Week 31 – 2021

Lee has opened up nominations for the 2022 Forensic 4Cast Awards. This means that people can start nominating folks this year!2022 Forensic 4:cast Awards – Nominations are Open! Bob RudisAcoustic: Solving a CyberDefenders PCAP SIP/RTP Challenge with R, Zeek, tshark (& friends) DFIR ReviewMissing SQLite Records Analysis Forensafe Investigating Brave Web Browser Investigating OpenSaveMRU InfoSec […]

Week 30 – 2021

Thanks to everyone that voted for this site for “Resource of the Year”. Congratulations to all of the winners!2021 Forensic 4:cast Awards – Results Alexis Brignoni at ‘Initialization Vectors’vLEAPP – Vehicle Logs Events And Properties Parser Howie Shia at Amnesty InternationalForensic Methodology Report: How to catch NSO Group’s Pegasus Bill Marczak, John Scott-Railton, Siena Anstis, […]

Week 29 – 2021

Last week to get your votes in for the Forensic 4Cast Awards! If you haven’t voted yet, you can votes here: don’t delay! While I would love to win an award again, getting nominated as a top resource for the community is definitely something to be proud of (this will be my fifth year getting […]

Week 28 – 2021

Kroll Forensically Unpacking EventTranscript.db: An Investigative Series EventTranscript.db Research Parsing Diagnostic Data With Powershell and Enhanced Logging Parsing EventTranscript.db With KAPE and SQLECmd Forensic Quick Wins With EventTranscript.DB: Win32kTraceLogging EventTranscript.db vs .rbs Files and Their Relation to DiagTrack Andrea Fortuna at ‘So Long, and Thanks for All the Fish’Some thoughts about Stuxnet B. Krishna Sai […]

Week 27 – 2021

Brendan Bone at AccessDataHow to run FTK Imager from a flash drive (Imager Lite) Dr. Neal Krawetz at ‘The Hacker Factor Blog’Up to your knees in alterations Forensafe Investigating UC Web Browser Investigating Windows OneDrive Kevin Pagano at Stark 4N6Turbo Pt. 3 – Device Health Services Application Usage Maxim SuhanovShadow copies become less visible Not […]

Week 26 – 2021

Alex Caithness at CCLChromium Session Storage and Local Storage BelkasoftBelkasoft CTF June 2021: Write-up CrowdStrikeResponse When Minutes Matter: Falcon Complete Disrupts WIZARD SPIDER eCrime Operators DFIR ReviewUpgrade From NULL—Detecting iOS Wipe Artifacts Forensafe Investigating User Accounts Investigating Zoom Joshua Hickman at ‘The Binary Hick’Apple’s Find My & iCloud’s Throne of Lies Kevin Pagano at Stark […]

Week 25 – 2021

Amber Schroader at Paraben CorporationTikTok Smartphone Evidence Marco Fontani at AmpedHow Can I View and Show the Date and Time of a CCTV Video File? AmrChapter 7 – Registry Analysis Chris Vance at ‘D20 Forensics’ iOS – Tracking Device Migration Android – Tracking Device Migration Oleg Afonin at Elcomsoft Analyzing Microsoft Timeline, OneDrive and Personal […]

Week 24 – 2021

Paul Masek at 4sysopsUsing the Convert-EventLogRecord function alongside the Get-WinEvent PowerShell cmdlet to search Windows event logs AcelabThe PC-3000 Mobile: the Support of Per-File Encryption for the F2FS File System Korstiaan Stam at Cloud ResponseCyberDefenders – Series (Malware Traffic Analysis 3 – Packet Analysis) Patrick Bennett at CrowdStrikeUAL Thank Us Later: Leveraging User Access Logging […]

Week 23 – 2021

Marco Fontani at AmpedHow Can I Find Which Are CCTV Video Files on a USB Drive? Andrea Fortuna at ‘So Long, and Thanks for All the Fish’dfir_ntfs: a forensic parser for NTFS filesystems DS4N6[NEWS]  DAISY documentation updated, including Demo version precooked content and RAM configurations Elcomsoft Password Crackers’ Gold Mine: Browser Passwords Breaking VeraCrypt: Obtaining […]

This Month In 4n6 – May – 2021

A monthly wrap-up of the DFIR news for May 2021. Thank you to those Patreon donors for the last month. This project takes a lot of time, so it’s very much appreciated that people see enough value in it to contribute back 🙂 If you are a Patreon donor the show notes will be found here. Special […]