Pages

▼
Tuesday, January 28, 2020

"Hidden" Prefetch File Analysis and Alternate Data Sources

›
One of the things I like to do is engage in DFIR analysis of CTF and challenge images, just to see what pops out and what new things I can l...
2 comments:
Monday, January 27, 2020

Developing and Using Lessons Learned

›
From the very beginning of my time in DFIR, and even before then, I saw the value in having some form of "lessons learned" process...
Saturday, January 04, 2020

First RegRipper 2020 Update

›
'cogphn' recently reached to me via the RegRipper GitHub repo to let me know that they'd found an issue with a plugin, and this ...
2 comments:
Tuesday, December 31, 2019

Maintaining The KnowledgeBase

›
As 2019 closes, we move into not just a new year, but also a new decade.  While, for the most part, this isn't entirely significant...af...
Sunday, December 29, 2019

LNK Toolmarks

›
Matt posted a blog article a while back, and I took interest in large part because it involved an LNK file.  Matt provided a hash for the f...
Saturday, December 28, 2019

Improving DFIR Skills

›
There are more than a few skills that make up the #DFIR "field", and just one of them is conducting DFIR analysis.  Brett Shavers ...
2 comments:
Wednesday, December 25, 2019

What is "best"?

›
A lot of times I'll see a question in DFIR-related social media, along the lines of, "what is the best tool to do X ?"  I'...
2 comments:
Tuesday, December 03, 2019

Artifact Clusters

›
Very often within the DFIR community, we see information shared (usually via blog posts) regarding a "new" artifact that has been ...
2 comments:
Thursday, November 28, 2019

ActivitesCache.db vs NTUSER.DAT

›
I recently had an opportunity to work with the data available in the Windows 10 Activity Timeline, or ActivitiesCache.db file.  I'd seen...
Saturday, November 02, 2019

More Regarding LNK Files

›
My recent post regarding LNK files got me thinking about other uses of LNK files.  That previous post really illustrated how some analysts ...
4 comments:
Monday, October 28, 2019

Return of the LNK Files...

›
I wanted to put something scary together in time for Halloween; I was gonna go with a mullet wig, a la Joe Dirt, or maybe pass out cards wit...
Monday, October 21, 2019

Registry Analysis

›
Something I've observed over the years is that analysis of the Windows Registry is still a largely misunderstood, misinterpreted, and un...
Friday, September 20, 2019

A Brief History of DFIR Time, pt II

›
Continuing on from my previous post ... Once I left active duty, one of my first jobs was in an information security role, and I was doin...