Pages

▼
Wednesday, May 31, 2017

Use of LNK Files...Again

›
I've discussed LNK file before... here , and more recently, here .  Windows shortcut files are an artifact on Windows systems that have ...
2 comments:
Sunday, April 09, 2017

Getting Started

›
Not long ago, I gave some presentations at a local high school on cybersecurity, and one of the questions that was asked was, "how do I...
3 comments:

Understanding What The Data Is Telling You

›
Not long ago, I was doing some analysis of a Windows 2012 system and ran across an interesting entry in the AppCompatCache data: SYSVOL\Us...
4 comments:
Saturday, April 08, 2017

Understanding File and Data Formats

›
When I started down my path of studying techniques and methods for computer forensic analysis, I'll admit that I didn't start out us...
Sunday, March 26, 2017

Links, Updates

›
LNK Attachments Through my day job, we've seen a surge in spam campaigns lately where Windows shortcuts/LNK files were sent to the targ...
1 comment:
Wednesday, March 15, 2017

Incorporating AmCache data into Timeline Analysis

›
I've had an opportunity to examine some Windows 10 systems lately, and recently got a chance to examine a Windows 2012 server system.  ...
5 comments:
Saturday, February 25, 2017

Powershell Stuff, Windows 10

›
Source: InterWebs I recently had some Windows 10 systems come across my desk, and as part of my timeline creation process, I extracted t...
4 comments:
Saturday, February 04, 2017

Updates, Links

›
VSCs Not long ago, I blogged about a means for accessing files within VSCs , which was based on a tweet that I had seen.  However, I could ...
Tuesday, January 31, 2017

DFIR Tools, Ransomware Thoughts

›
I like to keep up on new tools that are discussed in the community, because they offer insight into what other analysts are seeing.  The DFI...

Tools

›
Memory Analysis When I've had the opportunity to conduct memory analysis,  Volatility  and  bulk_extractor  have been invaluable. Bac...
5 comments:
Monday, January 02, 2017

Links, Updates

›
I thought I'd make my first post of 2017 short and sweet...no frills in this one... Tools Volatility 2.6 is available! Matt Suiche...
1 comment:
Sunday, December 18, 2016

Updates

›
What's New? The question I hear perhaps most often, when a new book comes out, or if I'm presenting at a conference, is "what...
Friday, November 18, 2016

The Joy of Open Source

›
Not long ago, I was involved in an IR engagement where an intruder had exploited a web-based application on a Windows 2003 system, created a...
Saturday, October 29, 2016

Ransomware

›
Ransomware I think that we can all agree, whether you've experienced it within your enterprise or not, ransomware is a problem.  It...
3 comments:

AmCache.hve

›
I was working on an incident recently, and while extracting files from the image, I noticed that there was an AmCache.hve file.  Not knowing...
8 comments:
Sunday, October 16, 2016

Links and Updates

›
RegRipper Plugin Not long ago, I read this blog post by Adapt Forward Cyber Security regarding an interesting persistence mechanism, and w...
2 comments: