Pages

▼
Tuesday, August 22, 2017

Beyond Getting Started

›
I blogged about getting started in the industry back in April (as well as here  and here ), and after having recently addressed the questio...
14 comments:
Friday, August 18, 2017

Updates, New Stuff

›
Specificity The folks at Talos recently posted an interesting article, "O n Conveying Doubt ".  While some have said that this ar...
Wednesday, August 02, 2017

Document Metadata

›
Okay, yeah, so I've been blogging a lot over the past couple of months about extracting document metadata as part of gathering threat in...
Sunday, July 09, 2017

Tools

›
Today's post is a mish-mash of tools and techniques that I've seen or used recently... Hindsight is a great free, open source too...
1 comment:
Thursday, June 15, 2017

Analyzing Documents

›
I've noticed over time that a lot of the write-ups that get posted online regarding malware or downloaders delivered via email attachmen...
Wednesday, May 31, 2017

Use of LNK Files...Again

›
I've discussed LNK file before... here , and more recently, here .  Windows shortcut files are an artifact on Windows systems that have ...
2 comments:
Sunday, April 09, 2017

Getting Started

›
Not long ago, I gave some presentations at a local high school on cybersecurity, and one of the questions that was asked was, "how do I...
3 comments:

Understanding What The Data Is Telling You

›
Not long ago, I was doing some analysis of a Windows 2012 system and ran across an interesting entry in the AppCompatCache data: SYSVOL\Us...
4 comments:
Saturday, April 08, 2017

Understanding File and Data Formats

›
When I started down my path of studying techniques and methods for computer forensic analysis, I'll admit that I didn't start out us...
Sunday, March 26, 2017

Links, Updates

›
LNK Attachments Through my day job, we've seen a surge in spam campaigns lately where Windows shortcuts/LNK files were sent to the targ...
1 comment:
Wednesday, March 15, 2017

Incorporating AmCache data into Timeline Analysis

›
I've had an opportunity to examine some Windows 10 systems lately, and recently got a chance to examine a Windows 2012 server system.  ...
5 comments:
Saturday, February 25, 2017

Powershell Stuff, Windows 10

›
Source: InterWebs I recently had some Windows 10 systems come across my desk, and as part of my timeline creation process, I extracted t...
4 comments: