Arman Gungor at MetaspikeInvestigating Message Read Status in Gmail & Google Workspace Brian MaloneyYour AV is Trying to Tell You Something: Registry CCL SolutionsUpdated RabbitHole software sets new standard for forensic data exploration tools David Via and Scott Runnels at Fire Eye Threat ResearchBack in a Bit: Attacker Use of the Windows Background Intelligent Transfer […]
A monthly wrap-up of the DFIR news for March 2021. Thank you to those Patreon donors for the last month. This project takes a lot of time, so it’s very much appreciated that people see enough value in it to contribute back 🙂 If you are a Patreon donor the show notes will be found here. Special […]
Jason Jordaan, one of my FOR308 co-authors, needs your help! Please fill out the survey on DFIR fundamentals below (and go in the draw to win a $250 Amazon voucher).Survey Now Open: 2021 SANS Digital Forensics Survey: Digital Forensics Essentials and Why Foundations Matter Abhiram KumarWhat App Is On Fire? – Securinets Quals 2021 Marco […]
I ran a webcast last month on getting started in DFIR by testing, and walked through a few different scenarios. Minor bump at the beginning with my VM dying, but at least we knew it was live! I took some parts of my FOR308 and FOR500 material to create this talk, where the premise is […]
Alexis BrignoniCheck out @AlexisBrignoni’s Tweet Brian MaloneyYour AV is Trying to Tell You Something: VBN’s Part 3 Brendan MccreeshData Exfiltration via ConnectWise Control (formerly ScreenConnect) James Smith at DFIR MadnessTriage Disk Analysis Case 001 Lukasz Olszewski at CyberushSuper timeline initial triage with Jupyter and Pandas Meisam Eslahi at Cyber Security HubBlue Team-System Live Analysis [Part […]
Nominations for the 4Cast Awards have opened again! Get your nominations in early!Lee has done a fantastic job for over a decade getting this together and his work is very much appreciated.Please make sure you nominate everyone who had an impact on you throughout 2020 to show your appreciation for them!2021 Forensic 4:cast Awards – […]
A monthly wrap-up of the DFIR news for February 2021. Thank you to those Patreon donors for the last month. This project takes a lot of time, so it’s very much appreciated that people see enough value in it to contribute back 🙂 If you are a Patreon donor the show notes will be found here. Special […]
Brian MaloneyYour AV is Trying to Tell You Something: VBN’s Part 1 Doug Metz at Baker Street ForensicsCSIRT-Collect Flynn Weeks at ‘The What2Log Blog’EventRecordID: A Hidden XML Tag Gabriele Zambelli at ‘Forense nella Nebbia’Building a Linux profile for Volatility 2 and 3 Kyle SongBlog #25: Importance of Drive Trim in Forensic Imager part 1. [KR] […]
ThinkDFIRMetaspike CTF – Week 6 – “HODL onto your timestamps” AbdulRhman Alfaifi at U0041Exploring Windows Artifacts : LNK Files Anatoly Tykushin at Group IBThe source of everything: forensic examination of incidents involving source code leaks Brian MaloneyYour AV is Trying to Tell You Something: AVMan.log/Daily AV Log Cellebrite Overview of Parsed Data in Cellebrite Physical […]
Also I’ll be delivering a SANS @Mic talk this Wednesday, 17 February at 1PM AEDT (2AM UTC, sorry!). The talk is aimed at people new to the field, talking about how to get started learning about digital forensics by testing and experimenting. You can register here Andrea Fortuna at ‘So Long, and Thanks for All […]
