Author: Phill Moore

I am a digital forensics analyst. I have a couple of blogs - This Week In 4n6 and Think DFIR I go by randomaccess (or variations of) on a number of DFIR social channels.
Written by Phill Moore

Week 24 – 2018

I’m back! Thankfully was able to get the post done today before jetlag set in. I’ll probably do a recap of the trip this week if I get a chance to jot down some thoughts. Overall it was fantastic and I had a great time, but it’s good to get home; 4 weeks away is […]

Written by Phill Moore

Week 23 – 2018

  Another week of links only; I’m going to try get back to scheduled programming next week but that may be tough. Will do my best 🙂 FORENSIC ANALYSIS Port139 ActivitiesCache.dbとアクティビティ削除(3) Arsenal Consulting Quick Look Cache Parsing Arsenal Quick Look Cache Parsing Collecting Quick Look Data From a Live macOS System Cyber Forensicator TrueCrypt Container […]

Written by Phill Moore

Week 22 – 2018

Links only this week! FORENSIC ANALYSIS Port139 ActivitiesCache.dbとアクティビティ削除(2) Cloudy Forensics How to run Yara Rules during Incident Response Cyber Forensicator Darwin-Collector – collect key files for macOS investigations Windows Phone Physical Imaging Without JTAG and Chip-off Cyber Triage Using Volatility in Cyber Triage to Analyze Memory DFIR Science Testing File Systems for Digital Forensic Imaging […]

Written by Phill Moore

This Month In 4n6 – May – 2018

A monthly wrap-up of the DFIR news for May 2018. Sorry in advance for the audio quality, turns out recording on my laptop without a dedicated mic, on a cruise ship, results in bad audio. Thank you to those Patreon donors for the last month. I decided to go with the value-for-value model rather than advertising. Alternatively, it would […]

Written by Phill Moore

Week 21 – 2018

FORENSIC ANALYSIS Hideaki Ihara at the Port 139 blog deletes some items out of the Win10 Timeline and shows that these events remain in the timeline database for a period (of unknown length) after the deletion. It would be good if he was to check the deleted records after a week or two and see […]

Written by Phill Moore

Week 20 – 2018

One more week of (vendor) campaigning for the Forensic 4Cast Awards! This will be my last mention of it before the actual awards, so if you haven’t already, head over here to vote! Magnet Forensics lists a few reasons why they deserve the Phone forensic tool of the year. 5 Reasons Magnet AXIOM Is Forensic […]

Written by Phill Moore

Week 19 – 2018

  Magnet Forensics wrote a blog post reminding you to go and vote in the Forensic 4Cast Awards. Only a couple more weeks till voting closes! 3 Reasons to Vote Magnet Forensics for Forensic 4:cast Digital Forensic Organization of the Year Brett Shavers at DFIR.Training shared some stats for the site, as well as asked […]