Pages

▼
Tuesday, December 30, 2014

What It Looks Like: Malware Infection via a Weaponized Document

›
Okay...I lied.  This is my last blog post of 2014. A couple of weeks ago, Ronnie posted regarding some analysis of a weaponized document...
3 comments:
Monday, December 29, 2014

Final Post of 2014

›
As 2014 draws to a close, I thought I'd finish off the year with one last blog post.  In part, I'd like to thank some folks for thei...
Monday, December 08, 2014

10 Years of Blogging

›
That's right...my first blog post was ten years ago today.  Wow. Over the passed ten years, some things have changed, and others have...
9 comments:
Thursday, October 23, 2014

WRF 2/e Contest

›
I recently posted that Syngress has agreed to publish a second edition of Windows Registry Forensics , and in that post, I mentioned that I...
Wednesday, October 22, 2014

RegRipper v2.8 is now on GitHub

›
RegRipper v2.8 is now available on GitHub . From this point forward, this repository should be considered THE repository for RegRipper ve...
2 comments:
Tuesday, October 21, 2014

Windows Event Logs

›
Dan recently tweeted: Most complete forensics-focused Event Log write-ups? # DFIR I have no idea what that means.  I'm going to assu...
4 comments:
Monday, October 20, 2014

Publishing DFIR Books

›
I recently received notification that Syngress is interesting in publishing a second edition of Windows Registry Forensics .  I submitted my...
Monday, October 06, 2014

Stuff

›
IR Here's a really good...no, I take that back...a great blog post by Sean Mason on "IR muscle memory".  Take the time to g...
Sunday, September 07, 2014

Windows Phone 8 and RegRipper

›
Last week, Cindy Murphy (@cindymurph) sent me some Registry hive files...from a Windows Phone 8 .  This was pretty fascinating, and fortunat...
Thursday, September 04, 2014

What Does That Look Like, Pt II

›
In my last post , I talked about sharing what things "look like" on a system, and as something of a follow up to that post,  this ...
5 comments:
Thursday, August 21, 2014

What does that "look like"?

›
We've heard this question a lot, haven't we? I attended a conference about 2 1/2 years ago, and the agenda for that conference h...
8 comments:
Wednesday, July 30, 2014

Book Review: "The Art of Memory Forensics"

›
I recently received a copy of The Art of Memory Forensics (thanks, Jamie!!), with a request that I write a review of the book.  Being a som...
16 comments:
Thursday, July 24, 2014

File system ops, testing phase 2

›
As I mentioned in my previous post on this topic , there were two other tests that I wanted to conduct with respect to file system operation...
1 comment:
Tuesday, July 22, 2014

File system ops, effects on MFT records

›
I recently conducted some testing of different actions on a Windows 7 system, with the specific purpose of identifying artifacts within the ...
8 comments: