Pages

▼
Tuesday, October 30, 2018

More Regarding IWS

›
IWS has been out for a short while now , and there have been a couple of reviews posted.  So far, it seems that there is some reticence to ...
3 comments:
Sunday, October 28, 2018

Updates

›
Book Discount While I was attending OSDFCon, I had a chance to (finally!) meet and speak with Jessica Hyde , a very smart and knowledgeable...
3 comments:
Saturday, October 20, 2018

OSDFCon Trip Report

›
This past week I attended the 9th OSDFCon ...not my 9th, as I haven't been able to make all of them.  In fact, I haven't been able t...
2 comments:
Sunday, October 07, 2018

Updates

›
IWS Folks have started receiving the copies of IWS they ordered, and folks like Joey and Mary Ellen have already posted reviews!  Mary E...
3 comments:
Sunday, September 23, 2018

First Review of IWS

›
The written first review of IWS comes from Joey Victorino, a consultant with the IBM X-Force IRIS team.  Joey sent me his review via Linked...
Tuesday, September 18, 2018

Book Writing

›
With the release of my latest book, Investigating Windows Systems , I thought that now would be a good time to revisit the topic of writing ...
3 comments:
Monday, September 17, 2018

IWS is out!

›
My latest book, Investigating Windows Systems ( Amazon , Elsevier ) is out, and it seems that some have already received their ordered copi...
1 comment:
Saturday, September 15, 2018

A lil Saturday morning computer programming

›
I've wanted to update lfle.pl for sometime, and with the rain this weekend, Saturday morning was the perfect time do so.  For those who ...
Friday, September 14, 2018

Random Stuff

›
I decided to put this post together because some things just need to persist beyond the typical Twitter life cycle.  The focus here is free ...
2 comments:
Thursday, September 06, 2018

Accessing Volume Shadows, re-revisited

›
As a follow-on to my previous post , I wanted to provide a concise summary or overview of the processes for accessing VSCs. First, a coup...
3 comments:
Tuesday, September 04, 2018

Accessing Volume Shadows, Revisited

›
Almost 3 yrs ago, I published this blog post regarding accessing VSCs, via several different means.  I recently did some testing, revisitin...
7 comments:
Wednesday, August 22, 2018

Updates

›
RegRipper Not all RegRipper plugins come from external sources; in fact, a good number of the plugins I've written start as something I...
Saturday, August 18, 2018

Updates

›
Win10 Notification Database Leave it to MS to make our jobs as DFIR analysts fun, all day, every day!  Actually, that is one of the things...
Friday, August 10, 2018

Gaps and Up-Hill Battles

›
I've been thinking about writing a RegRipper plugin that looks for settings that indicate certain functionality in Windows has been disa...
Friday, August 03, 2018

The Future of IR, pt I

›
I've been doing IR work for a while now, and I've had the great fortune of watching things grow over time. When I started in the i...
2 comments:

Notes, etc.

›
Case Notes @mattnotmax recently posted a blog on " contemporaneous notes ". But wait...there's more. I agree with what M...
1 comment: