FORENSIC ANALYSIS Hideaki Ihara at the Port 139 blog took a look at the Win10 Thumbnail index database, thumbcache_idx.db. Win10 と Thumbnail Index Brian Maloney stumbled across a Windows event log, Microsoft-Windows-MBAM/Operational, that tracks RemovableDriveMounted and RemovableDriveDismounted (event ID 39 and 40) Check out @bmmaloney97’s Tweet There were a few posts on the Cyber Forensicator […]
Happy New Year! It was a bit hectic last week posting a few times on New Year’s Eve; in case you missed it, I posted my monthly podcast episode, as well as a wrap up for the year. FORENSIC ANALYSIS Hideaki Ihara at the Port 139 blog posted a couple of times this week The […]
Another year has passed! I figured I did a wrap-up post last year so I decided I would do it again. (Most people relax on Sundays right? I wonder what that’s like…) This year has been as interesting as last year from a personal growth and development perspective. I decided to change a few things about […]
A monthly wrap-up of the DFIR news for December 2017. Thank you to those Patreon donors for the last month. I decided to go with the value-for-value model rather than advertising. If you get a little bit of value from the show, then I appreciate those that decide to give a little back. Alternatively, it would be great if […]
Last weekly post for the year! It’s both good and bad that the year ends on a Sunday. It does round things off nicely, but it also means that I have a podcast to put together next. Thank you to everyone that reads this every week, and also shares it around with others. I really […]
Merry Christmas and Happy Holidays! Hope everyone’s enjoying their break…although the last couple weeks have been 120+ links shared a week, and this week is no exception. FORENSIC ANALYSIS Hideaki Ihara at the Port 139 blog uses eventlogedit to delete an Event Log record. EventLogとEVTX There were a few posts by the guys at Cyber […]
FORENSIC ANALYSIS Hideaki Ihara at the Port 139 blog takes a look at registry transaction log files and shows to examine them using Maxim Suhanov’s YARP tool. RegistryとTransaction log files The guys at Cyber Forensicator shared a paper by Xingzi Yuan, Omid Setayeshfar, Hongfei Yan, Pranav Panage, Xuetao Wei, and Kyu Hyung Lee titled “DroidForensics: […]
FORENSIC ANALYSIS Hideaki Ihara at the Port 139 blog looks at deleting values from the Windows Registry. RegistryとFile format(3) Digital Forensics Corp shared an article by Jason Fenech at Altaro showing a few methods for accessing data on a VMDK. How to extract data from Virtual Machines Scar de Courcier at Forensic Focus has posted […]
FORENSIC ANALYSIS Hideaki Ihara at the Port 139 blog continues his examination of the Windows registry file format RegistryとFile format(2) There were a couple of posts by Digital Forensics Corp this week They provided a brief overview of Volatility Workbench by Passmark software. Volatility Workbench Overview They shared an article on InfoSecAddicts on iOS device […]
A monthly wrap-up of the DFIR news for November 2017. Thank you to those Patreon donors for the last month. I will be donating that money to Lifehouse in memory of my late colleague John. If you are a Patreons donor the show notes can be found here Special thanks to my friend Jeff (Animatic on Soundcloud) for letting me […]
