X-Ways Forensics Cheat Sheet
Brett Shavers has published his cheat sheet on how to you X-Ways Forensics. If you still haven’t checked it, it’…
Taking Memory Forensics To The Next Level
Here is a talk on memory forensics by Jamie Levy from Lockdown 2018: …
Deobfuscate malicious VBA Macros with ViperMonkey
ViperMonkey is a VBA Emulation engine written in Python, designed to analyze and deobfuscate malicious VBA Macros contained …
Persistence Mechanisms
As a continuation of the “Introduction to Windows Forensics” series by Richard Davis, this episode looks at pers…
Defcon DFIR CTF 2018 Open to the Public
David Cowen has posted Defcon DFIR CTF 2018 images and questions at his blog. It’s time to download them and have a go…
IoT 4n6: The Growing Impact of the Internet of Things on Digital Forensics
Gartner predicts that by 2020 there will be more than 20 billion connected “things,” not including smartphones, …
The Sleuth Kit 4.6.2 and Autopsy 4.8.0 released
The new versions of the Sleuth Kit and Autopsy have been released. You can already download them at GitHub and test. New fea…
Knowledge is Power! Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage
Sarah Edwards has posted her research of knowledgeC.db database. This database can be found on macOS and iOS devices. On Mac…
Imago: Digital Images Forensics Tool
Imago is a python tool that extract digital evidence from images recursively. This tool is useful throughout a digital foren…
The Challenges of APFS and How EnCase Can Help
The new Apple File System (APFS) was developed to replace HFS+ and became the default file system in September 2017. Like ma…
