4n6k.com
4n6k: Forensic FOSS: 4n6k_volatility_installer.sh - Install Volatility For Linux Automatically
http://www.4n6k.com/2014/08/forensic-foss-4n6kvolatilityinstallersh.html
Tuesday, August 26, 2014. Forensic FOSS: 4n6k volatility installer.sh - Install Volatility For Linux Automatically. These posts will consist of open source software for use in everyday forensic investigations. Of this project by @wzod. 4n6k volatility installer.sh. Is a bash script that installs Volatility 2.4 (and all dependencies) for Ubuntu Linux with one command. Why Do I Need It? An internet connection and an APT-based Linux distribution [for the time being]. This script has been tested on stock...
4n6k.com
4n6k: September 2011
http://www.4n6k.com/2011_09_01_archive.html
Wednesday, September 28, 2011. Forensics Quickie: Mounting Split .vmdk. These posts will consist of small tidbits of useful information that can be explained very succinctly. You're tasked with examining a VMware virtual disk. On your way to acquire the .vmdk file, you notice that there's not one, but several .vmdk files. A split VM! You know FTK Imager supports mounting .vmdk, so you go ahead and attempt to mount it. But.it only accepts one .vmdk file! For spurring this topic. Links to this post. Jump L...
4n6k.com
4n6k: May 2013
http://www.4n6k.com/2013_05_01_archive.html
Tuesday, May 14, 2013. UserAssist Forensics (timelines, interpretation, testing, and more). Everything I've learned on the subject of digital forensics has been a direct result of both experience and reading forensics books, blogs, and list-serv responses written by people like Ken Pryor, Harlan Carvey, Eoghan Casey, Chad Gough,. Before I get into the bulk of it a ll,. Let me note that UserAssist artifacts are nothing new. Didier Stevens. Each count subkey contains ROT-13 encoded values; each value is a ...
4n6k.com
4n6k: About
http://www.4n6k.com/p/about.html
TL;DR: I enjoy doing research and writing about it. More details on LinkedIn. I've taken up the task of learning as much as possible about digital forensics on my own time. My particular focus and interest lie within behavioral analysis of user activity/malware artifacts. Discovering the process by which a user interacts with a computer could be a key determinant in the prosecution or defense of a guilty or innocent individual - I'd say that's a pretty big deal, wouldn't you? Add me on LinkedIn. Registry...
4n6k.com
4n6k: Posts
http://www.4n6k.com/p/forensic-posts.html
Shellbags Forensics: Addressing a Misconception. Interpretation, step-by-step testing, new findings, and more). Timelines, interpretation, testing, and more). Jump List Forensics: AppIDs Part 1. Jump List Forensics: AppIDs Part 2. Jump List Forensics: AppID Master List (400 AppIDs). Forensics Quickie: PowerShell Versions and the Registry. Forensics Quickie: NTUSER.DAT Analysis (SANS CEIC 2015 Challenge #1 Write-Up). Forensics Quickie: Merging VMDKs and Delta/Snapshot Files (2 Solutions). Possible Unknown...
4n6k.com
4n6k: January 2012
http://www.4n6k.com/2012_01_01_archive.html
Sunday, January 8, 2012. Forensics Quickie: Recovering Deleted Files With Scalpel (.CR2 Photos). These posts will consist of small tidbits of useful information that can be explained very succinctly. SD card was accidentally formatted; RAW photos in .cr2 format from a Canon Rebel T3 needed to be recovered. Boot up a Linux VM (I chose Ubuntu) and install Scalpel with:. Sudo apt-get install scalpel. Check to see if the required filetype signature is supported by Scalpel by default :. Links to this post.
4n6k.com
4n6k: UserAssist Forensics (timelines, interpretation, testing, & more)
http://www.4n6k.com/2013/05/userassist-forensics-timelines.html
Tuesday, May 14, 2013. UserAssist Forensics (timelines, interpretation, testing, and more). Everything I've learned on the subject of digital forensics has been a direct result of both experience and reading forensics books, blogs, and list-serv responses written by people like Ken Pryor, Harlan Carvey, Eoghan Casey, Chad Gough,. Before I get into the bulk of it a ll,. Let me note that UserAssist artifacts are nothing new. Didier Stevens. Each count subkey contains ROT-13 encoded values; each value is a ...
cyberfrontsecurity.blogspot.com
Cyber Front Security: The Security Triad: Protection, Detection, and Response
http://cyberfrontsecurity.blogspot.com/2015/02/the-security-triad-protection-detection.html
The Front Line Is Everywhere. Thursday, February 19, 2015. The Security Triad: Protection, Detection, and Response. It's been a while since I've posted anything at all. I could cite a variety of excuses but the truth is that I've been cutting my teeth in the industry and adapting from my previous life to my new one. I've finally found the time and desire to continue writing, so without further ado. Each industry places more emphasis on a given phase than others and we often see. In infosec, Protection is...
cyberfrontsecurity.blogspot.com
Cyber Front Security: August 2011
http://cyberfrontsecurity.blogspot.com/2011_08_01_archive.html
The Front Line Is Everywhere. Monday, August 29, 2011. An Apple, Today, Gave Your Data Away. I'm not really huge on writing about events in the news but this one seems pretty huge and I think there are some people that might not see the implications. Http:/ www.theregister.co.uk/2011/08/26/mac osx lion security hole/. Think about it, if you have an ambitious employee with open access to every piece of data on the domain what kind of trouble could they get into? They probably don't want to actively damage...
SOCIAL ENGAGEMENT