So I was analyzing some bookmark files and noticed the volume creation time didn't make sense. The time was too old. If you're at all familiar »
Overview Understanding the HFS+ file system is an important step to analyzing Mac systems. It tracks all of the metadata associated with files and folders on »
Overview I read a few blog posts and slide presentations discussing the forensic value of alias data within plists. They typically consisted of running strings against »
Overview Before I get into the real reason for this post, I want to quickly go over what kMDItemDateAdded is, and then I will discuss where »
Overview I always thought JTAG was hard, then I tried it, and realized it was actually very easy (most of the time). Pretty much anyone can »
I started playing around with the Arduino Uno Rev 3 awhile back but never got around to documenting anything via a blog post (until now). I »
I am back online after a year. My previous employer did not allow blogging or code contributions, but that's behind me now so I am free »
Update - Back Online In two weeks I will no longer have corporate restrictions on blogging. I look forward to writing some new posts. I've missed »
I got this idea awhile back when I wrote a tool called, BARFF - Browser Artifact Recovery Forensic Framework. It was more or less a glorified »
In Part 1: Introduction to Hardware and Embedded Forensics I went over some tools I am using to perform hardware and embedded forensics analysis. In Part »
DISCLAIMER: EVERYTHING HERE WILL VOID YOUR PRODUCT WARRANTY This is Part II in a series of blog posts I will be doing. The main tracking page »
Blog Series Part 1: Introduction to Hardware and Embedded Forensics Part 2: UART Intro. and Sniffing UART with a Logic Analyzer Part 3: Home Automation Hub »
So I was reading Trend's blog post Without a Trace: Fileless Malware Spotted in the Wild and although not totally new, it got me thinking a »
I do not consider these next steps complex but I still wanted to document it because I didn't really find much online except a few Stack »
Update 8APR15 - Works on .msg files now. I wasn't going to write a blog post on this, but figured I would go ahead and share »
I was playing around with WinZIP today and noticed something and wanted to write it down before I forgot to document it. I still need to »
I released a tool called, Python Registry Parser (or regparse for short), which is a plugin based Windows Registry parser written in Python. Main reasons for »
Businesses of all sizes seem to be moving at least some operations to the cloud. It’s only a matter of time before you get a »
In a previous post Build your own NSRL Server I showed people how to get a NSRL server setup so they could filter out whitelisted hashes »
Ok, so I am taking a bit of a different direction and I am writing a quick post on interviewing. I don't claim to be an »
I was on a case the other day and I could see the malware dropped, At jobs created (typical), then I went to work on parsing »
I posted a blog post about Windows Processes and how knowing what's "normal" can be used to spot malicious activity. You can find it here Know »
I have been talking with quite a few people lately tasked with "security" inside their organizations and couldn't help but notice their lack of understanding when »
It's been a long time since I wrote a blog post. I moved to Singapore and started a new job and I simply lost track of »
I read a blog post by Boe Prox while sitting on the beach in Cebu, Philippines this past weekend, which oddly enough is the same guy »