Search for Malware on Webservers with Blazescan
Blazescan is a Linux webserver malware scanning and incident response tool, with built in support for cPanel servers, but wi…
X-Ways Forensics Cheat Sheet
Brett Shavers has published his cheat sheet on how to you X-Ways Forensics. If you still haven’t checked it, it’…
The Sleuth Kit 4.6.2 and Autopsy 4.8.0 released
The new versions of the Sleuth Kit and Autopsy have been released. You can already download them at GitHub and test. New fea…
Knowledge is Power! Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage
Sarah Edwards has posted her research of knowledgeC.db database. This database can be found on macOS and iOS devices. On Mac…
Deobfuscating Emotet’s PowerShell Payload
Lasq has posted a step-by-step guide on how to deobfuscate Emotet’s PowerShell payload. Also he shared a Python script…
How to Validate Your Forensic Tools
Paraben Software has published a free ebook called “How to Validate Your Forensic Tools”. The book is available …
Investigating Data Hiding and Covert Communication
The book will focus on incident response methods and techniques when faced with the unprecedented challenge that data hiding…
POSH-Triage
Mike Cary has written a PowerShell script that automates the use of Eric Zimmerman’s cmd line tools (https://ericzimme…
A Live Forensic Distribution Executing Malicious Code from a Suspect Drive
Maxim Suhanov has started a DFIR blog, and already submitted the first post – “A Live Forensic Distribution Exec…
Diffy: A Triage Tool for Cloud-Centric Incident Response
Diffy is a digital forensics and incident response (DFIR) tool developed by Netflix’s Security Intelligence and Respon…
