Pages

▼
Friday, April 25, 2014

WFA 4/e Reviews

›
Brett Shavers has posted the first (that I'm aware of) reviews of WFA 4/e... one on Amazon , and a longer one can be found on his  WinFE...
Wednesday, April 16, 2014

Follow up on TTPs post

›
David Bianco's "Pyramid of Pain" As a follow-up to my previous post on TTPs , a couple of us ( David Bianco , Jack Crook ,...
2 comments:
Monday, April 14, 2014

WFA 4/e

›
Okay, so Windows Forensic Analysis 4/e showed up in a couple of boxes on my doorstep tonight.  It's now a thing .  Cool. As I write ...
13 comments:
Sunday, April 13, 2014

TTPs

›
Within the DFIR and threat intel communities, there has been considerable talk about "TTPs" - tactics, techniques and procedures ...
15 comments:
Thursday, April 03, 2014

What's Up?

›
TTPs A bit ago, I ran across this fascinating blog post regarding the Pyramid of Pain .  Yes, it's over a year old, but it's stil...
2 comments:
Saturday, March 29, 2014

Writing DFIR Books: Questions

›
Based on my Writing DFIR Books post, Alissa Torres tweeted that she had a "ton of questions", so I encouraged her to start askin...
5 comments:
Friday, March 28, 2014

Writing DFIR Books

›
Suzanne Widup (of Verizon) recently asked me to sit on an author's panel that she's putting together, in order to make the round...
1 comment:
Saturday, March 22, 2014

Coding for Digital Forensic Analysis

›
Over the years, I've seen a couple of questions on the topic of coding for digital forensic analysis.  Many times, these questions ten...
3 comments:
Saturday, March 01, 2014

Reconstructing Data Structures

›
I've posted before on the topic of understanding data structures ( here , here , and here ), and some recent analysis brought this back ...
6 comments:
Monday, February 17, 2014

More Tracking User Activity via the Registry

›
I have previously posted on the topic of determining a user's access to files , and thanks to Jason Hale's recent post on a similar ...
5 comments:
Monday, January 20, 2014

Book Review: Cloud Storage Forensics

›
I had an opportunity to review Cloud Storage Forensics recently, and I wanted to provide my thoughts on the contents of the book.  I genera...
2 comments:
Sunday, January 12, 2014

Malware RE - IR Disconnect

›
Not long ago, I'd conducted some analysis that I had found to be...well, pretty fascinating...and shared some of the various aspects of...
4 comments: