I got a question from a colleague a few weeks ago about a potential bug in ExifTool, a fantastic tool and library by Phil Harvey for parsing EXIF data. I had a few minutes this evening, so thought I’d share the digging
We made a couple of word documents, and ran them through ExifTool, to take a look at the ‘Word Count’ field, and later I recreated them at home.
A few weeks ago Dave Cowen did four nights in a row of Windows 10 testing and I finally got to watching through it all. (more…)
A couple weeks ago I competed in DFIR Netwars at SANS Sydney 2017. Our team did really well, leading most of the way and just losing in the last half hour. But overall, it was a great learning experience and I thought I’d share some things about it.
TLDR: This is a post about how I document my examinations. I create a word document with a brain dump of my findings which includes a narrative that allows me to read through it in a way that gets me back into the mindset I was in when I completed the examination.
**update – this has been a really popular post but it’s very outdated now. Will add some information to the bottom of the post of what’s happened since**
On the 25th September Apple released OS X High Sierra which uses the Apple File System (APFS) as its default file system. Based on Steve’s video I thought it would be a good idea to do some testing.
A while back I wrote a Windows GUI for Regripper. (more…)
I noticed someone retweeted my link for this project last week so thought I’d write a short post about it. (more…)