SANS Digital Forensics and Incident Response Blog

New version of Nmap, 60TB hard drives on the way, attacker trends, & a dissected web attack

This week's edition of Case Leads features updates to a popular network scanning tool and another application which may be useful in gaining access to encrypted documents. We also have an article detailing a recent attack against a website and a couple of papers that look at attack trends. There's news that hard drives could approach 60TB and a report that a popular paste site will change its approach in how it manages sensitive content.

As always, if you have an item you'd like to contribute to Digital Forensics Case Leads, please send it to


  • Nmap 6 has been released. In addition to improvements in web scanning, overall scanning speed and the scripting engine, this popular scanner now fully supports IPv6.
  • Passware released Passware Kit Forensic 11.7 which includes memory capture and analysis for recovering various types of encryption keys. The software acquires the memory image over the Firewire port and focuses on identifying artifacts which enables the decryption of numerous types of files and storage.

Good Reads:

  • Dissecting a Hacktivist Attack. Imperva has a write up that explains the compromise of through the use of RFI (Remote File Inclusion.)
  • Email attack trends for Q1 2012. Based on data collected by FireEye for the first quarter of 2012, an organization is more likely to be attacked during the middle of the week than on weekends.
  • Advances in technology could push hard drive capacities to 30 - 60TB in a few years. By 2016, technology such as Heat Assisted Magnetic Recording (HAMR) should help double the areal density of drives making it possible to produce 3.5-inch drives up to 60TB and laptop drives in the 10 - 20TB range.



Coming Events:

Call For Papers:


Digital Forensics Case Leads is a (mostly) weekly publication of the week's news and events relating to digital forensics. If you have an item you'd like to share, please send it to

Digital Forensics Case Leads for 20120525 was compiled by Ray Strubinger. Ray regularly leads digital forensics and incident response efforts and when the incidents permit, he is involved in aspects of information security ranging from Data Loss Prevention to Risk Analysis.