Malware Data Science: Attack Detection and Attribution
Security has become a “big data” problem. The growth rate of malware has accelerated to tens of millions of new …
The Power of Bro and why you should include it in your security infrastructure
Bro is the most powerful network visibility solution for information security professionals, but it remains a tool that is n…
Carving Fragmented Registry Files
Yet another registry parser, or yarp, is a library and tools to deal with Windows registry files [1]. Despite the name, yarp…
Windows Console Command History: Valuable Evidence for Live Response Investigation
Tom Sela has posted an updated version of his paper originally published in the March 2017 edition of eForensics Magazine. T…
Real-Time Forensics Through Endpoint Visibility
In the course of the last years, there has been an established forensic process in place known by every investigator and res…
iOS Imaging on the Cheap! – Part Deux! (for iOS 10 & 11)
Sarah Edwards has published the second part of her “iOS Imaging on the Cheap” series. This time the post include…
SPaRe: Efficient SQLite Recovery Using Database Schema Patterns
In recent times, the Internet of Things (IoT) has rapidly emerged as one of the most influential information and communicati…
Statistical Methods for Analyzing Event Time-Series Data in Digital Forensics
This CSAFE webinar was presented by Dr. Padhraic Smyth from University of California, Irvine on September 28, 2017. Descript…
Meltdown and Spectre – understanding and mitigating the threats
Yesterday, two new vulnerabilities (Meltdown and Spectre) were introduced that are in the architecture of processors in near…
Shellbag Forensics
As a continuation of the “Introduction to Windows Forensics” series, this video by Richard Davis introduces Shel…
