
Friday, May 18, 2012

Good time for some 0xBADC0FEE

›
Every now and then, I'll post (to this blog or to an online forum) on the topic of sharing and collaboration within the community, and h...
2 comments:
Wednesday, May 16, 2012

Tool Updates

›
In preparation for some upcoming training courses that I'll be delivering, I've been updating some of the tools that I use (in my ...
2 comments:

What's New

›
Timelines The Sploited blog has part 3 of the Forensic Timeline for Beginners series of posts up, and there are a couple of interesting a...
1 comment:
Tuesday, May 08, 2012

Approximating Program Execution via VSC Analysis with RegRipper

›
I recently listened to Ovie and Corey on the latest CyberSpeak podcast , and wanted to combine what I'd heard them discuss with respect ...

How not to get p0wned by RR v2.5

›
I recently provided a minor update to the RegRipper tools , moving to v2.5.  As there was no modification to how the tools would interact wi...
3 comments:
Sunday, May 06, 2012

RegRipper: Update, Road Map

›
I thought that, due to some changes in how things were developing with respect to RegRipper , it was time to take a look at a couple of thin...
5 comments:
Saturday, May 05, 2012

Trusted Adviser

›
I've blogged before regarding the need for a " trusted adviser " and I recently had an opportunity to respond to a query, and ...
Friday, May 04, 2012

Links and Tools

›
Windows 8 Forensics Guide You can now find a free Windows 8 forensics guide over on the Propeller Head Forensics blog.  Amanda's guid...
Thursday, May 03, 2012

MASS AGO Conference

›
I recently had an opportunity to attend (and present at) the Massachusetts 2012 National Cyber Crime Conference , and wanted to take the tim...
Wednesday, May 02, 2012

ASI Training

›
At  ASI , we are developing digital forensics training courses, and our first offerings will be Intro to Windows Forensics Analysis  (4-5...
Thursday, April 26, 2012

Convergence

›
At times, there appear be a number of different sub-disciplines within the DFIR community, and those of us in that community may tend to sep...
Wednesday, April 25, 2012

Updates

›
Power of Open Source I've mentioned this before , and it bears repeating...open source is a very powerful thing. I recently posted ab...
2 comments:
Monday, April 23, 2012

Updates and Links

›
Malware Detection Jamie posted an MBR Parser recently.  You're probably thinking, "Yeah...and???"  Well, in her post regardi...
6 comments:
Saturday, April 21, 2012

Tools, Updates...

›
Tools Didier has released an updated version of an older viewer that he'd written, called InteractiveSieve .  Based on the description ...
1 comment:
Monday, April 16, 2012

Metadata

›
I've blogged about metadata before ( here , and here ), but it's been a while, and this is a subject worth revisiting every so often...
Thursday, April 12, 2012

Registry Analysis

›
I have several upcoming speaking engagements, during which I will be talking about digital forensic analysis of Windows systems (with a focu...
Tuesday, April 10, 2012

Value of Targeted Timeline Analysis in Research

›
I recently conducted some research into a specific event/activity on a system, and found that timeline analysis proved to be an extremely va...
2 comments: