Collaborate Disseminate
In order to fully understand digital analysis, we need to have an understanding of the foundational methodology, as well as the various constituent artifacts on which a case may be built. The foundational methodology starts with your goals…what are y… Continue reading Artifacts: Jump Lists
Recovering deleted data, or “carving”, is an interesting digital forensics topic; I say “interesting” because there are a number of different approaches and techniques that may be valuable, depending upon your goals. For example, I’ve used X-Ways … Continue reading Carving
A while back, Jesse Kornblum published a paper titled, “Using Every Part of the Buffalo in Windows Memory Analysis”. This was, and still is, an excellent paper, based on it’s content and how it pertained to the subject (Windows memory analysis). Howeve… Continue reading UEPOTB, LNK edition
I recently saw another LinkedIn post from someone supporting and sending readers to a site that was reportedly started using the SANS DFIR poster as a reference. As illustrated in figure 1, this site references the ShimCache artifact as providing evide… Continue reading Program Execution: The ShimCache/AmCache Myth
I had the distinct honor and pleasure of speaking at the “From The Source” Conference (FTSCon) on 21 Oct, in Arlington, VA. This was a 1-day event put on prior to the Volexity memory analysis training, and ran two different tracks…Maker and Hunter…… Continue reading FTSCon
Very often in cybersecurity, we share some level of indicators of compromise (IOCs), such as IP addresses, domain names, or file names or hashes. There are other indicators associated with many compromises or breaches that can add a great deal of granu… Continue reading Artifact Tracking: Workstation Names
Now and again, someone will ask me, “…how do you do analysis?” or perhaps more specifically, “…how do you use RegRipper?” This is a tough question to answer, but not because I don’t have an answer. I’ve already published a book on that ve… Continue reading Analysis Process
I ran across a fascinating post from Cyber Sundae DFIR recently that talked about the Capability Access Manager, and how with Windows 11 it includes database of applications that have accessed devices such as the mic or camera, going beyond just t… Continue reading Rundown
Anyone who’s followed me for a bit knows that I’m a huge proponent of metadata, and in particular, exploiting metadata in LNK files that threat actors create, use as lures, and send to their targets.I read an article not long ago from Splunk titled, LN… Continue reading Exploiting LNK Metadata
I ran across a Cyber5W article recently titled, Windows Shell Item Analysis. I’m always very interested in not only understanding parsing of various data sources from Windows systems, but also learning a little something about how others view the topic… Continue reading Shell Items