Hello everyone. I'm back for yet another blog post after a long absence. I wanted to post a great big giant THANK YOU to all the great open source forensic projects out there. You all are my heroes and I truly appreciate all that you make available to the digital forensics community.
I've been very busy as of late working on a case I was hired for and recently concluded. I wish I could tell about it as it's kind of interesting. Unfortunately, the most interesting parts are the things I really can't talk about. I'll just call it an employee misuse of company computer situation and leave it at that.
Among other things, the employee in question was using his company owned laptop to surf various types of porn, as well as using MS Word to do a little amateur porn story authoring. There were allegations of some financial misdeeds as well and I recovered a large number of files to help them conduct their investigation.
I relied in no small part on the knowledge I've gained from such books as the Windows Forensic Analysis series and Digital Forensics with Open Source Tools in working this case. Furthermore, I stand grateful to all the free and open source tool authors out there whose work benefited me greatly. Such awesome programs as Log2Timeline, RegRipper, the Sleuth Kit and the SANS SIFT Workstation virtual machine were huge help to me in this and most all my other cases.
The super awesome Volatility Framework crew has been rocking the proverbial house this month with their Month of Volatility Plugins. First, Volatility 2.2 was released at the beginning of this month and they're releasing tons of new plugins all month long. The blog posts at the official Volatility Labs blog accompanying these releases are just incredible. A great thank you and salute in no particular order to AAron, Jamie (Gleeda), MHL, Andrew and everyone else involved for using your talents to produce one of the greatest software projects ever and an amazing blog.
I've had the opportunity to do some public speaking lately and find I'm really enjoying it. Public speaking used to make me quite nervous, but I'm pretty comfortable with it these days. I've spoken to one group on protecting your home computer from malware, etc, while I did a training session on Identity Theft this week for a local bank. In both cases, I decided not to use Powerpoint or other visual aids. I believe it was Harlan Carvey at the WACCI conference a couple years ago who called the Powerpoint-free presentation "going commando." I liked that term and I enjoyed his presentation that day. It's fun to speak and interact with the crowd and I find I do a better job of that when I'm not using visual aids to distract me. Besides, I'm terrible at making PP slides anyway, so I'm better off going commando for that reason as well.
That's all I've got for now. Now that I've got a little more free time, I have a couple forensics related projects I hope to get started on. I hope to be back with new blogs posts about them "soon."
Wednesday, October 10, 2012
Monday, July 9, 2012
Knowing Normal
I heard talk at the SANS DFIR Summit a couple weeks ago about "knowing normal". What does that mean? Knowing what your systems and networks are doing each day and what their stats should look like. That way, even if you don't really know how to recognize something bad, you'll still know you're not seeing what you usually expect to see. This will (hopefully) lead you to investigating the oddity and finding the cause. You don't have to be an expert on what you're looking at; you only need to know it doesn't look like it should.
I had the opportunity last week to help out a local business tracking down strange issues on their network. It's a small business and they have no actual IT staff. Rather, some of the employees try to manage things as best they can and call in help when a problem is beyond their ability to fix. The business runs an Untangle router/firewall and it automatically sends an email each day to an employee with stats for the previous day. On this day, the employee noticed that their network traffic was more than double what he expected to see on a "normal" day.
The week of Patch Tuesday is one of those times the employee expects to see a rise in network traffic when the 15 computers in the business receive their updates. On a typical workday, the network normally sees about 1.0 to 1.1 gigabytes of traffic. On this particular workday, the traffic rose to 2.47 gigabytes without any obvious reason. The employee knew something was wrong, but he didn't know what. Things just weren't "normal."
I was given access to the Untangle control panel and I began looking at the event logs for each section. I found nothing remarkable until I opened the panel for Application Control Lite. This section monitors various network protocols for applications like chat programs, peer to peer networking, etc. I was sure I found the problem as soon as I looked at the protocol logs. One workstation on the network was making repeated attempts to make contact with a UK IP address via the Soulseek peer to peer networking protocol. This was definitely not normal
A look at other system reports showed the second most popular destination port through the Untangle gateway was port 16464 (port 80, naturally, was number 1). Once again, not normal.
I went to the troublesome computer and found a fake antivirus program on it. I decided to create an agent using Mandiant Redline to collect volatile data and a memory image prior to beginning cleanup. My plan was to use Redline to examine the data it collected and then later use the awesome Volatility Framework to continue studying the data.
While waiting for the Redline agent to finish, I posted a tweet that I was dealing with an apparent malware infection using a peer to peer protocol to commnicate out of the network. One of my friends, @dfirn00b asked if a port in the area of 16464 was part of the picture and I said it was. He told me it was very likely the ZeroAccess rootkit and said he'd created an Indicator of Compromise (IOC) for use with Redline to detect it. He pointed me to a location on disk where I would likely find files related to the infection and they were there. I happily accepted an offer to try out the IOC and returned the test results when Redline finished creating the report. The IOC had hit on several items in this collection and I would declare it a success. He has a blog post up on the DFIR Journal blog talking about this test and how the IOC was put together.
I collected some network traffic using WireShark on a Linux laptop I connected to the network with a hub. I haven't had time to review that traffic yet, but plan to later this week. I then rebooted the machine and loaded SMART for Linux from a live Ubuntu Linux CD-Rom. I imaged the hard drive and then once again rebooted, this time to a BitDefender Antivirus live CD. It found quite a few trojan's and deleted them for me. I tried booting to a Microsoft Security Essentials live CD, but it would never load
I finally rebooted back to the installed Windows XP OS and ran GMER to look for any further signs of rootkits. None found, I ran ComboFix and later, MalwareBytes. I removed the installed antivirus (10 year old copy of Norton Corporate) and installed Microsoft Security Essentials. The cleanup had left a few malware related files behind and I removed them manually.
Since that day, a close eye has been kept on the network logs and no further sign of malware phoning home has been seen. Through further scans with the ESET Online Scanner and others, the system does seem to be clean. I do plan to make a forensic timeline and further investigate the memory image, hard drive image and network traffic as time allows. The business is in no hurry for results and I have other "paying" cases to get done first. I'll add a new post here if and when I find something of value.
So, all this started with someone knowing what "normal" was and, even better, knowing when they weren't seeing it. The simple act of reviewing boring logs every day helped find and fix the problem. Kinda cool, don't ya think?
I had the opportunity last week to help out a local business tracking down strange issues on their network. It's a small business and they have no actual IT staff. Rather, some of the employees try to manage things as best they can and call in help when a problem is beyond their ability to fix. The business runs an Untangle router/firewall and it automatically sends an email each day to an employee with stats for the previous day. On this day, the employee noticed that their network traffic was more than double what he expected to see on a "normal" day.
The week of Patch Tuesday is one of those times the employee expects to see a rise in network traffic when the 15 computers in the business receive their updates. On a typical workday, the network normally sees about 1.0 to 1.1 gigabytes of traffic. On this particular workday, the traffic rose to 2.47 gigabytes without any obvious reason. The employee knew something was wrong, but he didn't know what. Things just weren't "normal."
I was given access to the Untangle control panel and I began looking at the event logs for each section. I found nothing remarkable until I opened the panel for Application Control Lite. This section monitors various network protocols for applications like chat programs, peer to peer networking, etc. I was sure I found the problem as soon as I looked at the protocol logs. One workstation on the network was making repeated attempts to make contact with a UK IP address via the Soulseek peer to peer networking protocol. This was definitely not normal
A look at other system reports showed the second most popular destination port through the Untangle gateway was port 16464 (port 80, naturally, was number 1). Once again, not normal.
I went to the troublesome computer and found a fake antivirus program on it. I decided to create an agent using Mandiant Redline to collect volatile data and a memory image prior to beginning cleanup. My plan was to use Redline to examine the data it collected and then later use the awesome Volatility Framework to continue studying the data.
While waiting for the Redline agent to finish, I posted a tweet that I was dealing with an apparent malware infection using a peer to peer protocol to commnicate out of the network. One of my friends, @dfirn00b asked if a port in the area of 16464 was part of the picture and I said it was. He told me it was very likely the ZeroAccess rootkit and said he'd created an Indicator of Compromise (IOC) for use with Redline to detect it. He pointed me to a location on disk where I would likely find files related to the infection and they were there. I happily accepted an offer to try out the IOC and returned the test results when Redline finished creating the report. The IOC had hit on several items in this collection and I would declare it a success. He has a blog post up on the DFIR Journal blog talking about this test and how the IOC was put together.
I collected some network traffic using WireShark on a Linux laptop I connected to the network with a hub. I haven't had time to review that traffic yet, but plan to later this week. I then rebooted the machine and loaded SMART for Linux from a live Ubuntu Linux CD-Rom. I imaged the hard drive and then once again rebooted, this time to a BitDefender Antivirus live CD. It found quite a few trojan's and deleted them for me. I tried booting to a Microsoft Security Essentials live CD, but it would never load
I finally rebooted back to the installed Windows XP OS and ran GMER to look for any further signs of rootkits. None found, I ran ComboFix and later, MalwareBytes. I removed the installed antivirus (10 year old copy of Norton Corporate) and installed Microsoft Security Essentials. The cleanup had left a few malware related files behind and I removed them manually.
Since that day, a close eye has been kept on the network logs and no further sign of malware phoning home has been seen. Through further scans with the ESET Online Scanner and others, the system does seem to be clean. I do plan to make a forensic timeline and further investigate the memory image, hard drive image and network traffic as time allows. The business is in no hurry for results and I have other "paying" cases to get done first. I'll add a new post here if and when I find something of value.
So, all this started with someone knowing what "normal" was and, even better, knowing when they weren't seeing it. The simple act of reviewing boring logs every day helped find and fix the problem. Kinda cool, don't ya think?
Sunday, July 1, 2012
Back from the Summit
What a week this has been! I attended the SANS Digital Forensics and Incident Response Summit in Austin, Texas this week and had an amazing time. I told Rob Lee I didn't think he and the SANS team could top last year's Summit, but somehow they managed to do it. That doesn't diminish the last year's outstanding conference by any means. Rather, they just raised the bar for such gatherings. Kudos to Rob and everyone at SANS for truly doing a fantastic job. Also, thank you very much to my friend Andrew Case for making it possible for me to be there.
The quality of the presentations was very good. I was familiar with most of the presenters and expected no disappointment. I won't review them all, as that has been done on other blogs. The only downside, if you will, was with simultaneous presentations going on in two tracks, it was hard to attend every talk you wanted to see. That's not really a complaint, as having two tracks certainly gave a lot more people the opportunity to present and allowed for a wide range of topics. Fortunately, SANS maintains Summit archives.
One of the talks I did want to mention was the opening day keynote by Cindy Murphy, the Forensic Forecast Digital Forensic Examiner of the Year. I've never heard more post-talk discussion about a keynote speech at any conference. I heard many high praises for the speech from everyone I talked to. It was obvious she had put a lot of thought and heart into it. I want to congratulate her on an awesome speech and her well deserved award. Congrats Cindy, I'm really proud of you!
I also wanted to mention the talks by Andrew Case on Mac Memory Analysis and Sarah Edwards entitled "When Macs Get Hacked" were excellent. I know little about the Macintosh system, but they both did a great job relating the material to those of us without a heavy Apple background.
Finally, Melia Kelley and Alissa Torres both rocked the place in their respective talks. They are awesome presenters and I hope to have the opportunity to see them present again.
It was cool seeing so many women on the stage this year. I respect and admire each of them so much and am happy to see them stepping to the forefront in this field. They've always been there, they just haven't always gotten the recognition they deserve.
Something I really wanted to talk about, though, has nothing to do with computers or forensics. I want to tell you what an awesome group of people I was privileged to spend time with while at the Summit. As Cindy mentioned, it's so great to be around people who "get" you. The camaraderie I experienced this week with people I truly respect and look up to was amazing. Some I'd met face to face previously, while some I "knew" online only. I was also happy to meet some people I hadn't known previously and I hope to maintain a lasting friendship with them as well.
As you may have guessed, my time in Austin was greatly enjoyed. It was fantastic seeing my close friends Joe Garcia and Brad Garnett again. The three of us have spent a lot of time together over the last couple years, both online and off and I really enjoyed "getting the band back together".
The opportunities for networking are always one of the best things about a conference. I'm not talking about "looking for a job" networking necessarily, although that can come about as well. The networking I'm talking about is the kind where you gain good friends; people you can count on when you need help and having the chance to be there for them when needed. Of the SANS events I've been too over the last few years, I can say that type of networking is never in short supply. Kudos to the people at SANS for knowing how to balance the program with the networking to make an event that results in both learning and friendship.
The quality of the presentations was very good. I was familiar with most of the presenters and expected no disappointment. I won't review them all, as that has been done on other blogs. The only downside, if you will, was with simultaneous presentations going on in two tracks, it was hard to attend every talk you wanted to see. That's not really a complaint, as having two tracks certainly gave a lot more people the opportunity to present and allowed for a wide range of topics. Fortunately, SANS maintains Summit archives.
One of the talks I did want to mention was the opening day keynote by Cindy Murphy, the Forensic Forecast Digital Forensic Examiner of the Year. I've never heard more post-talk discussion about a keynote speech at any conference. I heard many high praises for the speech from everyone I talked to. It was obvious she had put a lot of thought and heart into it. I want to congratulate her on an awesome speech and her well deserved award. Congrats Cindy, I'm really proud of you!
I also wanted to mention the talks by Andrew Case on Mac Memory Analysis and Sarah Edwards entitled "When Macs Get Hacked" were excellent. I know little about the Macintosh system, but they both did a great job relating the material to those of us without a heavy Apple background.
Finally, Melia Kelley and Alissa Torres both rocked the place in their respective talks. They are awesome presenters and I hope to have the opportunity to see them present again.
It was cool seeing so many women on the stage this year. I respect and admire each of them so much and am happy to see them stepping to the forefront in this field. They've always been there, they just haven't always gotten the recognition they deserve.
Something I really wanted to talk about, though, has nothing to do with computers or forensics. I want to tell you what an awesome group of people I was privileged to spend time with while at the Summit. As Cindy mentioned, it's so great to be around people who "get" you. The camaraderie I experienced this week with people I truly respect and look up to was amazing. Some I'd met face to face previously, while some I "knew" online only. I was also happy to meet some people I hadn't known previously and I hope to maintain a lasting friendship with them as well.
As you may have guessed, my time in Austin was greatly enjoyed. It was fantastic seeing my close friends Joe Garcia and Brad Garnett again. The three of us have spent a lot of time together over the last couple years, both online and off and I really enjoyed "getting the band back together".
The opportunities for networking are always one of the best things about a conference. I'm not talking about "looking for a job" networking necessarily, although that can come about as well. The networking I'm talking about is the kind where you gain good friends; people you can count on when you need help and having the chance to be there for them when needed. Of the SANS events I've been too over the last few years, I can say that type of networking is never in short supply. Kudos to the people at SANS for knowing how to balance the program with the networking to make an event that results in both learning and friendship.
Tuesday, March 20, 2012
From the All's Well That Ends Well department
Hello all, it's me with another drive by blog post.Yes, it really has been 7 months since my last post here. I won't be surprised if no one ever reads this. Time for writing or, for that matter, almost anything else, has been in short supply. Between my regular job and teaching at Lincoln Trail College I really haven't had the time to devote to testing and writing.
I took on a data recovery job recently that allowed me to practice my forensics skills a bit. The end result was rather humorous to me. I was asked to recover two missing Excel spreadsheets from a Windows 7 laptop computer. The owner told me the two spreadsheets had been saved to both the user's desktop, as well as a usb jump drive. These spreadsheets had important data and it would take a very long time to recreate them, so of course the owner was very interested in recovering them. He gave me the laptop, but didn't have the usb drive with him, so he said he would bring it to me the next day. I assumed this was going to be an easy job and it was.....sort of.
I took the laptop to my home office and hooked its hard drive up to my analysis system via a Wiebetech Ultradock v4. I started X-Ways Forensics, created a new case and brought the drive in to the case, followed by creating a forensic image and replacing the drive in the case with the newly created image. I selected Refine Volume Snapshot in X-Ways and set it up to do a particularly thorough file system data structure search and a file header signature search in hopes of carving out the missing files from unallocated space. Upon completion, I found no sign of the missing files.
Upon receipt of the 124 mb Lexar brand usb drive, I imaged it and added it to my X-Ways case. Following the same procedures as above, I expected I would find the missing files. No dice. Nada. Nothing.
The owner of the files had been quite certain the files had been in the two locations previously described. I decided I would look at the volume shadow copies from around the time the files went missing and see if I could locate anything. I used the VHD method of accessing the VSC's as presented by Harlan Carvey in Windows Forensic Analysis 3E and also as he presented in the DFIR Online session back in December. This method worked like a charm, but once again the data failed to be where I expected it.
About to give up, I realized I had failed to do something fairly obvious. I checked the Recent folder in Users\user\appdata\microsoft\windows\ to see if I could determine where the spreadsheets had been accessed from in the first place. I found lnk files for both spreadsheets in the Recent folder and they both had been opened from the "G:" drive, which I at first assumed to be the Lexar usb drive. I looked further into the lnk files and found the volume name of the G: drive had been Cruzer, which I knew to be the name for various SanDisk drives, not Lexar drives. I checked the volume name on the Lexar drive and it was not Cruzer.
I called the owner and asked if there was any chance at all the files had been saved to a different usb drive, possibly a SanDisk Cruzer. He didn't think so at first, but had such a drive in his pocket. He inserted it into a computer at his office and guess what....there were the two files!
This certainly wasn't your traditional data recovery, but in the end it worked out. I never did find any evidence the files had been saved on the laptop hard drive, but at least they got their files "back". Even though the files were never really gone, they were gone as far as the owner knew and a lot of work would have been done to recreate them if not for the use of digital forensic analysis. So, as mentioned in the title of this post, all's well that end's well.
Finally, I wanted to mention two awesome books I got recently. As previously mentioned, Windows Forensic Analsys 3E came out and I have been reading it. This version is a companion to WFA 2E and has lots of great info on volume shadow copies, file analysis, malware detection and much more. Harlan has never written a bad book as far as I'm concerned. Each one has excellent and well researched info of use to the forensics/IR crowd.
Also, another great book I got recently is Practical Malware Analysis. I've only had time to read the first couple chapters, but I love this book. It is so well written and easy to follow. Given the potential difficulty of learning this material, Michael Sikorski and Andrew Honig did a fantastic job writing it in a way that noobs and veterans alike can learn from it.
I'm hoping it won't be another 7 months before I post again. I'm going to try to make time to write now and then, but we'll see.
I took on a data recovery job recently that allowed me to practice my forensics skills a bit. The end result was rather humorous to me. I was asked to recover two missing Excel spreadsheets from a Windows 7 laptop computer. The owner told me the two spreadsheets had been saved to both the user's desktop, as well as a usb jump drive. These spreadsheets had important data and it would take a very long time to recreate them, so of course the owner was very interested in recovering them. He gave me the laptop, but didn't have the usb drive with him, so he said he would bring it to me the next day. I assumed this was going to be an easy job and it was.....sort of.
I took the laptop to my home office and hooked its hard drive up to my analysis system via a Wiebetech Ultradock v4. I started X-Ways Forensics, created a new case and brought the drive in to the case, followed by creating a forensic image and replacing the drive in the case with the newly created image. I selected Refine Volume Snapshot in X-Ways and set it up to do a particularly thorough file system data structure search and a file header signature search in hopes of carving out the missing files from unallocated space. Upon completion, I found no sign of the missing files.
Upon receipt of the 124 mb Lexar brand usb drive, I imaged it and added it to my X-Ways case. Following the same procedures as above, I expected I would find the missing files. No dice. Nada. Nothing.
The owner of the files had been quite certain the files had been in the two locations previously described. I decided I would look at the volume shadow copies from around the time the files went missing and see if I could locate anything. I used the VHD method of accessing the VSC's as presented by Harlan Carvey in Windows Forensic Analysis 3E and also as he presented in the DFIR Online session back in December. This method worked like a charm, but once again the data failed to be where I expected it.
About to give up, I realized I had failed to do something fairly obvious. I checked the Recent folder in Users\user\appdata\microsoft\windows\ to see if I could determine where the spreadsheets had been accessed from in the first place. I found lnk files for both spreadsheets in the Recent folder and they both had been opened from the "G:" drive, which I at first assumed to be the Lexar usb drive. I looked further into the lnk files and found the volume name of the G: drive had been Cruzer, which I knew to be the name for various SanDisk drives, not Lexar drives. I checked the volume name on the Lexar drive and it was not Cruzer.
I called the owner and asked if there was any chance at all the files had been saved to a different usb drive, possibly a SanDisk Cruzer. He didn't think so at first, but had such a drive in his pocket. He inserted it into a computer at his office and guess what....there were the two files!
This certainly wasn't your traditional data recovery, but in the end it worked out. I never did find any evidence the files had been saved on the laptop hard drive, but at least they got their files "back". Even though the files were never really gone, they were gone as far as the owner knew and a lot of work would have been done to recreate them if not for the use of digital forensic analysis. So, as mentioned in the title of this post, all's well that end's well.
Finally, I wanted to mention two awesome books I got recently. As previously mentioned, Windows Forensic Analsys 3E came out and I have been reading it. This version is a companion to WFA 2E and has lots of great info on volume shadow copies, file analysis, malware detection and much more. Harlan has never written a bad book as far as I'm concerned. Each one has excellent and well researched info of use to the forensics/IR crowd.
Also, another great book I got recently is Practical Malware Analysis. I've only had time to read the first couple chapters, but I love this book. It is so well written and easy to follow. Given the potential difficulty of learning this material, Michael Sikorski and Andrew Honig did a fantastic job writing it in a way that noobs and veterans alike can learn from it.
I'm hoping it won't be another 7 months before I post again. I'm going to try to make time to write now and then, but we'll see.
Saturday, August 13, 2011
Interesting Malware Trick
Sometimes it's hard to keep from admiring the tricks the various malware purveyors come up with. A couple days ago, my friend Luby (Luby Warning Luby Warning Luby Warning) sent me a malware sample he'd received as an email attachment. The filename was "Changelog_08_08_201atdoc" and its icon gave it the appearance of being a Microsoft Word document:
It would be easy to see that icon and not notice the "doc" part of the filename had no dot between it and the rest of the name to make a proper filename extension. Fortunately, Luby knows better than to open such an attachment and he started looking into it further, hashing it with FTK Imager. He noticed that when viewing the spreadsheet produced by FTK Imager, that the filename appeared as "Changelog_08_08_201at[U+202E]
He did some research and found that the characters within the brackets represent a Unicode Right to Left Override, where anything after the inserted Unicode control character is reversed in the way it is displayed. Thus, the "cod.exe" is displayed as "exe.doc" but the system still knows what it is and executes it when you double click it. You can read about similar uses of Unicode in this Microsoft Malware Protection Center blog post that came out the same day I received the file from Luby.
I'm sure this is nothing new to many people, but I must admit I'd never heard of such a thing. Like I said above, it's almost hard to keep from admiring cool tricks, but then I remember the reason for the trick and it's not so cool.
I found the executable file was packed with the UPX packer. I uploaded it to Virustotal and found 32 of the virus checkers there recognized the file as malicious:
Notice most everything listed under the File name (Submission date, Current Status, etc) is backwards. The Unicode in the file name even affected the VirusTotal display.
Not satisfied with what I'd found so far, I executed the malware file in a Windows XP virtual machine and obtained an image of RAM using the new free tool from Moonsols called DumpIt. I'd been wanting a good opportunity to try out DumpIt and this seemed like as good as any.
I saved the RAM image and moved to my analysis machine where I proceeded to examine it with the awesome Volatility Framework. I decided to obtain a copy of the unpacked executable from RAM and Volatility is perfect for that, using the procexedump plugin. After obtaining the unpacked executable, I uploaded it to VirusTotal and found this:
Only 10 out of 43 antivirus products on VirusTotal recognized the unpacked malware. I thought that was kind of interesting. My AV of choice was one of those that didn't recognize it in either the packed or unpacked versions, so I submitted both samples to them so signatures could be created (signatures for both now exist for Vipre Antivirus).
I searched online for some of the names given for this malware by the various AV vendors and only found a little information. I submitted the packed version of the malware to ThreatExpert.com and got a good report. Instead of me retyping it, you can have a look here: ThreatExpert Report.
By the way, I checked the headers from the original email sent to Luby and found it came from Austria. I'm planning to spend a little more time looking at this file soon, but have a couple other projects to take care of first. If I find anything new and interesting, I'll be sure to post about it.
Addendum: I wanted to give the MD5 of the packed exe for those who create their own signatures: FE84E712F52AF7B0F0F3FC58296FEE00.
Addendum: I wanted to give the MD5 of the packed exe for those who create their own signatures: FE84E712F52AF7B0F0F3FC58296FEE00.
Friday, July 29, 2011
Cheat Sheets
Mark Morgan has a couple of intrusion discovery cheat sheets over on his blog. He has one for Windows XP Pro, Server 2003 and Vista, along with a separate one for investigating Linux machines. I really appreciate him taking the time to do these and make them available. I always enjoy seeing how people approach their investigations and adapting their methods to my work when possible. Lenny Zeltser also has some great Information Security cheat sheets over on his site.
My good buddy Joe Garcia has a review of Windows Registry Forensics over on the CyberCrime 101 blog. Nice job Joe!
I've been beta testing a new tool called Registry Decoder for Windows Registry parsing and searching. Registry Decoder is being developed by Andrew Case and Vico Marziale over at Digital Forensics Solutions. It's plugin based and has a nice search function as well. It's still in early beta stage and not ready for prime time, but I can definitely see it will be a fine addition to my forensic toolbox.
I've been spending a lot of my off time studying for the Network+ exam and hope to take it in the near future. I've also taken the time lately to set up a couple of Untangle firewall/router machines, one at home and another for my employer. I'll be talking more about all of that later.
That's it for now. Everyone stay safe!
My good buddy Joe Garcia has a review of Windows Registry Forensics over on the CyberCrime 101 blog. Nice job Joe!
I've been beta testing a new tool called Registry Decoder for Windows Registry parsing and searching. Registry Decoder is being developed by Andrew Case and Vico Marziale over at Digital Forensics Solutions. It's plugin based and has a nice search function as well. It's still in early beta stage and not ready for prime time, but I can definitely see it will be a fine addition to my forensic toolbox.
I've been spending a lot of my off time studying for the Network+ exam and hope to take it in the near future. I've also taken the time lately to set up a couple of Untangle firewall/router machines, one at home and another for my employer. I'll be talking more about all of that later.
That's it for now. Everyone stay safe!
Monday, July 25, 2011
Upcoming Class
I've seen posts by several people as of late talking about digital forensic classes they'll be teaching in which they plan to use Digital Forensics with Open Source Tools for the text book. I mentioned in my review that I thought it would be a good book for introductory digital forensics courses and it seems others felt the same way. I'm happy to say that I'll be teaching a brand new DF course starting in the Spring, 2012 semester at Lincoln Trail College and I'm planning to use DFwOST as my text book as well. When I was first asked to teach this course, I started trying to decide on a good book that beginners and those with some experience would benefit from that I felt would cover all the topics I wanted covered. DFwOST is definitely that book.
On a related note, I'll be teaching Computer Ethics at LTC beginning in the Fall, 2011 semester. This course is required if the student is pursuing the Computer Forensics certificate. I'll be using Ethics for the Information Age by Michael J. Quinn as the text book. I've only had a short time to look at the book, but it looks like it's going to cover the topic very well.
I'm very excited to be teaching for the very first time and hope I will do a good job at it. I've never taught before and was pretty surprised when I was contacted by the college.
On a related note, I'll be teaching Computer Ethics at LTC beginning in the Fall, 2011 semester. This course is required if the student is pursuing the Computer Forensics certificate. I'll be using Ethics for the Information Age by Michael J. Quinn as the text book. I've only had a short time to look at the book, but it looks like it's going to cover the topic very well.
I'm very excited to be teaching for the very first time and hope I will do a good job at it. I've never taught before and was pretty surprised when I was contacted by the college.
Subscribe to:
Posts (Atom)