Carve and recreate VSS catalog with vss_carver
Minoru Kobayashi has presented a tool for carving and recreating deleted VSS at at Japan Security Analyst Conference 2018. T…
Carving Fragmented Registry Files
Yet another registry parser, or yarp, is a library and tools to deal with Windows registry files [1]. Despite the name, yarp…
How to Mount Mac APFS Images in Windows
In the first post of the new year Mari Degrazia is writing about mounting APFS images in Windows. The thing is, Paragon has …
Incident Response Script for APT Hunting
Sergey Golovanov and Igor Soumenkov have prepared a New Year present for DFIR community: they have presented their script fo…
Covert Post Exloitation Forensics with Metasploit
Here is a talk by Wesley McGrew from Defcon 19 about coverting post-exloitation forensics with Metasploit: …
Fighting Child Exploitation with Digital Forensics
Digital forensic cases involving children as potential victims are a reality that is always present in today’s society. Whet…
Mac MRU Parser v1.5 has been released
Sarah Edwards has released the new version of Mac MRU Parser – 1.5. Now the script can gather info from the following …
Correlate Cases and Get Intelligence
Starting with Autopsy 4.5.0, you can now determine when a file or phone number (or other artifact) was seen in a previous ca…
CERTitude – The seeker of IOC
CERTitude is a Python-based tool which aims at assessing the compromised perimeter during incident response assignments. It …
Investigate malicious logon with LogonTracer
LogonTracer helps digital forensics analysts to investigate malicious logon by visualizing and analyzing Windows active dire…
