SANS Digital Forensics and Incident Response Blog: Category - Computer Forensics

Digital Forensic Case Leads: Report from the Forensic Expert Witness Conference, Judge: Viewing CP might NOT be possession, Mac crypto bug helps forensicators

Welcome to Digital Forensics Case Leads. Another a busy week in digital forensics, incident response and the law. In this edition: The SANS Computer Forensics Blog was at the Forensic Expert Witness Annual Conference, and your humble reporter asked a seasoned member of the bench: What is it like for a Judge to sit on … Continue reading Digital Forensic Case Leads: Report from the Forensic Expert Witness Conference, Judge: Viewing CP might NOT be possession, Mac crypto bug helps forensicators


Writing Malware Reports

One of the more common questions that people ask in the FOR610 (reversing) class is about writing malware reports. Specifically what should go into a malware report? The Guiding Principle When I get asked this question my first response is usually "well why did you do the exam?" Besides potentially being a bit cheeky, the … Continue reading Writing Malware Reports


Digital Forensic Case Leads Getting caught via metadata, A Forensic Guide to Windows 8 and the New DFIR Wall Poster.

This week in Case Leads Apples security questions, Hacker gets caught via metadata, A DFIR wall poster will be available, a guide to Windows 8 forensics, a few tools have been updated and watching 182 superhero movies in under 5 minutes. If you have an item you'd like to contribute to Digital Forensics CaseLeads, please … Continue reading Digital Forensic Case Leads Getting caught via metadata, A Forensic Guide to Windows 8 and the New DFIR Wall Poster.


SANS DFIR Wall Poster Preview

The SANS DFIR Wall Poster is complete. The poster is our first dedicated specifically for Digital Forensics and Incident Response analysts. The poster will be sent to your home as a part of the SANS NS2012 course catalog. How Do I Receive the Poster? To sign up to receive the poster automatically, you will need … Continue reading SANS DFIR Wall Poster Preview


Digital Forensics Case Leads: MBR Parser, VSC Toolset GUI, Memory Forensics Cheat Sheet & other goodness......

In this week's SANS Case Leads, we have a python script for parsing the Master Boot Record, a question of USB drive serial number uniqueness, some VSC goodness and some other stuff ;-) If you have an item you'd like to contribute to Digital Forensics Case Leads, please send it to caseleads@sans.org Tools: Jamie Levy … Continue reading Digital Forensics Case Leads: MBR Parser, VSC Toolset GUI, Memory Forensics Cheat Sheet & other goodness......