Pages

▼
Sunday, September 23, 2018

First Review of IWS

›
The written first review of IWS comes from Joey Victorino, a consultant with the IBM X-Force IRIS team.  Joey sent me his review via Linked...
Tuesday, September 18, 2018

Book Writing

›
With the release of my latest book, Investigating Windows Systems , I thought that now would be a good time to revisit the topic of writing ...
3 comments:
Monday, September 17, 2018

IWS is out!

›
My latest book, Investigating Windows Systems ( Amazon , Elsevier ) is out, and it seems that some have already received their ordered copi...
1 comment:
Saturday, September 15, 2018

A lil Saturday morning computer programming

›
I've wanted to update lfle.pl for sometime, and with the rain this weekend, Saturday morning was the perfect time do so.  For those who ...
Friday, September 14, 2018

Random Stuff

›
I decided to put this post together because some things just need to persist beyond the typical Twitter life cycle.  The focus here is free ...
2 comments:
Thursday, September 06, 2018

Accessing Volume Shadows, re-revisited

›
As a follow-on to my previous post , I wanted to provide a concise summary or overview of the processes for accessing VSCs. First, a coup...
3 comments:
Tuesday, September 04, 2018

Accessing Volume Shadows, Revisited

›
Almost 3 yrs ago, I published this blog post regarding accessing VSCs, via several different means.  I recently did some testing, revisitin...
7 comments:
Wednesday, August 22, 2018

Updates

›
RegRipper Not all RegRipper plugins come from external sources; in fact, a good number of the plugins I've written start as something I...
Saturday, August 18, 2018

Updates

›
Win10 Notification Database Leave it to MS to make our jobs as DFIR analysts fun, all day, every day!  Actually, that is one of the things...
Friday, August 10, 2018

Gaps and Up-Hill Battles

›
I've been thinking about writing a RegRipper plugin that looks for settings that indicate certain functionality in Windows has been disa...
Friday, August 03, 2018

The Future of IR, pt I

›
I've been doing IR work for a while now, and I've had the great fortune of watching things grow over time. When I started in the i...
2 comments:

Notes, etc.

›
Case Notes @mattnotmax recently posted a blog on " contemporaneous notes ". But wait...there's more. I agree with what M...
1 comment:
Thursday, August 02, 2018

Some New Items

›
DFIR Skillz Brett Shavers posted another great article in which he discussed a much-needed skill in DFIR, albeit one that isn't taught...
1 comment:
Thursday, July 05, 2018

LNK "Toolmarks"

›
LNK Artifacts and "Toolmarks" I've discussed LNK files in this blog a number of times over the years , mostly focusing on the...
1 comment:
Friday, June 29, 2018

Updates

›
I just pushed three new plugins up to the RegRipper plugin repository, two written by Gabriele Zambelli ( photos_win10.pl , msedge_win10.pl ...
Thursday, June 21, 2018

More about EDR/MDR

›
On the heels of my previous post on the topic, from my perspective, there still seems to be something of a misconception within the market ...
Monday, June 18, 2018

Updates

›
I've had a bunch of draft blog posts sitting around, and for some of them, particularly the really technical ones, I thought, "...a...
1 comment:
Sunday, June 17, 2018

Coding in DFIR

›
A while back, I wrote a blog post where I discussed writing my own tools, and why I do it.  I have publicly shared the tools I've writt...