Pages

▼
Saturday, March 29, 2014

Writing DFIR Books: Questions

›
Based on my Writing DFIR Books post, Alissa Torres tweeted that she had a "ton of questions", so I encouraged her to start askin...
5 comments:
Friday, March 28, 2014

Writing DFIR Books

›
Suzanne Widup (of Verizon) recently asked me to sit on an author's panel that she's putting together, in order to make the round...
1 comment:
Saturday, March 22, 2014

Coding for Digital Forensic Analysis

›
Over the years, I've seen a couple of questions on the topic of coding for digital forensic analysis.  Many times, these questions ten...
3 comments:
Saturday, March 01, 2014

Reconstructing Data Structures

›
I've posted before on the topic of understanding data structures ( here , here , and here ), and some recent analysis brought this back ...
6 comments:
Monday, February 17, 2014

More Tracking User Activity via the Registry

›
I have previously posted on the topic of determining a user's access to files , and thanks to Jason Hale's recent post on a similar ...
5 comments:
Monday, January 20, 2014

Book Review: Cloud Storage Forensics

›
I had an opportunity to review Cloud Storage Forensics recently, and I wanted to provide my thoughts on the contents of the book.  I genera...
2 comments:
Sunday, January 12, 2014

Malware RE - IR Disconnect

›
Not long ago, I'd conducted some analysis that I had found to be...well, pretty fascinating...and shared some of the various aspects of...
4 comments:
Saturday, December 28, 2013

Quick Post

›
RegRipper At the end of this past summer and into the fall, I was working on the print matter for Windows Forensic Analysis 4/e , and I...
Wednesday, December 18, 2013

Shellbags

›
Dan recently posted what has to be one of the most thorough/comprehensive blog articles regarding the Windows shellbags artifacts.  His po...
1 comment:
Monday, December 16, 2013

Updates

›
Things tend to move fast in the DFIR world sometimes, and since my last post , there have been some updates to some of the things that were ...
2 comments:
Wednesday, December 04, 2013

Links and News

›
There have been some exciting developments recently on the Windows digital forensic analysis front, and I thought it would be a good idea ...