SANS Digital Forensics and Incident Response Blog

Digital Forensics Case Leads: New REMnux, Registry tools and more APT1 analysis

This week in Case Leads we have a great new update to REMnux, two new tools for registry analysis and be sure to vote for the Forensic 4cast Awards right after you hop over to the new REM community on Stack Exchange.

If you have an item you'd like to contribute to Digital Forensics Case Leads, please send it to


Good Reads:




Coming Events:

Call For Papers:

Digital Forensics Case Leads is a (mostly) weekly publication of the week's news and events relating to digital forensics. If you have an item you'd like to share, please send it to

Digital Forensics Case Leads for 20130413 was compiled by Rob Dewhirst (@robdew) GCFA, GCIH, GREM CISSP. Rob is a security analyst and CSIRT lead for a Tier I research University in the midwest and a private DFIR consultant.


Posted April 15, 2013 at 12:24 PM | Permalink | Reply


The download link for the compiled version of autorunner doesn't work anymore on the author's site, sad thing''

Posted April 15, 2013 at 2:51 PM | Permalink | Reply

H. Carvey

Corey's post isn't the only one available regarding providing descriptions of plugins.
For a complete list, go here:

Posted April 15, 2013 at 6:57 PM | Permalink | Reply

Rob Dewhirst

If you search Mark's Github profile you can find autorunner here: