Pages

▼
Monday, November 28, 2022

Post Compilation

›
Investigating Windows Systems It's the time of year again when folks are looking for stocking stuffers for the DFIR nerd in their lives,...
Sunday, November 27, 2022

Challenge 7 Write-up

›
Dr. Ali Hadi recently posted another challenge image , this one (#7) being a lot closer to a real-world challenge than a lot of the CTFs I...
Sunday, November 20, 2022

Thoughts on Teaching Digital Forensics

›
When I first started writing books, my "recipe" for how to present the information followed the same structure I saw in other book...
Monday, November 14, 2022

RegRipper Value Proposition

›
I recently posted to LinkedIn , asking my network for their input regarding the value proposition of RegRipper; specifically, how is RegRipp...
Monday, October 31, 2022

Testing Registry Modification Scenarios

›
After reading some of the various open reports regarding how malware or threat actors were "using" the Registry, manipulating it t...
Tuesday, October 18, 2022

Data Collection

›
During IR engagements, like many other analysts, I've seen different means of data exfiltration. During one engagement, the customer sta...
Saturday, October 15, 2022

Events Ripper

›
Not long ago, I made a brief mention of Events Ripper , a proof-of-concept tool I wrote to quickly provide situational awareness and pivot ...
Wednesday, October 12, 2022

We Need Cybersecurity Mentors

›
I received a job description from a recruiter recently, along with the request that if I knew anyone who fit the bill and was interested, co...
1 comment:
Monday, October 10, 2022

Post Compilation

›
For this post, I'll throw out a bunch of little snippets, or "post-lets", covering a variety of DFIR topics rather than one bi...
Thursday, October 06, 2022

Speaking Engagements

›
Every now and again, I have a need (re: "opportunity") to compile a list of recorded speaking events. The reasons vary...there...
Tuesday, September 20, 2022

ResponderCon Followup

›
I had the opportunity to speak at the recent ResponderCon , put on by Brian Carrier of BasisTech . I'll start out by saying that I real...
Monday, September 19, 2022

Deconstructing Florian's Bicycle

›
Not long ago, Florian Roth shared some fascinating thoughts via his post, The Bicycle of the Forensic Analyst , in which he discusses incre...
Saturday, September 10, 2022

AmCache Revisited

›
Not long ago, I posted about When Windows Lies , and that post really wasn't so much about Windows "lying", per se, as it was ...
Saturday, September 03, 2022

LNK Builders

›
I've blogged a bit...okay, a LOT...over the years on the topic of parsing LNK files, but a subject I really haven't touched on is LN...