Digital Forensics and Incident Response
Another DFIR book has been announced by Packt Publishing. It’s “Digital Forensics and Incident Response” b…
Windows Prefetch Carver
Adam Witt has presented a fresh Python script. It’s called Windows Prefetch Carver and, as you already understood, can…
Exposing Command Line Shells History with PowerShell
Eyal Neemany has published a post on how to use PowerShell to expose command line shells history. He notes that the biggest …
Python Digital Forensics Cookbook
Another digital forensic book from Packt Publishing has been announced. This time it’s “Python Digital Forensics…
SANS How To’s: SRUM-DUMP (System Resource Utilization Monitor) Tool
In this video Mark Baggett will show you how you can use a tool named SRUM-DUMP to capture critical DFIR (Digital Forensics …
Chainsaw of Custody: Manipulating forensic evidence the easy way
Wolfgang Ettlinger from SEC Consult Vulnerability Lab has published an interesting research on how to manipulate forensic ev…
Rapid Provisioning of a Malware Analysis Environment
Adam Kramer has published a post in SANS DFIR blog about ‘rapid_env’. This is an open source tool he developed, …
PPEE: cross-platform PE explorer
If you prefer to use different platforms for malware analysis and forensics, here is a good fresh tool for you – PPEE …
Automating print logging for DFIR purposes
Medium user @rootsecdev has published a post on how to automate print logging for DFIR purposes. In the post the author show…
Brush up on Dropbox DBX decryption
Francesco Picasso from Zena Forensics has published a blog post on how to decrypt Windows Dropbox DBX files. Reading the pos…
