Pages

▼
Monday, April 09, 2018

Mommy, where do plugins come from?

›
This is one of those questions kids have been asking their parents throughout history, and in more recent times, those parents may have reso...
1 comment:
Friday, April 06, 2018

Updates

›
Based on some feedback I received recently, I updated RegRipper's rip.pl (and the corresponding .exe, of course) to include the "-u...
Saturday, March 31, 2018

DFIR Analysis and EDR/MDR Solutions

›
There is only so much the DFIR analysis can do. There it is, I said it.  And it's especially true when the DFIR analysis is the result...
Monday, March 26, 2018

Even More DFIR Brain Droppings...

›
Analysis Something I've seen over the years that I've been interested in addressing is the question of "how do I analyze X?...
Sunday, March 25, 2018

More DFIR Brain Droppings

›
Ransomware (TL;DR) This past week, the City of Atlanta was hit with ransomware . This is not unusually...I've been seeing a lot of muni...
Monday, March 19, 2018

DFIR Brain Droppings

›
Live Response It's been a while since I posted anything on the topic of live response, but I recently ran across something that really ...
2 comments:
Thursday, March 15, 2018

DFIR Questions, How-Tos...

›
Not long ago, I finished up the content of my latest book, Investigating Windows Systems , and got it all shipped off to the publisher.  The...
12 comments:
Monday, March 12, 2018

New and Updated Plugins, Other Items

›
BAM Key and Process Execution, Updated Plugins Recently, blog posts describing the "BAM Key" and it's viability as a process ...
1 comment:
Sunday, March 11, 2018

Creating Tools and Solving Problems

›
I received a request recently for a blog post on a specific topic via LinkedIn; the request looked like this: Have you blogged or written ...
Monday, February 19, 2018

Stuffy Stuff

›
...yeah, I get it...I'm not entirely imaginative, and don't come up with the best titles for my blog posts.... #DFIR Intel About ...
Friday, February 16, 2018

On Writing (DFIR) Books

›
After sharing my recent post regarding my next book, IWS , one of the comments I received via social media was a tongue-in-cheek reference t...
2 comments:
Wednesday, February 14, 2018

IWS

›
As I'm winding up the final writing for my next book, Investigating Windows Systems , I thought I'd take the opportunity to say/writ...

How To...

›
...Parse Windows Event Logs I caught a really interesting tweet the other day that pointed to the DFIR blog , one that discussed how to par...