Sunday, June 6, 2021

Training! Cyber5W, CyberDefenders and more

Hello all, thanks for looking in.

As I continue trying to figure out what I want to be if/when I grow up, I'm finding so many awesome learning resources, including websites that offer basic introductions to DFIR and other infosec topics along with sites that have challenges to work through. I mentioned in an earlier post that I was considering a move toward learning to be a SOC analyst and that is still a possibility, though not my final goal. I hope one day to qualify for a digital forensic role with some company and I'm trying to learn all I can to make that happen. While I've been working on blue team training and exercises, I keep seeing amazing DFIR training opportunities and find I'm spending a lot more time on them than anything else at the moment.

I've recently started working on challenges at CyberDefenders. They have a variety of challenges for disk and memory forensics, malware, network traffic analysis and more. I completed a memory forensics challenge there a couple days ago called DumpMe. I had forgotten how much fun it was to work with Volatility. I learned a lot doing the challenge.

As has usually been the case for me, my training budget is mostly non-existent so I'm always on the lookout for low cost/no cost learning opportunities. I saw mention of a new training site while viewing my Twitter feed a couple weeks ago and I'm excited to see this site develop.

The Cyber5W Academy has multiple low cost and no cost training courses available. The 5W part of the name alludes to "who, what, where, when and why. The site is run by Professor Ali Hadi, Ph.d, who also teaches forensics and security courses at Champlain College. Cyber5W offers digital forensic consulting and on-site training as well.

The courses are broken down into three categories: Intro to Forensics, Windows Forensics and Linux Forensics. Quite a few courses are already available and many more are under development. All courses at the time of this post are either free or $50. The courses are online PDF based and include instruction, hands on exercises and the occasional quiz. Each course provides a certificate of completion as well.

I've been working my way through the Intro courses as I try to find my way to a DFIR role somewhere. They are helping me remember so much of what I've forgotten over the 5 years since I last did any forensic work. They are also introducing new ideas and helping me get up to speed on what is the current norm for forensic investigations. I especially liked the digital forensic reporting course, as reporting has always been something I enjoy. I intend to work my way through the available courses in all three categories.

I contacted Ali Hadi to thank him for this great learning opportunity and asked if he would tell me about his motivation for creating the Cyber5W Academy. He kindly replied and allowed me to share his thoughts here on the blog.
The Nobel Prize for an educator, is seeing his students being successful. There is literally nothing better than that and those success stories are prizes I love to collect. Now, currently teaching at Champlain College, allows me to engage with how many students per year? A hundred, two hundred, triple that number? It's good, I'm grateful, but still not much! But what if I am be able to teach and engage with thousands around the world? That's a great motivation! This is not the first educational organization that I have established, there are others, and they all share the same core goal "helping others".
Ali has created courses on other sites as well, including Hacking Techniques and Intrusion Detection, Digital Forensics Professional and Malware Analysis. He also has Offensive Software Exploitation and other great material on his YouTube channel.
I've received so many positive feedback, thank you and appreciation messages, network connection requests, etc, which I'm very happy that I was able to help those students advance in their careers, but also grateful for the opportunity. I thought now is the time in my career to start my own path and focus on something that I really love, which is teaching Digital Forensics.
He views Cyber5W as a way for him to help others, notably including those with little money to spend on quality training.
I do not want money to be a barrier for those who want to learn; I want to help as much as I can. Another important aspect, is the world is now so dependable on technology, and this means more abuse/crime/incidents/etc are going to happen. Unfortunately, that's true, so we need more investigators/fighters, we need more people to make this world a better place for our beloved ones. Therefore, I hope C5W will be able to encourage new people to start their DFIR journey, raise more awareness to DFIR, increase the DFIR community members, and also be a resource they can all depend on!
I'm looking very forward to seeing what all Ali has in store for Cyber5W. I'm having fun learning from his courses and can't wait to see what's next.

One other course I just purchased yesterday and plan to start working on soon is Cyber Security Incident Response: Wannacry Ransomware. The course is on Udemy and was authored by Balazs Lendvay.

The course is designed to teach the following (list taken from the Udemy course page):
Investigate and understand the behavior of the Wannacry ransomware in a lab environment using your own computer if you will.
Triage and identify indicators of compromise.
Live-analysis of the infected lab machine for windows artifacts
Static-analysis of the identified executable and artifacts
Sandbox analysis of the malicious activity, including network activity, processes, services, autoruns
Create a summary report of the incident and identify remediation recommendations

I've always liked learning about malware analysis, so it should be a lot of fun working through this course.

By the way, have you noticed how I keep mentioning the word "fun"? That's because learning is fun and it's my hope that more people will come to realize that. I'm very grateful to the people behind all these low cost and no cost courses for making this kind of fun available.

And with that, I will end this post. Hope to be back soon with some more cool stuff.

Saturday, April 3, 2021

Running Remnux on a Proxmox Server

One of techy things I really enjoy is working with virtual machines. I decided to set up a VM server a while back. There are several to pick from, but just for the sake of learning something new I set up a Proxmox Virtual Environment. While the computer I installed it on is ancient (AMD Phenom X4 965 with 8GB RAM), it still seems to run pretty well. I've been running two different Ubuntu server VM's on it since then. One is a Minecraft server for the grandkids and friends (and maybe me too) while the other is a simple file server. I also have one Windows virtual machine on there, but rarely use it.

Today, I started the Performing Malware Analysis on Malicious Documents course by Tyler Hudak on Pluralsight. The course makes use of the great Remnux Linux virtual machine by Lenny Zeltser. For those unfamiliar (if any such person exists), Remnux is a distro dedicated to malware analysis and comes with tons of malware analysis tools. Instead of adding Remnux to my nearly full laptop hard drive (too many other VM's taking up space), I decided to run it from my Proxmox server instead.

Remnux is available for download as a .ova file. The ova file is simply a compressed file containing other files. The files within the ova can be extracted with tar or 7zip (I used the 7z command line version). The only file within that we care about for this situation is the .vmdk virtual hard drive file. I went on to the next step while waiting for the vmdk to be extracted. I should note that what I describe below should apply for most any ova file. I just happened to be using Remnux.

Importing a virtual machine from an ova file to Proxmox isn't exactly a straightforward thing to do, but if you don't mind spending just a bit getting it ready it will work just fine. I'll talk about one issue I encountered later in this post.

The first step over on the Proxmox server is creating a new virtual machine. I won't go through the entire process of doing this, as there are plenty of other guides out there explaining it. However, during the creation process you are asked to create a new hard drive. Go ahead and do it, although we'll delete it later. I created the machine with a virtual dual-core processor, 4GB of RAM, a 10GB hard drive and accepted default setting for everything else.

Upon creating the VM, it was assigned an ID of 103. This meant that the temporary hard drive I mentioned above was created at /var/lib/vz/images/103 on the server. This temporary hard drive was just created so that the above directory would be created. This is where the Remnux vmdk we extracted earlier needs to be placed for the next step.

To get it there, I uploaded the vmdk from my laptop to the Proxmox server using the scp (Secure Copy) command. The syntax for the upload looks like this: scp <file-to-upload> <user@ipaddress:/path-to-folder>. In my case, it looked like scp remnux-v7-focal-disk1.vmdk root@192.168.x.x:/var/lib/vz/images/103. With that done, it's time to switch over to the Proxmox server view page located at <server-IP-address> port 8006 and start working in a shell (see pic).

Remember, you're logged in here as root so be careful if you're not really up on working at the Linux command line.

Upon logging in to the Promox page and going to the shell, we need to navigate to the directory mentioned above where our hard drive was uploaded to. Once there, we can just delete that temporary hard drive we created with a simple rm <filename>. In this case, it was rm vm-103-disk-0.qcow2. That leaves us with only the vmdk file still in the directory. Now, we have to convert it for use with Proxmox.

Still working from the command line, we need to type the following command: qm importdisk 103 remnux-v7-focal-disk1.vmdk local -format qcow2. The 103 in all of that of course is our machine ID. The command will convert our disk file from a vmdk to a qcow2. Qcow2 is a file format for QEMU virtual machines. Upon completion of the conversion, we are left with the original vmdk file and the newly created vm-103-disk-0.qcow2. We can now safely delete the vmdk as we won't be needing it anymore.

Now we go to the hardware settings for our new VM. We'll need to add our new hard drive to the machine. You'll see it listed as an unused hard drive. Double click it and check your settings. Once satisfied, you can click Add and it will be attached to your VM. In my case, I set the drive as a SCSI device and clicked Add. My hardware settings are picture below.

Next I clicked options (see pic) and double clicked the boot order setting. I clicked the check box to enable the hard drive and then dragged it to the top of the boot order.

We're done! Well, almost. After getting the boot order set, I switched to console view and clicked Start to boot the VM. In the console I was greeted with...a black screen. That's it. A little troubleshooting led me to change the display settings in the VM hardware from default to VMWare compatible and finally I got to the Remnux desktop.

Finally, once on the Remnux desktop, we need to enable networking so we can update. At the Bash prompt in the terminal, we type sudo ifconfig ens18 up. Actually, type sudo ifconfig -a to make sure yours shows up at ens18 as well and adjust accordingly. It didn't pick up an IP address at first in my case, so I typed sudo dhclient ens18 and the IP was set. After that, it was just a matter of running sudo apt update and sudo apt upgrade to get things updated.

If you have any questions or if I got something wrong or left something out, please comment below and I'll take care of it. Have a great day!

Friday, March 19, 2021

Feeling kinda blue (team)

Hello all! It took me much longer than I had planned to post again, but life has a way of keeping one busy. Between extra crazy hours at work, spending two weeks in bed "enjoying" the Covid-19 experience and otherwise just being busy as heck, I'm finally back to write a little.

In my last post, I said that I felt like it was unlikely I'd work in a digital forensics or any other security role ever again. I just didn't feel like I had a real chance to do anything in the field again. However, thanks to a lot of encouragement from a good friend, I'm studying and hoping to land a job as a entry level SOC analyst. The work seems very interesting to me and I believe it's something I would love.

Just like my earlier days getting into digital forensics, the ol' budget is pretty much nothing, so I'm actively searching out free and low cost training opportunities. The best source I've found for information on free and low cost training is on the DFIR Diva site. Along with her training information pages, Elan has so much more on the site that helps security noobs and veterans as well. I nominated her site for the DFIR Resource of the Year Forensic 4:cast Award and I hope you will too. There are so many great resources out there, but I think this one deserves recognition for it's fantastic wealth of information for those new or returning to the field.

One fantastic training I attended last month was the SOC Core Skills course taught by John Strand. This is a 16 hour (4 hours per day, 4 days) class that teaches entry level folks the basics they need to work in a SOC. It includes both lecture and labs. From the course info page, here's what the class teaches:

  1. Core networking skills
  2. Live Windows Forensics
  3. Live Linux Forensics
  4. Memory Forensics
  5. Active Directory Analysis
  6. Network Threat Hunting
  7. Basics of Vulnerability Management
  8. The Incident Response Process

The class is "pay what you can", so there is no reason for anyone to say they can't afford it. I was very impressed with the quality of the training. A Windows virtual machine is used in the course and it has all the lab materials. The lab materials are frequently updated.

Another opportunity I'm taking advantage of is the community version of Rangeforce. This free version of the site includes 20 course modules covering such things as Splunk, Docker, regular expressions, Kubernetes and so much more. This is an incredible resource and I'm learning a lot from it. The modules are taught in virtual machines so you can do hands on learning. I absolutely love this site and encourage you to give it a look.

I'm also training on the TryHackMe site. Like Rangeforce, there is free and paid training available and it too uses virtual machines in the browser to perform the labs. I'm having a lot of fun with this site too. I'm enrolled in the free Cyber Defense path which includes modules like Intro to Networking, Network Services, Active Directory Basics and more.

I've spent a little time on LetsDefend.IO This site simulates working in a SOC environment and does it pretty well. I've worked through the free exercises and plan to subscribe soon so that I can do more.

Finally, a great video resource I've found is the YouTube channel of Gerald Auger called Simply Cyber. He does a lot of great videos on getting into Cyber Security.

So that's all I've got for now. My progress through all of this is pretty slow, given my work schedule. When I have free time, I spend a lot of it working through this excellent training and look forward to finding more. Hope you all are well and thanks for reading!

Saturday, October 10, 2020

Where the heck have I been?

In the unlikely chance that someone will read this, I thought I'd just say hello and talk about what I've been doing since my last post nearly two years ago. Since then, I've disappeared from and then reappeared on social media and got a new job.

I'm currently in a job completely unrelated to anything I've ever done before. I'm working for a national home improvement store chain in the electrical department. I've learned so much about home electrical wiring and everything that goes with it and I'm really enjoying it. The hours are pretty crazy, but the work is usually enjoyable. After almost 4 years of retirement, I needed to get off my butt and do something productive again.

With all that said, I've recently started re-engaging with the DFIR world. This is because I missed learning cool new things and then experimenting with them on my own. From the first time I ever learned about digital forensics, I've been fascinated by it and all the different things that fall under the DFIR umbrella.

More importantly, I've missed the people. I made a lot of good friends over the years and I've lost touch with them for the most part, which I truly hate. So I've started trying to get back in touch with old friends and hope they're interested in being back in touch with me.

While I don't know if it's likely I'll ever work in any DFIR related job again, I still want to stay engaged with it. I love it and it's good for the brain to keep learning. That's why I've signed up for some free training courses and am working through them at the moment.

The courses I'm currently taking are both from Basis Technology. One is an introductory course called Intro to DFIR: The Divide and Conquer Process. The other Basis Tech course I'm taking is Autopsy Basics and Hands On. Both courses are online. I'm learning new investigative concepts, as well as being reminded of things I used to know and had forgotten about. I'm grateful to Basis for making these courses available.

My current plan, such as it is, is to continue these courses just to get my mind active on the subject(s) of DFIR. I've already started realizing just how much I've forgotten and how much has changed over the last few years. I'm excited to be thinking about these topics again. 

I reopened this blog in hopes it will prompt me to continue learning and writing about what I've learned. I always enjoyed writing and have missed doing it on a regular basis.

Be well and I'll be back with another post soon.

Tuesday, December 4, 2018

DFIR Training

Hello all! Back again, though not as soon as I had thought. Anyway, today I want to tell those who haven't already heard about the training offered by Brett Shavers. His courses have recently moved to a new home at This is where you will find all his current courses, as well as new courses as they come out. All courses are bundled and available for a monthly subscription.

I reviewed his old WinFE course four years ago. You can read it HERE, although that course is no longer active. I have also had access to his older X-Ways Forensics course and learned a lot from it.

While I haven't taken any of his newest training, the courses I've seen were great. The material itself is very well prepared and presented. The video and audio quality is also good, with items on screen easy to see and understand.

DFIR training is usually very expensive, as we all know. Brett is offering some high quality training at a fraction of the cost of many other courses. I plan to become one of his Patreon supporters soon and experience his newest offerings.

Brett also started a DFIR oriented social network at There are currently three groups on the site. One group is for DFIR Book Giveaways. Group members have the opportunity to win DFIR related books on a monthly basis. The other two groups are a SANS FOR 508 study group and a WinFE group.

Kudos to Brett for all he's doing with these sites. I encourage you to support him on his Patreon page and take part in some good DFIR training.

Tuesday, August 28, 2018

Life Update, a little Object ID research and More

It's been just over two years since I retired from the police department. As a retiree, I've enjoyed a lot of time with my wife, kids and grandkids, spent a lot of hours on my tractor, taken many walks in the woods and generally enjoyed life. As much as I've enjoyed my time off, I've realized I'm too young to be "really" retired.

While trying to figure out what I want to be when (if) I grow up, the field of digital forensics is always at the top of my list. I've missed the fun of learning cool new things and I miss solving cases. I often think back to my first case and how much I enjoyed doing that investigation. Finding what was on the computer and being able to report how and when it got there was so cool. Doing my own testing to find how artifacts were created and using that testing to help me tie the illegal materials in question to a certain user account, eventually getting a conviction was something I'll never forget.

I know that getting into forensics in the private sector won't be easy for me. I've accepted the possibility that it may never happen, but I'm going to give it a try. I know I have much to learn and catch up on. But honestly, learning the material is at least half the fun, right?

Speaking of learning, I watched the Forensic Lunch Test Kitchen with David Cowen a few days ago. In the video, he demonstrated the difference between Windows 7 and Windows 10 when it comes to the creation of an Object ID for a file. I recreated the test he did here and got the same results of course. But I started thinking about what may or may not change those results.

I wondered what might happen if I created the file as David did and then copied it to another location on the disk. I created a file called Never-opened.txt in my Documents folder. It was automatically given an object ID as expected from the earlier test. Next, I copied the file to another folder and used fsutil once again to check for an object ID for the copied file. In this case, no object ID was assigned.

Finally, I cut the file from it's original location and pasted it to another folder. the object ID traveled with the file to its new location. I went back and opened the copied file and as expected, a new object ID was created for it.  This testing all occurred on a Windows 10 Home system.

After talking with David, I've got a few other things I want to test as well. I'll post more when that's been done.

Finally, Brett Shavers wrote an excellent post on his blog How to start a digital forensic lab in your police department. The experiences he talked about were very similar to mine. He's absolutely right that you can make it happen, but it takes a lot of work and commitment to get it done. I was fortunate to have a chief who was very receptive to my ideas and helped me make it happen.

I wrote several grants to get funding for software and hardware. In addition to Federal grants, I was able to obtain funding from two different local foundations and one corporation. I like writing anyway, so getting to write a grant narrative explaining what I wanted and why was an enjoyable part of the process

Brett also talked about training. Like he mentioned, I paid my own way through some of my training (SANS FOR 508, 526 (old version) and 558 (old network forensics course). However, being in law enforcement, I also had the opportunity to attend training put on by the National White Collar Crime Center (NW3C). I took the NW3C BDRA and IDRA courses and those gave me an excellent introduction to the world of forensics prior to my SANS course attendance. If you are in in law enforcement, make sure you take advantage of the courses available to you for free through the NW3C.


That's it for now. I hope to start posting a little more often as time allows. Be well!

Friday, June 30, 2017

DFIR Reminiscing

Hello all. I have a new, mostly non-forensics blog that I occasionally post to. I just posted yesterday on a topic that I thought would be interesting to readers of this blog as well. The post is about fun/cool stuff I've acquired over the last few years from conferences and friends. Instead of re-posting it here, just take a look at the post on my Mental Field Trip blog.