SANS Digital Forensics and Incident Response Blog

Digital Forensics Case Leads: Email Scammers, Android Malware, DoS Against Banks, Tool Updates And A Few Good Reads.

In this issue of Case Leads with have Android Malware increase, DoS Attacks on Czech Banks, some updates to Oxygen Forensics Suite and a New tool from Magnet Forensics and a little levity.

If you have an item you'd like to contribute to Digital Forensics Case Leads, please send it to


  • Oxygen Forensics Suite have released version 5.1.1. Some of the new features include aupport for Windows 8. Added support for Opera Mini and Opera Mobile for Android. Many other enhancements and improvements as well.
  • Passware is now integrated in Oxygen Forensic Suite to provide a joint solution to mobile device investigations.
  • Magnet Forensics has release a new tool called IEF Frontline which will provide investigators with a "quick look" at digital media.

Good Reading and Listening

  • Lance Mueller has a good post over at where he has created a Enscript that will parse the file. Using this enscript you can easily parse out all the USB insertion events.
  • Harlan Carvey has a post over on his blog Windows Incident Response Blog that talks about WOW6432Node registry redirection. In Harlans words if we are not looking at this then we need to. This is just one more area we need to make sure that we look at when we do registry analysis, if you are not looking in this area then you are potentially only getting half the picture when you are examining 64bit windows systems.
  • Eric Huber over at the Fist Full of Dongles blog recently posted about Microsoft Windows File System Tunneling. This is something that forensic examiners should be aware of and should also be tested in Windows 7 and 8 as the research Eric did was on Windows XP.
  • The register has a good article about Rear Admiral Grace Hopper. Anyone who does not know who she is should read this ad learn a little about this amazing woman.


  • Climbing the corporate ladder BOFH style.

Coming Events:

Call For Papers:

Digital Forensics Case Leads is a (mostly) weekly publication of the week's news and events relating to digital forensics. If you have an item you'd like to share, please send it to

Digital Forensics Case Leads for 20121130 was compiled by Mark McKinnon (@markmckinnon) CCE, GCFA. Mark is a Software Developer and Instructor at a University in the Midwest where he also practices digital forensics.


Posted March 12, 2013 at 10:37 PM | Permalink | Reply

DMS Computer Forensics

I had only heard about one or two of those tools you mentioned, the rest were new to me. Thanks for sharing, I'll be investigating them and seeing if they are appropriate for me to integrate.