SANS Digital Forensics and Incident Response Blog: Category - Computer Forensics

High Tech Crime Investigators Conference 2011 Report, Anonymous Promises Retaliation, DigiNotar Dies

The 25th High Technology Investigators Conference was held last week near Palm Springs California last week. Your SANS Forensic blogger attended the event, along with over 500 fellow lethal, and aspiring lethal, forensicators. Information security events like BlackHat, DefCon and RSA drawing thousands. It's more difficult to really get to know one's colleagues at those … Continue reading High Tech Crime Investigators Conference 2011 Report, Anonymous Promises Retaliation, DigiNotar Dies


NTFS $I30 Index Attributes: Evidence of Deleted and Overwritten Files

Daunting as it may seem, one of the most wonderful aspects of Windows forensics is its complexity. One of the fascinating aspects of digital forensics is how we often leverage conventional operating system features to provide information peripheral to their original design. One such feature is the Windows NTFS Index Attribute, also known as the … Continue reading NTFS $I30 Index Attributes: Evidence of Deleted and Overwritten Files


Digital Forensics Case Leads: Registry Forensics, Volume Shadow Copies and Windows 8

It's the "better late than never" edition of Case Leads and I've got lots of great stuff for you this week. Lots of great articles and papers to read, including a very cool post by Andrew Case on recovering registry hives from a system that's been reformatted and had the OS reinstalled, as well as … Continue reading Digital Forensics Case Leads: Registry Forensics, Volume Shadow Copies and Windows 8


Shadow Timelines And Other VolumeShadowCopy Digital Forensics Techniques with the Sleuthkit on Windows

Creating Digital Forensic Filesystem Timelines From Multiple Windows Volume Shadow Copies

Introduction to Shadow Timelines:

This past weekend I was upgrading the SIFT Workstation to the new version and I realized I had not used the Windows version of the Sleuthkit tools in awhile. I usually demonstrate in class that many of the sleuthkit tools can work directly against the logical partitions of a Physical Hard Drive (e.g. \\.\\C:, \\.\\D:). It occurred to me that I had never tried to use the filesystem parser and timeline generator fls on a Windows Vista, Windows 7, or Windows 2008 Server ShadowCopyVolume.

We have known for some time now that you can image a Shadow Volume. I wrote a

...


Advanced Forensic Training in Asia Pacific

If you are in the Asia Pacific region, don't miss Singapore SOS October 10-18, 2011! We are bringing two of our most advanced forensics courses to the island nation. Forensics 508: Advanced Computer Forensic Analysis and Incident Response with Chad Tilbury Master advanced incident response and computer forensics tools and techniques to investigate data breach … Continue reading Advanced Forensic Training in Asia Pacific