SANS Digital Forensics and Incident Response Blog

Digital Forensics Case Leads: Arrests galore between Hackers and "Operation Nanny", Updated tools and more.

This week in Case Leads numerous hackers were arrested as well as a online pedophile ring was disbanded. One new tool for flash analysis is out as well as updates to existing tools. A case study as well as working with the SIFT workstation and a quiz to solve using proper pirate Arrgot round everything out.

If you have an item you'd like to contribute to Digital Forensics Case Leads, please send it to


  • Peleus Uhley over at Adobe has released a tool for SWF disassembly/analysis and it is Open Source. It can be found here.
  • Didier Stevens has released TaskManager.xls which is a simple taskmanager implemented in Excel/VBA, the new update has memory usage statistics and supports 64 bit.
  • Simple Carver Suite released a new version, version 4.6, a new program called File Fragmenter can be used to test how applications handle incomplete files, it will create subsets of files based on actual good files.
  • Oxygen Software has updated Oxygen Forensic Suite 2012 to version 4.1.

Good Reads:



Coming Events:

Call For Papers:


Digital Forensics Case Leads is a (mostly) weekly publication of the week's news and events relating to digital forensics. If you have an item you'd like to share, please send it to

Digital Forensics Case Leads for 20120309 was compiled by Mark McKinnon GCFA, CCE is Principal of RedWolf Computer Forensics where he has written many tools that are used throughout the Computer Forensic Community. You can follow Mark on twitter @markmckinnon.