blog.digital-forensics.it
ZENA FORENSICS: January 2015
http://blog.digital-forensics.it/2015_01_01_archive.html
Tuesday, January 13, 2015. Last October, I participated as speaker at the SANS DFIR. It was a great meeting and I am very happy to have been able to participate. My speech was focused on DPAPI. And how it could be used during a post-mortem digital investigation to access protected information: overcoming system's security it's sometimes necessary to access data otherwise not available. I like to call this "process" ODI. I want to be brief, skipping any DPAPI introduction and only providing some links.
aztcs.org
Tucson Computer Society Links to Members Web sites
http://aztcs.org/members/memlinks.shtml
Check for current events. Books, software, hardware, games, etc. Informative notes, Web links, and photos from our meetings. Technical advice and free online training. Can't find what you're looking for? Visit our Site Map. TCS members with a home page - either personal or business - can be listed on this page by sending an e-mail to the Webmaster. If you're not a member, consider joining. Please help promote our organization by using our logo/graphic to link back to the TCS home page! Yahoo Group. H...
4n6k.com
4n6k: Forensic FOSS: 4n6k_volatility_installer.sh - Install Volatility For Linux Automatically
http://www.4n6k.com/2014/08/forensic-foss-4n6kvolatilityinstallersh.html
Tuesday, August 26, 2014. Forensic FOSS: 4n6k volatility installer.sh - Install Volatility For Linux Automatically. These posts will consist of open source software for use in everyday forensic investigations. Of this project by @wzod. 4n6k volatility installer.sh. Is a bash script that installs Volatility 2.4 (and all dependencies) for Ubuntu Linux with one command. Why Do I Need It? An internet connection and an APT-based Linux distribution [for the time being]. This script has been tested on stock...
4n6k.com
4n6k: September 2011
http://www.4n6k.com/2011_09_01_archive.html
Wednesday, September 28, 2011. Forensics Quickie: Mounting Split .vmdk. These posts will consist of small tidbits of useful information that can be explained very succinctly. You're tasked with examining a VMware virtual disk. On your way to acquire the .vmdk file, you notice that there's not one, but several .vmdk files. A split VM! You know FTK Imager supports mounting .vmdk, so you go ahead and attempt to mount it. But.it only accepts one .vmdk file! For spurring this topic. Links to this post. Jump L...
4n6k.com
4n6k: May 2013
http://www.4n6k.com/2013_05_01_archive.html
Tuesday, May 14, 2013. UserAssist Forensics (timelines, interpretation, testing, and more). Everything I've learned on the subject of digital forensics has been a direct result of both experience and reading forensics books, blogs, and list-serv responses written by people like Ken Pryor, Harlan Carvey, Eoghan Casey, Chad Gough,. Before I get into the bulk of it a ll,. Let me note that UserAssist artifacts are nothing new. Didier Stevens. Each count subkey contains ROT-13 encoded values; each value is a ...
4n6k.com
4n6k: About
http://www.4n6k.com/p/about.html
TL;DR: I enjoy doing research and writing about it. More details on LinkedIn. I've taken up the task of learning as much as possible about digital forensics on my own time. My particular focus and interest lie within behavioral analysis of user activity/malware artifacts. Discovering the process by which a user interacts with a computer could be a key determinant in the prosecution or defense of a guilty or innocent individual - I'd say that's a pretty big deal, wouldn't you? Add me on LinkedIn. Registry...
4n6k.com
4n6k: Posts
http://www.4n6k.com/p/forensic-posts.html
Shellbags Forensics: Addressing a Misconception. Interpretation, step-by-step testing, new findings, and more). Timelines, interpretation, testing, and more). Jump List Forensics: AppIDs Part 1. Jump List Forensics: AppIDs Part 2. Jump List Forensics: AppID Master List (400 AppIDs). Forensics Quickie: PowerShell Versions and the Registry. Forensics Quickie: NTUSER.DAT Analysis (SANS CEIC 2015 Challenge #1 Write-Up). Forensics Quickie: Merging VMDKs and Delta/Snapshot Files (2 Solutions). Possible Unknown...
4n6k.com
4n6k: January 2012
http://www.4n6k.com/2012_01_01_archive.html
Sunday, January 8, 2012. Forensics Quickie: Recovering Deleted Files With Scalpel (.CR2 Photos). These posts will consist of small tidbits of useful information that can be explained very succinctly. SD card was accidentally formatted; RAW photos in .cr2 format from a Canon Rebel T3 needed to be recovered. Boot up a Linux VM (I chose Ubuntu) and install Scalpel with:. Sudo apt-get install scalpel. Check to see if the required filetype signature is supported by Scalpel by default :. Links to this post.
4n6k.com
4n6k: UserAssist Forensics (timelines, interpretation, testing, & more)
http://www.4n6k.com/2013/05/userassist-forensics-timelines.html
Tuesday, May 14, 2013. UserAssist Forensics (timelines, interpretation, testing, and more). Everything I've learned on the subject of digital forensics has been a direct result of both experience and reading forensics books, blogs, and list-serv responses written by people like Ken Pryor, Harlan Carvey, Eoghan Casey, Chad Gough,. Before I get into the bulk of it a ll,. Let me note that UserAssist artifacts are nothing new. Didier Stevens. Each count subkey contains ROT-13 encoded values; each value is a ...
