SANS Digital Forensics and Incident Response Blog: Category - Computer Forensics

Memory Forensics Cheat Sheet

I recently wrote on my personal blog about some of the new updates to the SANS Forensics 508 course and included a link to a new memory forensics cheat sheet. By popular request, I am posting a PDF versionof the cheat sheet here on the SANS blog. Feedback is appreciated! Chad Tilbury, GCFA, has … Continue reading Memory Forensics Cheat Sheet


Digital Forensic Case Leads: Medical Records Get Hacked, #DFIR Index, New and Updated Tools and More....

In this edition of SANS Case Leads we have petabytes of #DFIR tools, reads, news, and levity to stimulate your analytical juices and warm up your processors. Get your dongles out cause' AccessData has updates and we got more breaches to investigate! Dongleless? I got you covered with a brew of Python, Perl and EXE … Continue reading Digital Forensic Case Leads: Medical Records Get Hacked, #DFIR Index, New and Updated Tools and More....


Digital Forensics Case Leads: log2timeline, DFIR dogs, and cybersemantics

This week brings us a new version of log2timeline, Cindy Murphy explaining how we're all like dogs (it's not a bad thing, I swear), and Kyle Maxwell wading into the murky semantic waters of APT, cyberwar, and hackers. Just to tweak Kyle, I'll dub that part cybersemantics. You can also learn what Facebook turns over … Continue reading Digital Forensics Case Leads: log2timeline, DFIR dogs, and cybersemantics


Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 3)

Application Specific Geo-location Web applications can often leave their own geo-location clues similar to those found via the mapping services. While mapping artifacts are largely consistent, geo-artifacts created by applications are more haphazard. Thus the number of available artifacts can be as numerous as the applications using geo-location services. To illustrate this, we will analyze … Continue reading Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 3)


April 19th: Community Night at SANS NoVA!

Mike Wilkinson's DFIROnline Meetups continue to provide huge value to the community. The next one happens to fall on April 19th, during the SANS Northern Virginia event. We thought it would be fun to provide a space for people to gather and mingle while watching the presentations. If you happen to be in the area, … Continue reading April 19th: Community Night at SANS NoVA!