Collaborate Disseminate
Warning – before you get started reading this blog post, it’s only fair that I warn you…in this post, I make the recommendation that you document your analysis process. If you find this traumatic, you might want to just move on. ;-)Robert Jan Mora, a… Continue reading Thoughts on Analysis
In writing Investigating Windows Systems, published in 2018, I made use of publicly available images found on the Internet. Some were images posted as examples of techniques, others were posted by professors running courses, and some were from CTFs. If… Continue reading Images
I’m a huge fan of MS file formats, mostly because they provide for the possibility of an immense (and often untapped, unexploited) amount of metadata. Anyone who’s followed me for any length of time, or has read my blog, knows that I’m a huge fan of fi… Continue reading File Formats
Over the passed couple of days, I’ve had images pop up in my feed showing people’s workstations, most often with multiple screens. I’ve seen various configurations, some with three or more screens, but the other thing I’ve noted is that for those socia… Continue reading What We Value
In 2005, Cory Altheide and I published the first peer-reviewed paper to address tracking USB devices on Windows systems. Over the years, it’s been pretty amazing to see not only the artifacts expand and evolve, but to also see folks pick up the baton a… Continue reading Analysis Playbooks: USB
First off, what is “analysis”? I submit that “analysis” is what happens when an examiner has investigative goals and context, and applies this, along with their knowledge and experience, to a data set. This can be anything, from a physical image of a m… Continue reading Registry Analysis
Not long ago, I ran across this LinkedIn post on analyzing a ransomware executable, which led to thisHexaStrike post. The HexaStrike post covers analyzing an AI-generated ransomware variant, which (to be honest) is not something I’m normally interested… Continue reading Analyzing Ransomware
I recently read through this FalconFeeds article on Qilin ransomware; being in DFIR consulting for as long as I have, and given how may ransomware incidents I’ve responded to or dug into, articles with titles like this attract my attention. I do not pr… Continue reading Ransomware artifacts
The awesome folks over at Cyber Triage recently published their 2025 Guide to Registry Forensic Tools, and being somewhat interested in the Windows Registry, I was very interested to take a look. The article is very well-written, and provides an excell… Continue reading RegRipper
I ran across Manuel Arrieta’s Hunting Fileless Malware in the Windows Registry article recently, and found it to be an interesting read.Let me start by saying that the term “fileless malware”, for me, is like finger nails dragged down a chalkboard. Par… Continue reading Hunting Fileless Malware