A Guide to Eric Zimmerman’s command line tools
SANS Instructor and Former FBI Agent Eric Zimmerman has provided several open source command line tools free to the DFIR Com…
Is Fileless Malware Really Fileless?
Travis Smith has published a post about fileless malware on The State of Security. He notes that this type of malware isn…
How to Load a SQL .bak File for Analysis, Without SQL Server Previously Installed
Brian Moran from BriMor Labs has posted an article on how to load a SQL .bak file for analysis, without SQL Server previousl…
Forensics Analysis from Cloud Storage Client Application on Proprietary Operating System
Increased use of cloud storage services have become a necessity alternative that complements the main storage media in every…
Tor Browser Artifacts in Windows 10
Here is a paper by Aron Warren from SANS Institute Reading Room site about Tor browser artifacts in Windows 10. The Tor netw…
Extract data from System Resource Usage Monitor database with srum-dump
Srum-dump is an open source tool by Mark Baggett, which creates an excel spreadsheet containing forensics artifacts containe…
Windows 10 Forensics
In this article, we are going to take a close look at the fundamentally new sources of digital evidences that are typical fo…
An Overview: Windows Volume Shadow Copies
BlackBag Training Team has published a fresh post. This time they are speaking about Windows Volume Shadow Copies. You will …
Windows Forensics by Dr. Philip Polstra
Windows Forensics is the most comprehensive and up-to-date resource for those wishing to leverage the power of Linux and fre…
A forensic insight into Windows 10 Jump Lists
The records maintained by Jump Lists have the potential to provide a rich source of evidence about users’ historic act…
