SANS Digital Forensics and Incident Response Blog

Digital Forensics Case Leads: Multi-plat RAT, No US Cybersecurity bill, Dropbox drops a doozie, Volatility everywhere

This week we found out the NetWire Remote Access Trojan claims to be able to infect everyone, the US Senate has blocked a much-debated cybersecurity bill, Dropbox shows it's great way to share the confidential data of Dropbox customers, British Telecom says somewhere between 100% and 0% of Android devices are compromised and cybercrime costs somewhere between $1 trillion and $0.

If you have an item you'd like to contribute to Digital Forensics Case Leads, please send it to


Good Reads:



Coming Events:

Call For Papers:


Digital Forensics Case Leads is a (mostly) weekly publication of the week's news and events relating to digital forensics. If you have an item you'd like to share, please send it to

Digital Forensics Case Leads for 20120803 was compiled by Rob Dewhirst (@robdew) GCFA, GCIH, CISSP. Rob is a security analyst and CSIRT lead for a Tier I research University in the midwest and a private DFIR consultant.


Posted August 3, 2012 at 4:25 PM | Permalink | Reply

Harlan Carvey

One thing I've always been curious about is the purpose of the Case Leads. Is the purpose to provide links, and nothing else?
I guess I'm always just interested to know why the person posting the link found it to be interesting. Is there some way that those posting Case Leads can provide insight as to why they thought it was a "lead" worth following?