Hello Reader,
It's Saturday! Time for another collection of links to make you think. I will most likely be going to go see Thor today but after that I will be back to my forensicy ways. Here is this weeks set of good reads.
1. The Forensic lunch, always free of trans fats, happened again this Friday. This week Sheryl Falk of Winston & Strawn, Jonathan Rajewski of Champlain College, Matt and myself got down to business discussing the legal side of breaches, undergraduate and graduate degrees in computer forensics and big changes coming to the v3 beta of ANJP aka the triforce. Make sure to give it a watch! http://www.youtube.com/watch?v=GuUEyZw3hRo&list=PLzO8L5QHW0ME1xEyDBEAjmN_Ew30ewrgX&index=16
2. Over on the Magnet Forensics blog Jad has a nice writeup on his journey into the dark web and his research into recovering bitcoin artifacts, http://www.magnetforensics.com/bitcoin-forensics-a-journey-into-the-dark-web/. You may not currently have a case relating to tor or bitcoin, but its not going away so be prepared.
3. If you are interested in Plaso the python based log2timeline replacement or python DFIR development in general go over to Kristinn's blog and watch his video/follow his links to see what you missed at the Open Source Digital Forensics Conference http://blog.kiddaland.net/2013/11/osdf-conference-links.html.
4. If you watched last weeks forensic lunch then you'll know one of the things we lamented was a lack of an open source tool that would recover deleted data from SQLite databases. Well Mari DeGrazia has stepped up to the challenge and posted a blog entry with her tool, http://az4n6.blogspot.com/2013/11/python-parser-to-recover-deleted-sqlite.html. Well done Mari! Maybe you can come on the lunch and talk about it?
5. Lee Reiber has a good post up going through how to analyze Whats App, a very popular mobile messaging program http://blog.mobileforensicsinc.com/whats-up-with-whatsapp/. Lee works at Accessdata and does a lot work with MPE+ and their mobile training program there.
6. Over on the hexacorn blog there is a good introduction into the forensic implicated of Microsoft SCCM, http://www.hexacorn.com/blog/2013/11/01/sccm-system-center-configuration-manager-and-incident-response/. I'm a big fan of making use of SCCM and I plan to write some blogs regarding how to mine it for last logins and machine discovery.
7. Harlan has a new post up on his experience at OSDFC and OMFW, http://windowsir.blogspot.com/2013/11/conferences.html. I have a different perspective than Harlan does in regards to getting DFIR discussions going at conferences, but that may be because our choice of topics.That or I just keep talking about forensics until someone joins in.
That's all for this week, come back tomorrow for another Sunday Funday!
It's Saturday! Time for another collection of links to make you think. I will most likely be going to go see Thor today but after that I will be back to my forensicy ways. Here is this weeks set of good reads.
1. The Forensic lunch, always free of trans fats, happened again this Friday. This week Sheryl Falk of Winston & Strawn, Jonathan Rajewski of Champlain College, Matt and myself got down to business discussing the legal side of breaches, undergraduate and graduate degrees in computer forensics and big changes coming to the v3 beta of ANJP aka the triforce. Make sure to give it a watch! http://www.youtube.com/watch?v=GuUEyZw3hRo&list=PLzO8L5QHW0ME1xEyDBEAjmN_Ew30ewrgX&index=16
2. Over on the Magnet Forensics blog Jad has a nice writeup on his journey into the dark web and his research into recovering bitcoin artifacts, http://www.magnetforensics.com/bitcoin-forensics-a-journey-into-the-dark-web/. You may not currently have a case relating to tor or bitcoin, but its not going away so be prepared.
3. If you are interested in Plaso the python based log2timeline replacement or python DFIR development in general go over to Kristinn's blog and watch his video/follow his links to see what you missed at the Open Source Digital Forensics Conference http://blog.kiddaland.net/2013/11/osdf-conference-links.html.
4. If you watched last weeks forensic lunch then you'll know one of the things we lamented was a lack of an open source tool that would recover deleted data from SQLite databases. Well Mari DeGrazia has stepped up to the challenge and posted a blog entry with her tool, http://az4n6.blogspot.com/2013/11/python-parser-to-recover-deleted-sqlite.html. Well done Mari! Maybe you can come on the lunch and talk about it?
5. Lee Reiber has a good post up going through how to analyze Whats App, a very popular mobile messaging program http://blog.mobileforensicsinc.com/whats-up-with-whatsapp/. Lee works at Accessdata and does a lot work with MPE+ and their mobile training program there.
6. Over on the hexacorn blog there is a good introduction into the forensic implicated of Microsoft SCCM, http://www.hexacorn.com/blog/2013/11/01/sccm-system-center-configuration-manager-and-incident-response/. I'm a big fan of making use of SCCM and I plan to write some blogs regarding how to mine it for last logins and machine discovery.
7. Harlan has a new post up on his experience at OSDFC and OMFW, http://windowsir.blogspot.com/2013/11/conferences.html. I have a different perspective than Harlan does in regards to getting DFIR discussions going at conferences, but that may be because our choice of topics.That or I just keep talking about forensics until someone joins in.
That's all for this week, come back tomorrow for another Sunday Funday!
