Pages

▼
Tuesday, February 19, 2013

BinMode: Understanding Data Structures

›
As most analysts are aware, the tools we use provide a layer of abstraction over the data with which we're engaged.  What we see can oft...
2 comments:
Saturday, February 16, 2013

Java, Timelines, and Training

›
A lot of interesting things have gone on lately...and I'm sure that there's more to come.  I thought I'd take a moment to raise ...
2 comments:
Wednesday, February 13, 2013

Hosted Training

›
On 10-12 June 2013, a Windows Forensic Analysis and Registry Analysis combo course will be hosted at the Santa Cruz PD training facility ...
11 comments:
Wednesday, February 06, 2013

There Are Four Lights: The Forensic Scanner

›
I made a push recently via social media to raise awareness about the Forensic Scanner , and based on some of what I saw come back, I'd l...
Saturday, February 02, 2013

BinMode: Parsing Java *.idx files, pt trios

›
Things have progressed a great deal since I last blogged on this subject.  Specifically, additional information and resources have been add...
Monday, January 28, 2013

Are You Being Served, pt II

›
This article isn't going to be directed toward digital analysts; rather, it will be directed more to folks who hire or contract with ana...

Why "BinMode"?

›
You may be wondering why I've started posting articles to my blog with titles that start with "BinMode" and "There Are Fo...
Monday, January 21, 2013

BinMode: Parsing Java *.idx files, pt. deux

›
My last post addressed parsing Java *.idx files, and since I released that post, a couple of resources related to the post have been update...
Saturday, January 19, 2013

BinMode: Parsing Java *.idx files

›
One of the Windows artifacts that I talk about in my training courses is application log files, and I tend to sort of gloss over this topic...
5 comments:
Saturday, January 12, 2013

There Are Four Lights: The Analysis Matrix

›
I've talked a lot in this blog about employing event categories when developing, and in particular, when analyzing timelines, and the ...
1 comment:
Tuesday, January 08, 2013

Training

›
For those readers who may not be aware, I teach a couple of training courses through my employer, at our facility in Reston, VA.  We're...
Saturday, January 05, 2013

There Are Four Lights: USB-Accessible Storage

›
There's been a good deal of discussion and documentation regarding discovering USB devices that had been connected to a Windows system, ...
9 comments:
Tuesday, January 01, 2013

BinMode

›
I've recently been working on a script to parse the NTFS $UsnJrnl:$J file, also known as the USN Change Journal.  Rather than blogging a...
1 comment:
Friday, December 28, 2012

Malware Detection

›
Corey recently posted to his blog regarding his exercise of infecting a system with ZeroAccess .  In his post, Corey provides a great examp...
6 comments:
Friday, December 21, 2012

Are You Being Served?

›
Larry Daniel recently posted to his Ex Forensis blog regarding a very interesting topic, regarding "The Perils of Using the Local Comp...
3 comments:
Saturday, December 15, 2012

There are FOUR lights!

›
Okay, you're probably wondering what Picard and one particular episode of Star Trek TNG has to do with forensicating.  Well, to put it q...
1 comment: