Plaso 20171118 has been released
Plaso development team has just released a new Plaso version, fixing a couple of small issues and adding a parser for Sophos…
Extending The Sleuth Kit and its underlying model for pooled storage file system forensic analysis
Carrier’s book File System Forensic Analysis is one of the most comprehensive sources when it comes to the forensic an…
In-Depth Forensic Analysis of Windows Registry Files
The Windows registry is an essential source of evidence when performing a wide range of examinations. In a recent talk (Zero…
Mail Header Analyzer (MHA)
Mail Header Analyzer (MHA) is an open source tool by Ahmed Shawky for parsing email headers and converting them to a human r…
Getting Started with the SIFT Workstation Webcast with Rob Lee
An international team of forensics experts helped create the SANS Investigative Forensic Toolkit (SIFT) Workstation and made…
MemTri: A Memory Forensics Triage Tool Using Bayesian Network and Volatility
This work explores the development of MemTri. A memory forensics triage tool that can assess the likelihood of criminal acti…
LNK Files and Jump Lists
Richard Davis continues his “Introduction to Windows Forensics” series. This video introduces the ubiquitous LNK…
Chasing Adversaries with Autoruns â Evading Techniques and Countermeasures
Sysinternals Autoruns is a great utility for defenders to discover and disable malware and adversaries’ persistence po…
FindUSBMSC has been updated
EasyMetaData has updated FindUSBMSC. It’s a script to parse the system logs on macOS. It looks for USBMSC storage devi…
Extract Common Windows Forensic Artifacts with ArtifactExtractor
ArtifactExtractor is a script that extracts common Windows artifacts from source images and VSCs. Artifacts in VSCs will be …
