Pages

▼
Wednesday, February 11, 2015

Tools

›
Microsoft recently released an update ( KB 3004375 ) that allows certain versions the Windows OS to record command line options, if Proces...
4 comments:
Friday, January 09, 2015

A Smattering of Links and Other Stuff

›
Registry Well, 2014 ended with just one submission for the  WRA 2/e Contest .  That's unfortunate, but it doesn't alter my effort...
12 comments:
Monday, January 05, 2015

What It Looks Like: Disassembling A Malicious Document

›
I recently analyzed a malicious document , by opening it on a virtual machine; this was intended to simulate a user opening the document, an...
6 comments:
Tuesday, December 30, 2014

What It Looks Like: Malware Infection via a Weaponized Document

›
Okay...I lied.  This is my last blog post of 2014. A couple of weeks ago, Ronnie posted regarding some analysis of a weaponized document...
3 comments:
Monday, December 29, 2014

Final Post of 2014

›
As 2014 draws to a close, I thought I'd finish off the year with one last blog post.  In part, I'd like to thank some folks for thei...
Monday, December 08, 2014

10 Years of Blogging

›
That's right...my first blog post was ten years ago today.  Wow. Over the passed ten years, some things have changed, and others have...
9 comments:
Thursday, October 23, 2014

WRF 2/e Contest

›
I recently posted that Syngress has agreed to publish a second edition of Windows Registry Forensics , and in that post, I mentioned that I...
Wednesday, October 22, 2014

RegRipper v2.8 is now on GitHub

›
RegRipper v2.8 is now available on GitHub . From this point forward, this repository should be considered THE repository for RegRipper ve...
2 comments:
Tuesday, October 21, 2014

Windows Event Logs

›
Dan recently tweeted: Most complete forensics-focused Event Log write-ups? # DFIR I have no idea what that means.  I'm going to assu...
4 comments:
Monday, October 20, 2014

Publishing DFIR Books

›
I recently received notification that Syngress is interesting in publishing a second edition of Windows Registry Forensics .  I submitted my...
Monday, October 06, 2014

Stuff

›
IR Here's a really good...no, I take that back...a great blog post by Sean Mason on "IR muscle memory".  Take the time to g...
Sunday, September 07, 2014

Windows Phone 8 and RegRipper

›
Last week, Cindy Murphy (@cindymurph) sent me some Registry hive files...from a Windows Phone 8 .  This was pretty fascinating, and fortunat...