XWAYSCLIPS.CO.UK

az4n6.blogspot.com

Another Forensics Blog: Python Parser to Recover Deleted SQLite Database Data

http://az4n6.blogspot.com/2013/11/python-parser-to-recover-deleted-sqlite.html

The primary purpose of this blog is to aid the occasional Google researcher in the field of computer forensics. The content may not be ground breaking or earth shattering, but simply a way to pass along what I hope is useful information. Wednesday, November 6, 2013. Python Parser to Recover Deleted SQLite Database Data. Soooo last week I was listening to the Forenisc Lunch. And the topic of parsing deleted. While a commerical tool is good, its always nice to have an open source alternative. After hea...

az4n6.blogspot.com

Another Forensics Blog: Safari and iPhone Internet History Parser

http://az4n6.blogspot.com/2014/07/safari-and-iphone-internet-history.html

The primary purpose of this blog is to aid the occasional Google researcher in the field of computer forensics. The content may not be ground breaking or earth shattering, but simply a way to pass along what I hope is useful information. Monday, July 21, 2014. Safari and iPhone Internet History Parser. Back in June, I had the opportunity to speak at the SANS DFIR Summit. In this post I'll run through each of the artifacts I located and explain how to use the script to parse out the files. First, a little...

az4n6.blogspot.com

Another Forensics Blog: Timestomp MFT Shenanigans

http://az4n6.blogspot.com/2014/10/timestomp-mft-shenanigans.html

The primary purpose of this blog is to aid the occasional Google researcher in the field of computer forensics. The content may not be ground breaking or earth shattering, but simply a way to pass along what I hope is useful information. Tuesday, October 7, 2014. Basically there are two "sets" of timestamps that are tracked in the MFT. These two "sets" are the $STANDARD INFORMATION and $FILE NAME. Both of these track 4 timestamps each - Modified, Access, Created and Born. Or if you prefer - C...Most time...

cheeky4n6monkey.blogspot.com

Cheeky4n6Monkey - Learning About Digital Forensics: Using SIFT to Crack a Windows (XP) Password from a Forensic Image

http://cheeky4n6monkey.blogspot.com/2011/12/using-sift-to-crack-windows-xp-password_27.html

The (Badly) Illustrated Musings of a Cheeky Forensics Monkey . Tuesday, 27 December 2011. Using SIFT to Crack a Windows (XP) Password from a Forensic Image. In the previous post, we focused on retrieving Windows login passwords from a memory dump using Volatility. But what happens if you don't have a memory dump / only have a forensic image of the hard drive? Well, Rob Lee. Has kindly provided the tools in the SANS SIFT. V212) workstation and Irongeek. And crack them using John The Ripper. 2 Type "samdum...

cheeky4n6monkey.blogspot.com

Cheeky4n6Monkey - Learning About Digital Forensics: Detecting Spoofed Emails with SIFT's pffexport and some Perl scripting

http://cheeky4n6monkey.blogspot.com/2012/03/detecting-spoofed-emails-with-sifts.html

The (Badly) Illustrated Musings of a Cheeky Forensics Monkey . Thursday, 8 March 2012. Detecting Spoofed Emails with SIFT's pffexport and some Perl scripting. One likely issue facing today's forensicator is the sheer number of emails people keep in their Inboxes. These numbers can grow at a phenomenal rate especially if the user subscribes to multiple mailing lists. Unsure if was SANS. O) recently suggested using pffexport. For one of my previous posts dealing with email analysis. Like readpst. Under "us...

az4n6.blogspot.com

Another Forensics Blog: Dealing with compressed vmdk files

http://az4n6.blogspot.com/2015/04/dealing-with-compressed-vmdk-files.html

The primary purpose of this blog is to aid the occasional Google researcher in the field of computer forensics. The content may not be ground breaking or earth shattering, but simply a way to pass along what I hope is useful information. Tuesday, April 7, 2015. Dealing with compressed vmdk files. To verify that I had not received some corrupted files, I used the VMWares disk. Utility to check the partitions in the vmdk file. This tool showed two volumes, so it appeared the vmdk file was not corrupted:.

cheeky4n6monkey.blogspot.com

Cheeky4n6Monkey - Learning About Digital Forensics: Writing a CCleaner RegRipper Plugin Part 2

http://cheeky4n6monkey.blogspot.com/2012/02/writing-ccleaner-regripper-plugin-part_05.html

The (Badly) Illustrated Musings of a Cheeky Forensics Monkey . Sunday, 5 February 2012. Writing a CCleaner RegRipper Plugin Part 2. We now continue with our scheduled programming . heh-heh. About RegRipper (on SIFT V2.12). RegRipper is written in Perl and is included with the SIFT VM. There are 3 main components to it:. Perl script located in /usr/local/bin. The various plugin scripts located in /usr/local/src/regripper/plugins. At a SIFT VM terminal window. Rippl -r /cases/NTUSER.DAT -p ccleaner". Each ...

az4n6.blogspot.com

Another Forensics Blog: April 2014

http://az4n6.blogspot.com/2014_04_01_archive.html

The primary purpose of this blog is to aid the occasional Google researcher in the field of computer forensics. The content may not be ground breaking or earth shattering, but simply a way to pass along what I hope is useful information. Thursday, April 24, 2014. What's the Word - Thunderbird! What tipped me off that the profile was not being parsed correctly? Because the email profile was corrupted, I wanted to test the same programs with a "normal" profile. I actually use Thunderbird as my email cl...