Pages

▼
Thursday, November 28, 2019

ActivitesCache.db vs NTUSER.DAT

›
I recently had an opportunity to work with the data available in the Windows 10 Activity Timeline, or ActivitiesCache.db file.  I'd seen...
Saturday, November 02, 2019

More Regarding LNK Files

›
My recent post regarding LNK files got me thinking about other uses of LNK files.  That previous post really illustrated how some analysts ...
4 comments:
Monday, October 28, 2019

Return of the LNK Files...

›
I wanted to put something scary together in time for Halloween; I was gonna go with a mullet wig, a la Joe Dirt, or maybe pass out cards wit...
Monday, October 21, 2019

Registry Analysis

›
Something I've observed over the years is that analysis of the Windows Registry is still a largely misunderstood, misinterpreted, and un...
Friday, September 20, 2019

A Brief History of DFIR Time, pt II

›
Continuing on from my previous post ... Once I left active duty, one of my first jobs was in an information security role, and I was doin...
Monday, September 09, 2019

The Ransomware Economy

›
There's no doubt about it...cybercrime, and especially ransomware, is an entire economy in and of itself. Don't believe me? Read...
2 comments:

A Brief History of DFIR Time, pt I

›
Whether we like it or not, we're all time travelers. We're all moving through time, caught in the flow. In the western world, we...
Wednesday, August 28, 2019

DFIR Open Mic Night

›
So, here's a thought... At a well-attended DFIR conference, there should be a DFIR open mic comedy night.  In the evening, after the e...
2 comments:
Friday, August 16, 2019

Program Execution...Or Not

›
Over the years, different means have been used to discuss the DFIR analysis process, and one of those has been artifact categories.  This is...
19 comments:

Chasing the DFIR Cure, pt II

›
Following my first post on this topic, an interesting comment was shared that I thought would really benefit the discussion, as well as ben...
Tuesday, August 13, 2019

Chasing the DFIR Cure

›
I've wondered for some time now, how do "customers" (recipients of DFIR services) determine the quality and accuracy of the re...
Thursday, July 04, 2019

IWS Review

›
A while back, I sent a signed copy of IWS to someone who was willing to write a review, and they've gone about trying to post their revi...
1 comment:
Tuesday, June 04, 2019

What's New

›
A New Blogger I ran across a fascinating blog post during my Sunday morning reading, one that was interesting in a number of ways.  First ...
Wednesday, May 29, 2019

Troubleshooting and Deep Knowledge

›
What do we do when a tool that we're using doesn't return what we expect to see? How often does this happen?  How often do we run ...