Windows 10 and beyond – What is your digital forensics investigation missing?
Windows Forensic Analysis is constantly progressing. If you have been doing digital forensics for the past few years and hav…
Android Recovery Acquisitions with Magnet AXIOM
In this post Jamie McQuaid from Magnet Forensics shows how to create Android physical images via custom recovery with AXIOM,…
FLARE VM – a fully customizable, Windows-based security distribution for malware analysis
FLARE VM is a fully customizable, Windows-based security distribution for malware analysis, incident response, penetration t…
fuse-mft: Expose the File System Metadata Stored within an MFT
fuse-mft is a FUSE file system driver for MFT files. It allows an forensic examiner to mount the file system tree defined by…
Using Outlook Forms for Lateral Movement and Persistence
During a recent investigation, CrowdStrike Services team identified an adversary attack method, used for lateral movement an…
Detection of Backdating the System Clock in Windows
SANS Institute has published a whitepaper by Xiaoxi Fan titled “Detection of Backdating the System Clock in Windows…
Introduction to Hashcat
Richard Davis has published a video introduction to Hashcat, a cross-platform CPU and GPU password “recovery” tool. He will …
Mac MRU Parser – Spotlight Shortcuts & BLOB Parsing
Sarah Edwards has updated her Mac MRU Parser. Now it parses the Spotlight Shortcuts plist and also the Bookmark and Alias BL…
Carving EVTX
Quentin Jerome from RawSec shared an article on carving Windows Event Logs in EVTX format. He gives a short overview of the …
Forensic Case Files: Chip Off, Chip On, The Chipper!
Cindy Murthy has published a post about her recent case where she and her team transplanted a chip from a damaged mobile pho…
