ಟ್ವೀಟ್ಗಳು
- ಟ್ವೀಟ್ಗಳು
- ಟ್ವೀಟ್ಗಳು & ಪ್ರತಿಕ್ರಿಯೆಗಳು
- ಮಾಧ್ಯಮ
@4n6k ತಡೆಹಿಡಿಯಲಾಗಿದೆ
ನೀವು ಖಚಿತವಾಗಿಯೂ ಈ ಟ್ವೀಟ್ಗಳನ್ನು ನೋಡಲು ಬಯಸುವಿರಾ? ಟ್ವೀಟ್ಗಳನ್ನು ನೋಡುವುದು @4n6k ಅವರನ್ನು ತಡೆತೆರವುಗೊಳಿಸುವುದಿಲ್ಲ.
-
ಪಿನ್ ಮಾಡಿದ ಟ್ವೀಟ್
[
#DFIR] My reading/resource list (forensics, IR, infosec, malware, reverse engineering, programming, etc): http://www.4n6k.com/p/resources.html … -
<monthly reminder that shellbags are great artifacts and you should be using Shellbags Explorer in every case ya get>
-
Whoever did the video production and marketing for this video did it really well.https://twitter.com/MagnetForensics/status/829720044678569984 …
-
We're looking for a web pentester type to come and hack stuff with me
@mozilla => https://careers.mozilla.org/position/gh/589077 … -
I have seen many systems with
#Prefetch files (allocated) that are actually other files or partials. Any#DFIR seeing this?pic.twitter.com/sggVBH2xgM
-
@4n6k Both, and it's a corporate environment (Windows AD). I run Win10 Ent version 14393 (1611), the other computer Win10 Ent version 10586. -
@4n6k Have now tested functionality on Win10 and it works against another host on the network toopic.twitter.com/7anDYsFvwt
-
Results for `volrest.exe \\127.0.0.1\C$\Windows\system32 /s` std: 257 files, 26 dirs admin: 323 files, 49 dirs Sampling of some imp diffs:pic.twitter.com/WpfCiJTIAW
-
Running volrest.exe as admin will net you more previous version results, but std user is still able to get a ton + VSC paths w/o vssadmin.
-
Can confirm volrest.exe works for Win7. Even works for standard non-elevated accounts. No vssadmin necessary. Can see VSC paths.pic.twitter.com/J4JWNn0CdO
-
Wow, volrest and this capability go back a long time: http://www.windowsdevcenter.com/pub/a/windows/2004/07/20/shadow_copies.html …
-
RE: https://twitter.com/4n6k/status/826723131020673024 … Looks like there's a cmd tool to determine paths to previous versions of files: volrest http://superuser.com/questions/643536/how-to-find-and-open-previous-versions-of-a-folder-programmatically-using-power …
-
This exchange is a great example of the research process. Good stuff on both sides, figuring it out.
Spicy
#DFIRpic.twitter.com/IERnYFnT43
-
[
#DFIR] Forensics Quickie: Accessing & Copying Volume Shadow Copy Contents From Live Remote Systems http://www.4n6k.com/2017/02/forensics-quickie-accessing-copying.html … -
PROTIP: When delegated a task - even if you don't know the solution - research & *figure it out.* Those are the best people w/ whom to work.
-
Remember this post? Well, now there's a nice website for it all. http://aboutdfir.com/ Nice work
@aei4n6.#DFIRhttps://twitter.com/4n6k/status/817802830203551746 … -
And on that note, let's not forget another great and similar
#DFIR post by@patrickrolsen -->http://sysforensics.org/2014/01/lateral-movement/ … -
Dan (4n6k) ಹಿಂಬಾಲಿಸಿದ್ದಾರೆ Open Whisper Systems, HAGGIS! ಮತ್ತು JP
-
@whispersystems
Making private communication simple. For support, questions, or more information, please visit http://support.whispersystems.org
-
@M_haggis
I help companies eradicate evil. https://keybase.io/mhaggis Legacy: http://blog.michaelhaag.org
-
-
Nice post and clean blog by
@ok_bye_now. <-- students, take note. This is how you get ahead.#DFIRhttps://jordanpotti.com/2017/01/20/basics-of-windows-incident-response/ … -
Can't leave out Blue Team. Check out Blue Team Field Manual
#BTFM. Many, many thanks to Alan White@_BTFM.https://www.amazon.com/gp/product/154101636X/ref=as_li_tl?ie=UTF8&camp=1789&creative=9325&creativeASIN=154101636X&linkCode=as2&tag=r0148-20&linkId=9abaa9e9f624382c5fc36867f82551bd … -
"PowerMemory v1.4 – Exploit the credentials present in files and memory." Neat stuff. http://seclist.us/powermemory-v1-4-exploit-the-credentials-present-in-files-and-memory.html …
ಲೋಡಿಂಗ್ ಸಮಯ ಸ್ವಲ್ಪ ತೆಗೆದುಕೊಳ್ಳುತ್ತಿರುವಂತೆನಿಸುತ್ತದೆ.
Twitter ಸಾಮರ್ಥ್ಯ ಮೀರಿರಬಹುದು ಅಥವಾ ಕ್ಷಣಿಕವಾದ ತೊಂದರೆಯನ್ನು ಅನುಭವಿಸುತ್ತಿರಬಹುದು. ಮತ್ತೆ ಪ್ರಯತ್ನಿಸಿ ಅಥವಾ ಹೆಚ್ಚಿನ ಮಾಹಿತಿಗೆ Twitter ಸ್ಥಿತಿಗೆ ಭೇಟಿ ನೀಡಿ.
Dan (4n6k)
Jonathan Claudius
James Habben
Jan Engman
RTFM
dk