Collaborate Disseminate
Yes, yes, I know…you’re probably thinking, “you wrote it, dude”, and while that’s true, that’s not the reason why I really love RegRipper. Yes, it’s my “baby”, but there’s so much more to it than that. For me, it’s about flexibility and utility. At t… Continue reading Why I love RegRipper
Investigating Windows SystemsIt’s the time of year again when folks are looking for stocking stuffers for the DFIR nerd in their lives, and my recommendation is a copy of Investigating Windows Systems! The form factor for the book makes it a great stoc… Continue reading Post Compilation
Dr. Ali Hadi recently posted another challenge image, this one (#7) being a lot closer to a real-world challenge than a lot of the CTFs I’ve seen over the years. What I mean by that is that in the 22+ years I’ve done DFIR work, I’ve never had a custome… Continue reading Challenge 7 Write-up
When I first started writing books, my “recipe” for how to present the information followed the same structure I saw in other books at the time. While I was writing books to provide content along the lines of what I wanted to see, essentially filling i… Continue reading Thoughts on Teaching Digital Forensics
I recently posted to LinkedIn, asking my network for their input regarding the value proposition of RegRipper; specifically, how is RegRipper v3.0 of “value” to them, how does it enhance their work? I did this because I really wanted to get the perspec… Continue reading RegRipper Value Proposition
After reading some of the various open reports regarding how malware or threat actors were “using” the Registry, manipulating it to meet their needs, I wanted to take a look and see what the effects or impacts of these actions might “look like” from a … Continue reading Testing Registry Modification Scenarios
During IR engagements, like many other analysts, I’ve seen different means of data exfiltration. During one engagement, the customer stated that they’d “…shut off all of our FTP servers…”, but apparently “all” meant something different to them, bec… Continue reading Data Collection
Not long ago, I made a brief mention of Events Ripper, a proof-of-concept tool I wrote to quickly provide situational awareness and pivot points for analysts who were already on the road to developing a timeline. The idea behind the tool is that artifa… Continue reading Events Ripper
I received a job description from a recruiter recently, along with the request that if I knew anyone who fit the bill and was interested, could I please forward the job description to them. The recruiter was looking for someone at an entry-level, with … Continue reading We Need Cybersecurity Mentors
For this post, I’ll throw out a bunch of little snippets, or “post-lets”, covering a variety of DFIR topics rather than one big post that covers one topic.What’s Old Is New AgainDuring Feb, 2016, Mari published a fascinating blog post regarding the VBA… Continue reading Post Compilation