I shared this page last month for my upcoming travels but as it’s getting closer to take off I thought I’d expand a bit on what I’m looking forward to over my time away.
I got a question from a colleague a few weeks ago about a potential bug in ExifTool, a fantastic tool and library by Phil Harvey for parsing EXIF data. I had a few minutes this evening, so thought I’d share the digging
We made a couple of word documents, and ran them through ExifTool, to take a look at the ‘Word Count’ field, and later I recreated them at home.
A few weeks ago Dave Cowen did four nights in a row of Windows 10 testing and I finally got to watching through it all. (more…)
A couple weeks ago I competed in DFIR Netwars at SANS Sydney 2017. Our team did really well, leading most of the way and just losing in the last half hour. But overall, it was a great learning experience and I thought I’d share some things about it.
TLDR: This is a post about how I document my examinations. I create a word document with a brain dump of my findings which includes a narrative that allows me to read through it in a way that gets me back into the mindset I was in when I completed the examination.
A while back I wrote a Windows GUI for Regripper. (more…)
I noticed someone retweeted my link for this project last week so thought I’d write a short post about it. (more…)
I was sitting in an Intro to Forensics lecture recently (in my free time, I’m crazy I know) and was explaining orphaned files to a student so thought I’d just write some stuff down about it. The main point of the post was showing how to manually modify the MFT to create orphaned entries and what they look like in FTK Imager (V126.96.36.199). Nothing groundbreaking 🙂 (more…)