Pages

▼
Thursday, January 28, 2021

Extracting Toolmarks from Open Source Intel

›
I've talked about toolmarks before...what they are, why (I believe) they're important, that sort of thing.  I've also described...
Monday, November 23, 2020

Speaking at Conferences, 2020 edition

›
As you can imagine, 2020 has been a very "different" year, for a lot of reasons, and impacts of the events of the year have extend...
2 comments:
Tuesday, November 10, 2020

Happy Birthday, Marine Corps!

›
  I thought today of all days would be a good time to break from tradition and share a post that has nothing to do with DFIR or Windows, one...
1 comment:
Wednesday, October 21, 2020

Name Resolution

›
How often to DFIR analysts think about name resolution, particularly on Windows systems?  I know that looking back across engagements I'...
7 comments:
Sunday, October 11, 2020

Settings That Impact The Windows OS

›
There are a number of settings within Windows systems that can and do significantly impact the functionality of Windows, and as a result, ca...
2 comments:

#OSDFCON

›
 The agenda for the 11th annual Open Source Digital Forensics Conference  has been posted.  I've attended OSDFCON before  (several times...
2 comments:
Saturday, September 19, 2020

Toolmarks

›
 I recently ran across an interesting article from Sophos , indicating that the Maze ransomware threat group had taken a page from the Ragna...
Monday, August 31, 2020

The Death of AV??

›
I had a conversation recently, which started out being about endpoint technologies.  At one point in the conversation, the topic of AV came ...
1 comment:
Sunday, August 16, 2020

Toolmarks: The "How"

›
 I recently published a post where I discussed DFIR  toolmarks , and not long after sharing it on Twitter, someone asked me for a list of re...
1 comment:
Wednesday, August 05, 2020

Toolmarks and Intrusion Intelligence

›
Very often, DFIR and intel analysts alike don't appear to consider such things as toolmarks associated with TTPs, nor intrusion intellig...
1 comment:
Tuesday, July 07, 2020

On Artifact Constellations And "Toolmarks"

›
Something I've been pretty focused on in my analysis for some time is the concept of "artifact constellations".  I originally ...
Sunday, June 14, 2020

Plugin Spotlight - consentstore, consentstore_tln, appcompatflags.pl update

›
These plugins were developed as a result of this article posted to Medium by Zach, aka, " svch0st ".  The article is fascinating,...
4 comments:

Plugin Spotlight - printer_settings, featureusage

›
Given the number of RegRipper plugins that are part of the distro, I thought it would be a good idea every now and then to spotlight a plugi...
Sunday, May 31, 2020

Tips on Using RegRipper v3.0

›
With the "new" release, I thought it would be good to share a couple of tips as to how you can get the most out of RegRipper v3.0 ...
11 comments:
Thursday, May 28, 2020

RegRipper v3.0

›
I recently released RegRipper v3.0 , something I've been working on since Aug, 2019. I am no longer supporting RegRipper 2.8.  I'l...
Tuesday, April 14, 2020

Registry Analysis, pt II

›
In my last blog post , I provided a brief description of how I perform "Registry analysis", and I thought it would be a good idea ...
Sunday, April 12, 2020

Registry Analysis

›
When you see the words, "Registry analysis", what comes to mind?  Okay, now...what actually happens when we 'do' this t...
Sunday, April 05, 2020

Going Beyond

›
As an industry and community, we need to go beyond...go beyond looking at single artifacts to indicate or justify "evidence", and ...