Pages

▼
Monday, October 28, 2013

Links

›
This is not the persistence mechanism you were looking for... First off, thanks to David Cowen for taking the time to address a question re...
5 comments:
Wednesday, October 09, 2013

Shell Item Artifacts, Reloaded

›
I spoke on David Cowen and crew's Forensic Lunch a bit ago, on the topic of shell item artifacts .  I put together some slides at th...
Tuesday, September 24, 2013

Links - Malware Edition

›
Malware Bromium Labs posted some pretty interesting information regarding another Zeus variant; the information in this post is very use...
1 comment:
Monday, September 23, 2013

Shell Item Artifacts

›
I was watching the 9/20 Forensic Lunch  with David Cowen and crew recently, and when Jonathan Tomczak TZWorks  was initially speaking, there...
Thursday, September 12, 2013

Forensic Perspective

›
We all have different perspectives on events, usually based on our experiences.  When I was a member of the ISS ERS team, I tried to engage ...
2 comments:

Links

›
Artifacts Jason Hale has a new post over on the Digital Forensics Stream blog, this one going into detail regarding the Search History a...
Monday, September 02, 2013

Data Structures, Revisited

›
A while back, I wrote this article regarding understanding data structures .  The importance of this topic has not diminished with time; ...
4 comments:
Tuesday, July 23, 2013

HowTo: Investigate an Online Banking Fraud Incident

›
A recent comment over on Google Plus caught my attention, and I thought it was important enough to incorporate into a HowTo post.  The comme...
3 comments:

HowTo: Determine/Detect the use of Anti-Forensics Techniques

›
The use of anti-forensics techniques to hide malicious activity (malware installation, intrusion, data theft, etc.) can be something of a ...
Monday, July 22, 2013

HowTo: Add Intelligence to Analysis Processes

›
How many times do we launch a tool to parse some data, and then sit there looking at the output, wondering how someone would see something ...
10 comments:
Thursday, July 18, 2013

HowTos

›
I've offered up a number of HowTo blog posts thus far, and hopefully DFIR folks out there have found use in them.  In the comments of ...
4 comments:

HowTo: Data Exfiltration

›
One of the questions I see time and again, in forums as well as from customers, is "what data was taken from the system?"  Sometim...
3 comments: