SANS Digital Forensics and Incident Response Blog: Category - Computer Forensics

Erasing drives should be quick and easy

In the past years, I have seen many many false and misleading statements about what is needed to securely erase or wipe a hard drive. The FUD surrounding this topic with many still purporting to have a means of recovering data using SEMs and AFM (electron microscopy will do) is incredible. The problem is that … Continue reading Erasing drives should be quick and easy


Digital Forensics: PS3 Linux file system analysis and network forensics

Let me start by noting how much fun I had while investigating and analyzing everything for this forensics challenge, I was able to apply many different techniques, from analyzing logs to file carving and network forensics. It's the 2009 forensics challenge from DFRWS and you can find the description, system images and pcap files at … Continue reading Digital Forensics: PS3 Linux file system analysis and network forensics


Digital Forensics Case Leads: REMnux, Stuxnet, Facebook and more

This week we have Lenny Zeltser releasing his awesome tool REMnux V2 along with some good blog posts by Brad Garnett, Andrew Hay and Harlan Carvey and the Yahoo group Win4n6. In the news we have more Stuxnet and privacy issues with Facebook. Don't forget to check out the upcoming training events comingto a city … Continue reading Digital Forensics Case Leads: REMnux, Stuxnet, Facebook and more


Digital Forensics: In-depth analysis of SRM and BCWipe (for unix)

Secure wiping tools are nothing new, we've all seen and used them for a long time now. It's no mystery that these tools are used by intruders to cover their tracks by securely deleting files such as logs, or other files they downloaded onto compromised systems. Organizations also use these tools to securely delete confidential … Continue reading Digital Forensics: In-depth analysis of SRM and BCWipe (for unix)


Digital Forensics on a (less than) shoestring budget - Part 2

In my last post, I talked about the various ways one can find training resources to assist in getting started in the field of digital forensics. In this post, I will go over some of the free and low cost software you can use and related information. A few years ago when I was first … Continue reading Digital Forensics on a (less than) shoestring budget - Part 2